Advertisement

On the Security and Engineering Implications of Finer-Grained Access Controls for Android Developers and Users

  • Yanick FratantonioEmail author
  • Antonio Bianchi
  • William Robertson
  • Manuel Egele
  • Christopher Kruegel
  • Engin Kirda
  • Giovanni Vigna
Conference paper
Part of the Lecture Notes in Computer Science book series (LNCS, volume 9148)

Abstract

One of the main security mechanisms in Android is the permission system. Previous research has pointed out that this system is too coarse-grained. Hence, several mechanisms have been proposed to address this issue. However, to date, the impact of changes in the current permission system on both end users and software developers has not been studied, and no significant work has been done to determine whether adopting a finer-grained permission system would be feasible in practice.

In this work, we perform the first study to explore the practicality of the adoption of finer-grained system for the Internet permission. In particular, we have developed several analysis tools that we used to perform an empirical study on 1,227 real-world Android applications. The results of this study provide useful insights to answer the following three conceptual questions: (1) Is it practical to apply fine-grained access control mechanisms to real-world Android applications? (2) How can a system for fine-grained permission enforcement be integrated into the application development and distribution life-cycle with minimal additional required effort? (3) What are the incentives and practical benefits for both developers and end users to adopt a fine-grained permission model? Our preliminary results show that, in general, finer-grained permissions could be practical and desirable for Android applications. In addition, we show how the tools we have developed can be used to automatically generate and enforce security policies, and thus could be used to lower the burden of adoption of finer-grained permission systems.

Keywords

Security Policy Configuration File Symbolic Execution Permission System Code Coverage 
These keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.

Notes

Acknowledgements

We thank the anonymous reviewers and our shepherd Simin Nadjm-Tehrani for their valuable feedback. The work is supported by National Science Foundation (NSF) under grant CNS-1408632, and by Secure Business Austria. This work is also sponsored by DARPA under agreement number FA8750-12-2-0101. The U.S. Government is authorized to reproduce and distribute reprints for Governmental purposes notwithstanding any copyright notation thereon. The views and conclusions contained herein are those of the authors and should not be interpreted as necessarily representing the official policies or endorsements, either expressed or implied, of NSF, DARPA, or the U.S. Government.

