Google extends its Android TLS adoption program; covers 80% apps by default

Google announced this week that 80 percent of Android apps are encrypting traffic by default. The percentage is even greater for apps targeting Android 9 and higher, with 90 percent of them encrypting traffic by default.

Android is committed to keeping users, their devices, and their data safe. One of the ways that Google is keeping data safe is by protecting network traffic that enters or leaves an Android device with Transport Layer Security (TLS). 

Android 7 (API level 24) introduced the Network Security Configuration in 2016, allowing app developers to configure the network security policy for their app through a declarative configuration file. To ensure apps are safe, apps targeting Android 9 (API level 28) or higher automatically have a policy set by default that prevents unencrypted traffic for every domain.

The Network Security Configuration feature lets apps customize their network security settings in a safe, declarative configuration file without modifying app code. These settings can be configured for specific domains and for a specific app. 

This feature can customize which Certificate Authorities (CA) are trusted for an app's secure connections. For example, trusting particular self-signed certificates or restricting the set of public CAs that the app trusts. It also safely debugs secure connections in an app without added risk to the installed base; protects apps from accidental usage of cleartext traffic; and restricts an app's secure connection to particular certificates.

Since Nov. 1 2019, all app (updates as well as all new apps on Google Play) must target at least Android 9. As a result, we expect these numbers to continue improving. Network traffic from these apps is secure by default and any use of unencrypted connections is the result of an explicit choice by the developer.

The latest releases of Android Studio and Google Play’s pre-launch report warn developers when their app includes a potentially insecure Network Security Configuration (for example, when they allow unencrypted traffic for all domains or when they accept user provided certificates outside of debug mode). 

This encourages the adoption of HTTPS across the Android ecosystem and ensures that developers are aware of their security configuration.

Google Security expands its Android Security rewards program

Google is expanding its Android Security Rewards (ASR) program and increasing reward amounts, by introducing a top prize of US$1 million for a full chain remote code execution exploit with persistence which compromises the Titan M secure element on Pixel devices. Additionally, the search engine giant will release a specific program offering a 50 percent bonus for exploits found on specific developer preview versions of Android, offering a top prize of $1.5 million.

The rewards program was created in 2015 to reward researchers who find and report security issues to help keep the Android ecosystem safe. Over the past 4 years, Google has awarded over 1,800 reports, and paid out over four million dollars.

The Android Security Rewards program recognizes the contributions of security researchers who invest their time and effort in helping Google make Android more secure. The reward level is based on the bug severity and increases for complete reports that include reproduction code, test cases, and patches.

Android Security Rewards covers bugs in code that runs on eligible devices and isn't already covered by other reward programs at Google. Eligible bugs include those in AOSP code, OEM code (libraries and drivers), the kernel, the Secure Element code, and the TrustZone OS and modules. Vulnerabilities in other non-Android code, such as the code that runs in chipset firmware, may be eligible if they impact the security of the Android OS.

Earlier this year, Gartner rated the Pixel 3 with Titan M as having the most “strong” ratings in the built-in security section out of all devices evaluated. Due to this, Google has created a dedicated prize to reward researchers for exploits found to circumvent the secure elements protections.

In addition to exploits involving Pixel Titan M, Google has added other categories of exploits to the rewards program, such as those involving data exfiltration and lockscreen bypass. These rewards go up to $500,000 depending on the exploit category. 

During this year, Google made total payouts over the last 12 months to the tune of over $1.5 million. Over 100 participating researchers have received an average reward amount of over $3,800 per finding (46 percent increase from last year), and the top reward that was paid out this year was $161,337.

The highest reward paid out to a member of the research community was for a report from Guang Gong (@oldfresher) of Alpha Lab, Qihoo 360. This report detailed the first reported 1-click remote code execution exploit chain on the Pixel 3 device. 

