359 flaws found in Android

INSECURITY EXPERTS at Coverity have issued a report on kernel flaws found in the Android mobile operating system.

The "Scan 2010 Open Source Integrity Report" picked one flavour of Android because each kernel is tinkered with by the hardware maker.

It chose the HTC Droid Incredible to pull to bits because one of the sales engineers had one and wanted to know how bad it really was. Not the most scientific selection process but better than sticking them on the wall and throwing a dart at them.

It turned out that the Android operating system on the sales engineer's phone had some bugs.

The average defect density for the Android kernel was 0.47 defects per 1,000 lines of code. This is actually pretty good, half of what you'd expect compared to the industry average of 1 defect per 1,000 lines of code.

There were 359 defects in total and of these, 88 of the defects were "high risk", a category that includes memory corruption, resource and memory leaks, and uninitialized variables.

The Android-specific portions of the kernel have a higher defect density than the rest of the Linux kernel.

The security outfit found the code at the HTC's developer site, configured, built, and analyzed it.

It is sending all the details to HTC and other insecurity outfits before it goes public with them. Otherwise you might get some nasty hackers having a field day. µ