Second verse, same as the first. Two days ago the CyanogenMod ROM team announced a security update to the CM 10.1 platform, incorporating the "Master Key" security patch that Google had already issued back in February. Yesterday another, more intricate exploit in the same vein was posted by a Chinese blog, and again, Google has rapidly moved to patch the problem in Android... which won't be much comfort to those running an older release.
While most Android users are waiting on updaters that might patch some of the recently reported security holes, CyanogenMod is already getting a bug fix update out the door. CyanogenMod 10.1.1 is now hitting the stable channel for all supported devices.
The Master Key exploit will be presented by Jeff Forristal at Black Hat 2013 as "One Root To Own Them All." It's essentially a bug in signature verification which can be used to insert malicious code into an APK.
If you're reading this on a later GSM-only Samsung device, pay attention. After clarifying their continuing support for Tegra 2 devices earlier this week, the CyanogenMod ROM team wants to let you know about their position vis-à-vis Samsung's Exynos 4 series of chipsets. In a nutshell: devices based on the Exynos 4 will be getting CyanogenMod 10.1 (Android 4.2) nightly builds, and not much else. These phones and tablets will not be getting stable releases of the latest CyanogenMod builds for the time being.
Hey there, 2012-era HTC smartphone owners. Wondering where your CyanogenMod nightly builds went? We were too, at least until CM team member Ethan Chen posted a short update on his Google+ page. New CyanogenMod 10.1 nightly builds are now rolling out for the HTC One XL (codename evita), One S (ville), Sprint's EVO 4G LTE (jewel), and Verizon's DROID Incredible LTE (fireball). You can find them all on the get.cm download page.
We don't need no NSA up is our business, right? CyanogenMod recently added the Privacy Guard feature to nightlies to protect user data from sketchy apps, but the next innovation might go deeper than that. Koushik Dutta (Koush) has started development of a secure messaging platform for CyanogenMod devices.
Koush expressed his admiration for the elegance of iMessage in his post, and he wants to do the same for CyanogenMod. To that end, Koush has built an encrypted open source push messaging plugin for CM that would stand in for regular SMS.
CyanogenMod and other aftermarket ROMs are often the last recourse for tech-savvy users whose hardware has fallen behind the curve, or just been forgotten by a manufacturer or carrier. But even the CyangoenMod team can't keep supporting devices forever. In a Google+ post today, the CM team states that due to technical limitations, support for phones and tablets using the NVIDIA Tegra 2 chipset will end with the next major Android release.
The CyanogenMod team has announced the release candidate phase of CM 10.1 is over – the final version is going to drop later today. If your device has been getting the RC builds, you can expect a final version of this popular ROM to be waiting for you in the morning.
Devices that haven't been updated to release candidate builds up to now won't be part of this first push. That includes Tegra 2 phones and tablets, as well as some Samsung Exynos devices.
Privacy Guard, the feature formerly known as Incognito Mode for apps, will make its way into CyanogenMod starting tonight. Steve Kondik, Mr. Cyanogen himself, has merged the ability to enable Privacy Guard support into all future nightly builds. Just to be clear, this new feature is not included in the 10.1.0 RC or stable releases currently available. Only those who like to walk on the wild side are getting their hands on this feature right away.
A new CyanogenMod feature is currently under review, and it looks staggeringly cool. Developed by Nebojsa Cvetkovic, this addition would place a new camera tile in the Quick Settings panel. Tap it, and you get a live viewfinder capable of taking snapshots right from the notification shade.