Guang Gong was awarded $161,337 from the Android Security Rewards program and $40,000 by Chrome Rewards program for a total of $201,337. The $201,337 combined reward is also the highest reward for a single exploit chain across all Google VRP programs. The Chrome vulnerabilities leveraged in this report were fixed in Chrome 77.0.3865.75 and released in September, protecting users against this exploit chain.

Gartner reports that global smartphone demand weak in third quarter this year, as Apple and Xiaomi find their shares declining

Global sales of smartphones to end users continued to decline in the third quarter of 2019, contracting by 0.4 percent compared with the third quarter of 2018, according to data released Tuesday by analyst firm, Gartner. Demand remained weak as consumers became more concerned about getting value for money.

This shift has led brands such as Samsung, Huawei, Xiaomi, OPPO and Vivo to strengthen their entry-level and mid-tier portfolios. This strategy helped Huawei, Samsung and OPPO grow in the third quarter of 2019. By contrast, Apple recorded another double-digit decline in sales, year over year.

Huawei was the only one of the top-five global smartphone vendors to achieve double-digit growth in smartphone sales in the third quarter of 2019. The company sold 65.8 million smartphones, an increase of 26%, year over year. Huawei’s performance in China was the key driver of its global smartphone sales growth. It sold 40.5 million smartphones in China and increased its share of the country’s market by almost 15 percentage points.

While the ban on Huawei to access key U.S. technologies is yet to be fully implemented as a three-month extension was just announced, the proposed ban brought negativity around Huawei’ brand in the international market. Nevertheless, Huawei’s strong ecosystem in China continued to show growth. 

The current situation with the U.S. has also fostered patriotism among Huawei’s partners, which are now keener to promote its smartphones in China — a development that makes it difficult for local competitors to compete aggressively against Huawei. Huawei’s long investment in subbrands (Honor and Nova), in multichannel operations (online and retail), and in 5G and other technological innovation forms the basis of its success in China.

Samsung maintained the top position globally in the third quarter of 2019, by increasing its smartphone sales by 7.8 percent, year over year. “Samsung’s aggressive revamp of its portfolio, with a focus on midtier and entry-tier segments, strengthened its competitive position,” said Anshul Gupta, senior research director at Gartner.

Apple’s iPhone sales continued to decline in the third quarter of 2019. Apple sold 40.8 million iPhones, a year-over-year decline of 10.7%. “Although Apple continued its sales promotions and discounts in various markets, this was not enough to stimulate demand globally,” said Gupta. “In the Greater China market sales of iPhones continued to improve, however, it follows a double-digit decline recorded at the beginning of the year. The iPhone 11, 11 Pro and 11 Pro Max saw good initial adoption, which suggests that sales may be positive in the remaining quarter.”

With Black Friday and Cyber Monday approaching, smartphone deals are likely to spur consumer demand in the fourth quarter of 2019. Vendors including Google and Samsung are likely to offer aggressive price promotions not just for their older smartphones but also for new devices such as the Google Pixel 4 and Samsung Galaxy Note 10.

Competition between mobile phone manufacturers will increasingly focus on more intelligent smartphones. These devices will deliver increasingly personalized content and services that draw on users’ contexts and preferences. 

“To deliver relevant personalized experiences, manufacturers will need to improve the integration of artificial intelligence (AI) in smartphones and make security capabilities and privacy key aspects of their brands,” said Roberta Cozza, senior research director at Gartner.

At a time of limited technology-led innovation, product managers should focus on offering attractive features at low prices as quickly as possible. By offering better value for money, they can increase demand for smartphones.

“For the majority of smartphone users, desire has shifted away from owning the least expensive smartphone. Today’s smartphone user is opting for midtier smartphones over premium-tier ones because they offer better value for money,” said Gupta. “In addition, while waiting for 5G network coverage to increase to more countries, smartphone users are delaying their purchase decisions until 2020.”

Google announces progress on effects of AI to the reporting process, beginning with news gathering and distribution

Google released Monday a report which highlights how AI offers new powers to journalists across the reporting process, from news gathering to distribution. It also underlines how news organizations that want to explore this potential must be ready to consider and carefully monitor the ethical and editorial implications of these new technologies.

