The newest version of Google's Android mobile operating system has been upgraded to make it harder for hackers to hijack handsets by exploiting code errors in the underlying code.
Android 4.0, aka Ice Cream Sandwich, has added a mitigation known as ASLR, or address space layout randomization. It works by routinely changing the memory locations where software components are loaded. As a result, it's much harder for attackers to execute malicious code even when they've identified an otherwise serious vulnerability because they don't know where Android will load their exploit's payload.
Microsoft Windows, Mac OS X and Apple's iOS rely on ASLR to minimize the risk of someone successfully attacking a system when targeting flaws that are inevitable in every complex piece of code.
“Android 4.0 now provides address space layout randomization (ASLR) to help protect system and third party applications from exploitation due to memory-management issues,” a note posted to the Android Developers blog said.
Ice Cream Sandwich has also been upgraded to more securely manage private keys used to encrypt data and authenticate websites.
“Any application can use the keychain API to install and store user certificates and CAs securely,” the blog post said. ®