Security Issues in the Android Cross-Layer Architecture

نویسندگان

  • Alessandro Armando
  • Alessio Merlo
  • Luca Verderame
چکیده

The security of Android has been recently challenged by the discovery of a number of vulnerabilities involving different layers of the Android stack. We argue that such vulnerabilities are largely related to the interplay among layers composing the Android stack. Thus, we also argue that such interplay has been underestimated from a security point-ofview and a systematic analysis of the Android interplay has not been carried out yet. To this aim, in this paper we provide a simple model of the Android cross-layer interactions based on the concept of flow, as a basis for analyzing the Android interplay. In particular, our model allows us to reason about the security implications associated with the cross-layer interactions in Android, including a recently discovered vulnerability that allows a malicious application to make Android devices totally unresponsive. We used the proposed model to carry out an empirical assessment of some flows within the Android cross-layered architecture. Our experiments indicate that little control is exercised by the Android Security Framework (ASF) over cross-layer interactions in Android. In particular, we observed that the ASF lacks in discriminating the originator of a flow and sensitive security issues arise between the Android stack and the Linux kernel, thereby indicating that the attack surface of the Android platform is wider than expected.

برای دانلود رایگان متن کامل این مقاله و بیش از 32 میلیون مقاله دیگر ابتدا ثبت نام کنید

ثبت نام

اگر عضو سایت هستید لطفا وارد حساب کاربری خود شوید

منابع مشابه

Security considerations related to the use of mobile devices in the operation of critical infrastructures

An increasing number of attacks by mobile malware have begun to target critical infrastructure assets. Since malware attempts to defeat the security mechanisms provided by an operating system, it is of paramount importance to understand the strengths and weaknesses of the security frameworks of mobile device operating systems such as Android. Many recently discovered vulnerabilities suggest tha...

متن کامل

Aggrandizing the beast's limbs: patulous code reuse attack on ARM architecture

Since smartphones are usually personal devices full of private information, they are a popular target for a vast variety of real-world attacks such as Code Reuse Attack (CRA). CRAs enable attackers to execute any arbitrary algorithm on a device without injecting an executable code. Since the standard platform for mobile devices is ARM architecture, we concentrate on available ARM-based CRAs. Cu...

متن کامل

Android Multi-Level System Permission Management Approach

With the expansion of the market share occupied by the Android platform, security issues (especially application security) have become attention focus of researchers. In fact, the existing methods lack the capabilities to manage application permissions without root privilege. This study proposes a dynamic management mechanism of Android application permissions based on security policies. The pa...

متن کامل

DroidAuditor: Forensic Analysis of Application-Layer Privilege Escalation Attacks on Android DroidAuditor: Forensic Analysis of Application-Layer Privilege Escalation Attacks on Android

Smart mobile devices process and store a vast amount of securityand privacy sensitive data. To protect this data from malicious applications mobile operating systems, such as Android, adopt finegrained access control architectures. However, related work has shown that these access control architectures are susceptible to applicationlayer privilege escalation attacks. Both automated static and d...

متن کامل

Literature Analysis on Malware Detection

Usage of Android smartphones is more as compared to another smartphones due to its Open Source Operating System. Due to its Open OS, Android enables us to install third party applications. However, Security is one of the main concerns in Android. Security threats of malicious applications are rapidly increasing due to the nature of the third party applications where only developers can assign r...

متن کامل

ذخیره در منابع من


  با ذخیره ی این منبع در منابع من، دسترسی به آن را برای استفاده های بعدی آسان تر کنید

عنوان ژورنال:
  • CoRR

دوره abs/1209.0687  شماره 

صفحات  -

تاریخ انتشار 2012