References

  1. 1.
    Arp, D., Spreitzenbarth, M., Malte, H., Gascon, H., Rieck, K.: Drebin: effective and explainable detection of android malware in your pocket. In: Proceedings of the Symposium on Network and Distributed System Security (NDSS) (2014)Google Scholar
  2. 2.
    Arzt, S., Rasthofer, S., Fritz, C., Bodden, E., Bartel, A., Klein, J., Le Traon, Y., Octeau, D., McDaniel, P.: FlowDroid: precise context, flow, field, object-sensitive and lifecycle-aware taint analysis for android apps. In: Proceedings of the ACM SIGPLAN Conference on Programming Language Design and Implementation (PLDI) (2014)Google Scholar
  3. 3.
    Au, K.W.Y., Zhou, Y.F., Huang, Z., Lie, D.: PScout: analyzing the android permission specification. In: Proceedings of the ACM Conference on Computer and Communications Security (CCS) (2012)Google Scholar
  4. 4.
    Backes, M., Gerling, S., Hammer, C., Maffei, M., von Styp-Rekowsky, P.: AppGuard – enforcing user requirements on android apps. In: Piterman, N., Smolka, S.A. (eds.) TACAS 2013 (ETAPS 2013). LNCS, vol. 7795, pp. 543–548. Springer, Heidelberg (2013) CrossRefGoogle Scholar
  5. 5.
    Barrera, D., Kayacik, H.G., Oorschot, P.V., Somayaji, A.: A methodology for empirical analysis of permission-based security models and its application to android. In: Proceedings of the ACM Conference on Computer and Communications Security (CCS) (2010)Google Scholar
  6. 6.
    Böhme, R., Grossklags, J.: The security cost of cheap user interaction. In: Proceedings of the Workshop on New Security Paradigms Workshop (NSPW) (2011)Google Scholar
  7. 7.
    Cao, Y., Fratantonio, Y., Bianchi, A., Egele, M., Kruegel, C., Vigna, G., Chen, Y.: EdgeMiner: automatically detecting implicit control flow transitions through the android framework. In: Proceedings of the Symposium on Network and Distributed System Security (NDSS) (2015)Google Scholar
  8. 8.
    Chin, E., Felt, A.P., Greenwood, K., Wagner, D.: Analyzing inter-application communication in android. In: Proceedings of the International Conference on Mobile Systems, Applications, and Services (MobiSys) (2011)Google Scholar
  9. 9.
    Davis, B., Chen, H.: RetroSkeleton: retrofitting android apps. In: Proceedings of the International Conference on Mobile Systems, Applications, and Services (MobiSys) (2013)Google Scholar
  10. 10.
    Davis, B., Sanders, B., Khodaverdian, A., Chen, H.: I-ARM-Droid: a rewriting framework for in-app reference monitors for android applications. In: IEEE Mobile Security Technologies (MoST) (2012)Google Scholar
  11. 11.
    Enck, W., Ongtang, M., McDaniel, P.: On lightweight mobile phone application certification. In: Proceedings of the ACM Conference on Computer and Communications Security (CCS) (2009)Google Scholar
  12. 12.
    Felt, A.P., Chin, E., Hanna, S., Song, D., Wagner, D.: Android permissions demystified. In: Proceedings of the ACM Conference on Computer and Communications Security (CCS) (2011)Google Scholar
  13. 13.
    Felt, A.P., Greenwood, K., Wagner, D.: The effectiveness of application permissions. In: Proceedings of the USENIX Conference on Web Application Development (WebApps) (2011)Google Scholar
  14. 14.
    Felt, A.P., Wang, H.J., Moshchuk, A., Hanna, S., Chin, E.: Permission re-delegation: attacks and defenses. In: Proceedings of the USENIX Security Symposium (USENIX Security) (2011)Google Scholar
  15. 15.
    Google: UI/Application Exerciser Monkey. http://developer.android.com/tools/help/monkey.html
  16. 16.
    Grace, M., Zhou, Y., Wang, Z., Jiang, X.: Systematic detection of capability leaks in stock android smartphones. In: Proceedings of the Symposium on Network and Distributed System Security (NDSS) (2012)Google Scholar
  17. 17.
    Grace, M., Zhou, Y., Zhang, Q., Zou, S., Jiang, X.: RiskRanker: scalable and accurate zero-day android malware detection. In: Proceedings of the International Conference on Mobile Systems, Applications, and Services (MobiSys) (2012)Google Scholar
  18. 18.
    Heuser, S., Nadkarni, A., Enck, W., Sadeghi, A.R.: ASM: a programmable interface for extending android security. In: Proceedings of the USENIX Security Symposium (USENIX Security) (2014)Google Scholar
  19. 19.
    Hornyack, P., Han, S., Jung, J., Schechter, S., Wetherall, D.: These aren’t the droids you’re looking for: retrofitting android to protect data from imperious applications. In: Proceedings of the ACM Conference on Computer and Communications Security (CCS) (2011)Google Scholar
  20. 20.
    Jeon, J., Micinski, K.K., Foster, J.S.: SymDroid: symbolic execution for dalvik bytecode. Technical report CS-TR-5022, University of Maryland, College Park (2012)Google Scholar
