Google is reportedly using the Rust language to rewrite security-critical components of Android that execute outside of the Linux kernel, thus further reducing security vulnerabilities.

▲ Source Google Security Blog

Google claimed that last year’s survey showed Android’s security vulnerabilities, from 223 in 2019 to 85 in 2022, after analyzing the situation, Google believes that the reduction of memory vulnerabilities is mainly related to the increase in the proportion of Rust code.

The Rust language takes memory security into account, and at compile time, Rust can capture most memory security issues and avoid related vulnerabilities in the production environment.

In Android 13, about 21% of the new native code has been developed in Rust. Officially, most of these components run in user-level system services (i.e., Linux), but there are still a lot of components written in C++, and many of these safety-critical components run in bare-metal environments outside of the Linux kernel. Google is gradually increasing the use of Rust in the bare-metal environment in order to strengthen the security of Android devices.

Google claims that developers have rewritten the Android Virtualization Framework’s protected virtual machine (pVM) firmware in Rust to provide a secure foundation for the pVM root of trust.

▲ Source Google Security Blog

The PVM is said to work like a bootloader and is built on top of the open-source project U-Boot, but U-Boot is flawed in its design, and a number of researchers have found security vulnerabilities such as Integer Underflow and memory corruption in U-Boot, especially in the VirtIO driver, in the form of “boundary checking”. “boundary checking”, which has many problems.

Google says that they have already fixed the problems found in U-Boot, and by switching to Rust, they can also avoid similar memory security vulnerabilities in the future.

▲ Source Google Security Blog

Google is also contributing a number of new projects to support the Rust language in bare metal environments, such as fixing a number of bugs in existing virtio drivers and adding new features to the VirtIO driver for pVM firmware.

Google also plans to release more Rust packages and support bare-metal program development on all platforms. Google mentioned that while there are many limitations to applying Rust to bare-metal applications, Rust offers greater security and productivity than the C or C++ languages, and Google will continue to expand its use of Rust in the future.

THIS IS A SPONSOR PROMOTION: >>>>>>>>>>>>>

Geekwills is an online shop that connects consumers with millions of products and brands around the world with the mission to empower them to live their best lives. Geekwills is committed to offering the most affordable quality products to enable consumers and sellers to fulfill their dreams in an inclusive environment.

The post Google announces it is rewriting key Android components using the Rust language appeared first on TechGoing.

Note: Rust is a general-purpose, compiled programming language developed under the auspices of Mozilla. It is designed to be “safe, concurrent, and practical” and supports functional, concurrent, procedural, and object-oriented programming styles.

The industry consensus on Rust is that it is “safe”, and Microsoft is currently recompiling the Win11 kernel based on the language to further improve the security of the Win11 system.

Palo Alto Networks researchers have discovered P2PInfect, a Rust-based peer-to-peer worm that exploits the Lua Sandbox Escape vulnerability to remotely execute arbitrary code by targeting Redis, an open source database application heavily used in cloud environments.

The Lua Sandbox Escape vulnerability is tracked as CVE-2022-0543 and has a Critical CVSS rating of 10.0 (out of a maximum score of 10) in the NIST National Vulnerability Database, which indicates its danger.

The post P2PInfect Worm Exposed: Written on Rust, Executes Remote Code appeared first on TechGoing.

The Rust language does not require massive learning costs

The Google blog

The Rust compiler is not as fast as you might think

Google’s internal survey shows that more than 2/3 of respondents believe they can get started with Rust after only 2 months of learning, and 1/3 of respondents say they are now able to use Rust efficiently after learning it for 2 months previously. is not accurate.

Google’s survey shows that slow build speed is by far the number one challenge developers encounter when using Rust, and only 40% of respondents are comfortable with the speed of the Rust compiler.
unsafe code and interoperability are not the biggest challenges

Google refutes the anecdotal claim that “unsafe code and interoperability are always the biggest challenges” and the top three challenges they face in Rust, according to the Google developers interviewed, are more like

Macros

Ownership and borrowing

Async programming

In addition, writing unsafe code and dealing with C/C++ interoperability were also problems for Google developers, but not the biggest challenges.
Rust’s compiler error messages are very useful

The Rust compiler is mostly well-received within Google, with only 9% of respondents dissatisfied with the quality of diagnostic and debugging messages in Rust.

▲ Image Source Google Official Blog

The compiler messages are considered to be relatively good by the combined community feedback.

Rust’s code quality is high

The vast majority of Google respondents report that Rust code is of high quality – 77% of developers are satisfied with the quality of Rust code. When they were asked to compare “whether they think Rust code is more correct than code they write in other languages,” 85% of respondents believed their Rust code was correct.

In addition, Rust code is easy to review, with more than half of respondents saying that Rust code is very easy to review.

The post Google team: Rust language learning does not cost much and high-quality code can be written appeared first on TechGoing.

After gradually embracing Rust code, Google says it will fully support the Rust programming language next year. Google’s introduction of Rust for Chromium will make the open source browser simpler and more secure than C++, especially in terms of avoiding memory security vulnerabilities.

Rust is a general-purpose, compiled programming language developed under the direction of Mozilla. The Rust language was originally a private project of Mozilla employee Graydon Hoare, who sponsored the project in 2009 and made it publicly available for the first time in 2010. The Rust language was originally a private project of Mozilla employee Graydon Hoare, who sponsored it in 2009 and first made it public in 2010.

The post Making Google Chrome more secure, Google introduces Rust code for Chromium appeared first on TechGoing.