Android 4.4.4 rolls out to several Nexus devices

Google quietly updates KitKat with security fixes, including one patch for a flaw discovered in OpenSSL after the notorious Heartbleed bug was uncovered.

Even though Android 4.4.3 KitKat has only been out a couple of weeks, Google quietly released an updated version to its operating system on Thursday.

Android 4.4.4 is now available for download on several Nexus devices via theNexus Factory Image page. Those devices listed for the update include the Nexus 4, 5, 7, and 10.

Based on scant information from the Nexus Factory Image page and a Google+ post from Android Engineering Program Manager Sascha Prüter, this new Android 4.4.4 version is fairly minor and basically entails a few security patches. Prüter hinted that the update primarily addresses the CVE-2014-0224 flaw, which wasdiscovered in OpenSSL after the notorious Heartbleed bug was uncovered.

According to Prüter, more information on the update will be available within another 48 hours. It's unclear when Android 4.4.4 will be rolled out to other devices.

Google unveiled Android 4.4.3 earlier this month, which brought an improved dialer with a new interface and more colors designed to be user-friendly. The update also delivered bug fixes, security patches, and overall stability improvements, including a fix aimed at resolving battery drain that occurred with camera use.

Google's security guru finds flaws in Microsoft's products

On Tuesday, Microsoft warnedthat it was issuing an emergency patch to fix a dangerous flaw in its software.

This is notable for a few reasons. Microsoft rarely releases these kinds of urgent patches, onlynine of them so far in 2014. It normally saves all patches for one mega patch day once a month.

The software in question is Microsoft's nearly entire family of security software. That means that the software Microsoft designed to protect computers from hackers can be hacked. In this case, it can be turned off, and from there, the hacker could do more harm.

The person who found the flaw was none other than Microsoft's security nemesis, Tavis Ormandy.

Google security researcher Tavis Ormandy

Ormandy is a well-respected Google engineer who has become famous for finding problems with Microsoft software and, sometimes, showing hackers how to use them before Microsoft has fixed them.

This time, it looks like Ormandy did not share the problem before Microsoft could fix it.

And that's a good thing, because the vulnerable software includes everything from Microsoft's free Windows antivirus program, Microsoft Security Essentials, to its corporate security product family, Forefront. It also includes Intune, the security cloud service Microsoft has been heavily hawking to enterprises.

But Microsoft knows Ormandy could share the problem if he feels that company is dragging its feet.

A year ago, when he found a bug that let hackers crash or gain control over Windows, he not only discussed the bug before Microsoft had fixed it, he released "exploit" code that showed them how to work with the bug.

It's all part of a long-running skirmish between Microsoft and Ormandy, pressuring Microsoft to respond faster to security problems.

Microsoft has an age-old reputation for doing a poor job with security, in part because Windows is so popular it is a constant target for hackers.

Back in 2010, Ormandy really pushed the company, angering many in the security world along the way. He gave Microsoft only five days between the time he told them about a flaw and the time he published information about it.

The previous standard in the security world was 30 to 60 days. Security pros are anxious to publish information on the flaws they find. That's how they build their reputations and their careers.

Last year, Google backed Ormandy and changed its disclosure policy. It said that if its engineers find security flaws in other's code, they will only wait seven days before making it public to the world.

Their goal, Google said, was to make all companies move faster when they need to fix their software.

Meanwhile, Ormandy continues to breathe down Microsoft's neck. His latest interest? Windows 8.