  21. 21.
    Jeon, J., Micinski, K.K., Vaughan, J.A., Fogel, A., Reddy, N., Foster, J.S., Millstein, T.: Dr. Android and Mr. Hide: fine-grained permissions in android applications. In: Proceedings of the ACM CCS Workshop on Security and Privacy in Smartphones and Mobile Devices (SPSM) (2012)Google Scholar
  22. 22.
    Lookout: 2014 Mobile Threat Report ((2014)). https://www.lookout.com/resources/reports/mobile-threat-report
  23. 23.
    Lu, L., Li, Z., Wu, Z., Lee, W., Jiang, G.: CHEX: statically vetting android apps for component hijacking vulnerabilities. In: Proceedings of the ACM Conference on Computer and Communications Security (CCS) (2012)Google Scholar
  24. 24.
    Nauman, M., Khan, S., Zhang, X.: Apex: extending android permission model and enforcement with user-defined runtime constraints. In: Proceedings of the ACM Symposium on Information, Computer and Communication Security (AsiaCCS) (2010)Google Scholar
  25. 25.
    Rasthofer, S., Arzt, S., Bodden, E.: A machine-learning approach for classifying and categorizing android sources and sinks. In: Proceedings of the Symposium on Network and Distributed System Security (NDSS) (2014)Google Scholar
  26. 26.
    Rastogi, V., Chen, Y., Enck, W.: AppsPlayground: automatic security analysis of smartphone applications. In: Proceedings of the ACM Conference on Data and Application Security and Privacy (CODASPY) (2013)Google Scholar
  27. 27.
    Russello, G., Jimenez, A.B., Naderi, H., van der Mark, W.: FireDroid: hardening security in almost-stock android. In: Proceedings of the Annual Computer Security Applications Conference (ACSAC) (2013)Google Scholar
  28. 28.
    Saltzer, J., Schroeder, M.: The protection of information in computer systems. Proc. IEEE 63(9), 1278–1308 (1975)CrossRefGoogle Scholar
  29. 29.
    Smalley, S., Craig, R.: Security enhanced (SE) android: bringing flexible MAC to android. In: Proceedings of the Symposium on Network and Distributed System Security (NDSS) (2013)Google Scholar
  30. 30.
    Smaragdakis, Y., Bravenboer, M., Lhoták, O.: Pick your contexts well: understanding object-sensitivity. In: Proceedings of the ACM Symposium on Principles of Programming Languages (POPL) (2011)Google Scholar
  31. 31.
    Tam, K., Khan, S.J., Fattori, A., Cavallaro, L.: CopperDroid: automatic reconstruction of android malware behaviors. In: Proceedings of the Symposium on Network and Distributed System Security (NDSS) (2015)Google Scholar
  32. 32.
    Viennot, N., Garcia, E., Nieh, J.: A measurement study of Google play. In: Proceedings of the ACM International Conference on Measurement and Modeling of Computer Systems (SIGMETRICS) (2014)Google Scholar
  33. 33.
    Wang, X., Sun, K., Wang, Y., Jing, J.: DeepDroid: dynamically enforcing enterprise policy on android devices. In: Proceedings of the Symposium on Network and Distributed System Security (NDSS) (2015)Google Scholar
  34. 34.
    Xu, R., Saidi, H., Anderson, R.: Aurasium: Practical policy enforcement for android applications. In: Proceedings of the USENIX Security Symposium (USENIX Security) (2012)Google Scholar
  35. 35.
    Zheng, C., Zhu, S., Dai, S., Gu, G., Gong, X.: SmartDroid: an automatic system for revealing UI-based trigger conditions in android applications. In: Proceedings of the ACM CCS Workshop on Security and Privacy in Smartphones and Mobile Devices (SPSM) (2012)Google Scholar
  36. 36.
    Zhou, Y., Jiang, X.: Dissecting android malware: characterization and evolution. In: Proceedings of IEEE Symposium on Security and Privacy (S&P) (2012)Google Scholar
  37. 37.
    Zhou, Y., Jiang, X.: Detecting passive content leaks and pollution in android applications. In: Proceedings of the Symposium on Network and Distributed System Security (NDSS) (2013)Google Scholar
  38. 38.
    Zhou, Y., Wang, Z., Zhou, W., Jiang, X.: Hey, you, get off of my market: detecting malicious apps in official and alternative android markets. In: Proceedings of the Symposium on Network and Distributed System Security (NDSS) (2012)Google Scholar

Copyright information

© Springer International Publishing Switzerland 2015

Authors and Affiliations

  • Yanick Fratantonio
    • 1
    Email author
  • Antonio Bianchi
    • 1
  • William Robertson
    • 2
  • Manuel Egele
    • 3
  • Christopher Kruegel
    • 1
  • Engin Kirda
    • 2
  • Giovanni Vigna
    • 1
  1. 1.University of CaliforniaSanta BarbaraUSA
  2. 2.Northeastern UniversityBostonUSA
  3. 3.Boston UniversityBostonUSA

Personalised recommendations