This research is the result of Journalism AI, a year-long collaboration between Polis, the international journalism think tank at the London School of Economics and Political Science, and the Google News Initiative, to educate newsrooms about the potential offered by AI-powered technologies through research, training and networking.

The Journalism AI report is based on a survey of 71 news organisations in 32 different countries regarding artificial intelligence and associated technologies. A wide range of journalists working with AI answered questions about their understanding of AI, how it was used in their newsrooms, and their views on the wider potential and risks for the news industry.

What emerges from this research is that AI is a significant part of journalism already but it is unevenly distributed. AI is giving journalists more power, but with that comes editorial and ethical responsibilities.

The future impact of AI is uncertain but it has the potential for wide-ranging and profound influence on how journalism is made and consumed. AI can free up journalists to work on creating better journalism at a time when the news industry is fighting for economic sustainability and for public trust and relevance. It can also help the public cope with a world of news overload and misinformation and to connect them in a convenient way to credible content that is relevant, useful and stimulating for their lives.

Artificial intelligence is helping transform many businesses, and journalism is no exception. Newsrooms are already using AI to help organize and find videos and images, transcribe interviews in multiple languages and much more. But the industry  is still trying to understand the full impact AI can have.  

Newsrooms around the world are experimenting with AI, and responses to the Journalism AI survey came from 71 media organizations in 32 countries. Publishers, editors and reporters shared their detailed thoughts on the potential of AI for the news industry, how it is impacting their organizations and the risks and challenges involved with this new wave of technological innovation. 

The findings make it clear that journalism should pay attention to AI, which has the potential for wide-ranging and profound influence on how journalism is made and consumed. 

On one side, AI technologies promise to free up time for journalists to work on the more creative aspects of the news production, leaving tedious and repetitive tasks to machines. At a time when the news industry is fighting for economic sustainability and for the public’s trust, it’s easy to see why this promise is highly attractive.

On the other side, via personalization and smart recommendations, AI can help the public cope with news overload, connecting them in a convenient way to credible content that is relevant, useful, and stimulating for their lives.

AES partners with Google to develop and implement solutions that enable broader adoption of renewable energy

The AES Corp. announced that it is entering into a ten-year strategic alliance with Google to accelerate the growth and adoption of clean energy by leveraging Google Cloud technology to pioneer innovation in the sector. This alliance builds on the recent agreement between Google and AES to provide long-term renewable power to Google’s data center in Chile.

As part of this alliance, AES will use Google Cloud technology to help create the grid of the future and improve the experience for energy customers. AES innovation partner, Uplight, will also utilize Google Cloud technology to enhance its end-to-end energy action system, to increase customer satisfaction and reduce carbon emissions. 

Google Cloud’s platform, tools and technology will help redefine and improve AES and Uplight’s delivery of customer solutions through advanced cloud computing, data analytics, machine learning (ML) and artificial intelligence (AI).

The two companies will work together to improve the experience for corporate energy customers and to develop and implement solutions that enable broad adoption of clean energy. 

AES will collaborate with Google Cloud on energy management and opportunities to sponsor clean energy projects in targeted markets in the United States and Latin America that have the potential to help Google meet its clean energy objectives.

“AES has been working with its customers to accelerate the transformation of the electric sector through energy storage, renewables and energy efficiency. Today, we are one of the largest renewables solutions providers and developers in the world,” said Andrés Gluski, AES president and CEO. “We’re proud to have been selected by Google to form this strategic alliance. By combining the capabilities, footprint and experience of both companies, we will be able to provide better and more efficient energy solutions.”

“Cloud technology is an enabler for forward-leaning organizations seeking to put customers at the center of their business strategies,” said Thomas Kurian, CEO of Google Cloud. “Together, AES and Google Cloud will leverage the cloud, AI/ML and data analytics to help transform the energy industry’s infrastructure, while driving wider adoption of renewable energy around the world.”