Better Performance Through Thread-local Emulation Ali Razeen, Valentin Pistol, Alexander Meijer, and Landon P. Cox Duke University

Goal: Track how apps use data 2

3

4

“What is the app doing?” What is the app doing after taking a picture? Is it creating multiple copies of the picture? 5

Dynamic taint tracking 6 Log when photos are saved as files 01: Image pic = takePicWithCamera(); 02: Image newPic = copy(pic); 03: crop(newPic); 04: modify(newPic); 05: writeToFile(newPic, “my_picture.png”); Mark as “taint source” Tainted due to “taint propagation rules” Mark the file system as a “taint sink”

Dynamic taint tracking Detecting and defeating malware TaintCheck (Newsome `05), Panorama (Yin`07) Attest to the authenticity of sensor data YouProve (Gilbert `11) Minimize exposure of sensitive data Clean OS (Tang `12) Manage app data in logical units Pebbles (Spahn `14) Track how apps use passwords SpanDex (Cox `14) Improve energy efficiency of apps MobileHub (Shen `15) 7

YouProve [Gilbert `11] 8 Was the swan really there?

YouProve [Gilbert `11] 9 Prove that camera images are authentic 01: Image pic = takePicWithCamera(); 02: Image newPic = copy(pic); 03: crop(newPic); 04: modify(newPic); 05: writeToFile(newPic, “my_picture.png”); The camera is a taint source The file system is a taint sink Original

YouProve [Gilbert `11] 10 OriginalnewPic Picture analyzer Authenticity certificate

TaintDroid [Enck ‘10] Implemented within the Dalvik VM – Dalvik is a managed runtime like the Java VM Reasonably good performance – Overhead of about 14% – Running apps on a VM is slow to begin with – Taint tracking logic does not add significant overhead Hardware Linux Kernel Android Platform Dalvik VM Core Libraries 11

The trend to native code 12 Tracking native code is expensive! 10 to 30x slowdown TaintCheck (Newsome ‘05), Dytan (Clause ’07)

Selective taint tracking Perform tracking only the camera is used – 1. Disassemble an app’s instructions – 2. Perform taint propagation – 3. Execute the app instruction – 4. Proceed until app stops using tainted data Otherwise, apps run normally Implemented using page protections Demand Emulation (Ho ’06) Overhead is amortized over app’s lifetime! 13

Apps are multi-threaded takePicWithCamera() Only emulate the threads handling tainted data UI Thread Worker Thread 1 Worker Thread 2 Worker Thread 3 14

Thread-local emulation takePicWithCamera() How can we interpose on memory accesses on a thread-level basis? Worker Thread 2 Worker Thread 3 UI Thread Worker Thread 1 Only the threads handling tainted data are emulated 15

16 UI Thread Worker Thread 1 Worker Thread 2 Worker Thread 3 Memory How does emulator access tainted data in protected page? Tainted data in protected page Memory organized in pages Remove page protections Not emulated!

17 UI Thread Worker Thread 1 Worker Thread 2 Worker Thread 3 Memory Emulate everything! We want thread-local emulation

Page table tricks 18 UI Thread Worker Thread 1 Worker Thread 2 Worker Thread 3 Virtual Memory Physical Memory

Alternative approaches Software Techniques: – Virtual page table tricks (Appel and Li ’91) Hardware techniques: – ARM memory domains – Virtualization features Dune (Belay ’12) 19

Limitations 20 Tainted data on UI thread!

Conclusion Dynamic taint tracking is useful Modern mobile platforms exhibit a shift to native code Need native code taint tracking Require thread-local emulation for performance Plenty of research and implementation questions left 21

Thread-level Memory Access UI Thread Worker Thread 1 Worker Thread 2 Worker Thread 3 Process Emulator implemented as thread-specific signal handler. Page protections at thread-granularity.

The Elephant in the Room 23 Implicit Flows

Might not be a problem. YouProve (Gilbert’11) May be quantified in certain contexts. SpanDex (Cox ‘14) Ideas from static taint analysis may be used. MobileHub (Shen ’15) 24

Implicit Flows 25 01: int someVal = getTaintedValue(); 02: bool lessThanTwenty = false; 03: if (someVal < 20) { 04: lessThanTwenty = true; 05: } 06: if (lessThanTwenty) { 07: doSomethingHere(); 08: } Should this be tainted? Exploitable by malicious apps. Unclear.

YouProve [Gilbert `11] 26 Prove that sensor data is authentic. 01: Image pic = takePicWithCamera(); 02: Image newPic = copy(pic); 03: crop(newPic); 04: modify(newPic); 05: writeToFile(newPic, “my_picture.png”) Original Authenticity certificate will not be generated!