Most changes are aimed at developers, but end users benefit from better security
Several days have passed since Google kicked off the rollout of Android 4.2.2 Jelly Bean and the first details on the changes included in the update have just started to pour in.Even though we have already found some of the improvements added by Android 4.2.2, it appears that there are a lot more that we didn’t know about.
Fred Chung from Android Developer Relations team has just detailed some of the new features and improvements included in Android 4.2.2 Jelly Bean, though we’re pretty sure these are only a fraction of what’s new in the update.
According to Chung, most of the security features introduced in Android 4.2 are aimed at developers: “regardless whether you are targeting your app to devices running Jelly Bean or to earlier versions of Android, it's a good idea to validate these areas in order to make your app more secure and robust,” says Chung in his post.
The first improvement detailed by Chung is Content Provider default access, which has been changed to “not exported.” This will help avoid inadvertent data sharing as the content provider will no longer be accessible by other apps by default.
There’s also a new implementation of SecureRandom which is based on OpenSSL. Chung describes this new change as follows:
“In the older Bouncy Castle-based implementation, given a known seed, SecureRandom could technically (albeit incorrectly) be treated as a source of deterministic data. With the new OpenSSL-based implementation, this is no longer possible.”
Another new improvement, secure USB debugging, is aimed at end users and developers alike. Google introduced a new way of protecting apps and data on Android devices. With Android 4.2.2 users will need to authorize a host computer in order to access the internals of a device.
Basically, secure debugging, which is part of the ADB protocol, will now require hosts to authenticate before accessing any ADB services or commands. USB debugging for a single session, multiple sessions or for all future sessions are among the list of options users can choose from.