Systematic Detection of capability leaks in stock android smartphones 2018/9/20 Systematic Detection of capability leaks in stock android smartphones Michael Grace, Yajin Zhou, Zhi Wang, Xuxian Jiang North Carolina State University NDSS 2012

Outline Introduction System Design Implementation Evaluation 2018/9/20 Outline Introduction System Design Implementation Evaluation Discussion Related Work Conclusions

2018/9/20 Introduction Wookpecker systematically analyzes each app on the phone to explore the reachability of a dangerous permission from a public, unguarded interface.

Introduction Explicit Capability Leaks Implicit Capability Leaks 2018/9/20 Introduction Explicit Capability Leaks Allow an app to successfully access certain permissions by exploiting some publicly-accessible interfaces or services without actually requesting these permissions by itself Implicit Capability Leaks Allow the same, but instead of exploiting some public interfaces or services, permit an app to acquire or “inherit” permissions from another app with the same signing key (presumably by the same author)

2018/9/20 Introduction Focus on 13 representative privileged permissions that protect sensitive user data or phone features Among these 13 privileged permissions, 11 were explicitly leaked, with individual phones leaking up to eight permissions

2018/9/20 System Design Focus on those permissions used by the pre-loaded apps as part of an Android phone’s firmware, since the firmware has access to some permissions that are too privileged to be granted to third-party apps

2018/9/20 System Design Starting from some public interface, there exists an execution path that can reach some use of the capability If this public interface is not guarded by a permission requirement, and the execution path does not have sanity checking in place to prevent it from being invoked by another unrelated app, we consider the capability leaked.

2018/9/20 System Design Implicit capability leaks arise from the abuse of an optional attribute in the manifest file, i.e.,“sharedUserId” As permissions are granted to user identifiers, this causes all the apps sharing the same identifier to be granted the union of all the permissions requested by each app.

System Design - Explicit Capability Leak Detection 2018/9/20 System Design - Explicit Capability Leak Detection First: possible-path identification Extract a pre-loaded app’s Dalvik bytecode, then build a CFG to locate possible execution paths Issue 1: object references Issue 2: extensive use of callbacks

System Design - Explicit Capability Leak Detection 2018/9/20 System Design - Explicit Capability Leak Detection Second: feasible path refinement Symbolic path simulation Many potential paths exist Most are either impossible or uninteresting Must prune these uninteresting paths Explicit permission checks are “infeasible paths”

System Design - Implicit Capability Leak Detection 2018/9/20 System Design - Implicit Capability Leak Detection If an app has a sharedUserId in its manifest but does not request a certain (dangerous) permission, we also need to investigate the possibility of an implicit capability leak

System Design - Implicit Capability Leak Detection 2018/9/20 System Design - Implicit Capability Leak Detection We consider a capability to have been implicitly leaked if there is any way to exercise it, which is different from explicit capability leak detection

Implementation Using baksmali disassembler tool Using adb to obtain 2018/9/20 Implementation Using baksmali disassembler tool Using adb to obtain /system/app and /system/framework AndroidManifest.xml sharedUserId attribute Compute the actual set of permissions granted to each pre-loaded app classes.dex or odex

Implementation Control-Flow Graph Construction Entry Point AIDL 2018/9/20 Implementation Control-Flow Graph Construction Entry Point AIDL Binder.onTransact() Callbacks EX: Thread().start()  run() onTransact() 是 Service 收到 request 的處理函數

2018/9/20 Implementation Cover 13 permissions:

Implementation Capability Leak Detection 2018/9/20 Implementation Capability Leak Detection List the related APIs that might exercise the permissions The available API documentation is incomplete about which APIs a permission grants access to “android.permission.MASTER_CLEAR” – for factory reset Explicit If a state exists that contains a dangerous-call field modification and does not have the corresponding permission-check flag set

2018/9/20 Evaluation Eight studied Android smartphones:

2018/9/20 Evaluation Capability leak results

2018/9/20 Evaluation Smartphones with more pre-loaded apps tend to be more likely to have explicit capability leaks Nexus One / Nexus S com.svox.pico defines which can be tricked to remove another app, com.svox.pico.langpack.installer by any other third-party app

Evaluation – Case Study 2018/9/20 Evaluation – Case Study Explicit Capability Leaks (without Arguments) Samsung Epic 4G com.sec.android.app.SelectiveReset app Intent android.intent.action.SELECTIVE_RESETIntent SelectiveResetService Intent SelectiveResetReceiver SelectiveResetApp masterClear()

Evaluation – Case Study 2018/9/20 Evaluation – Case Study Explicit Capability Leaks (without Arguments) HTC EVO 4G REBOOT and SHUTDOWN FREESE

Evaluation – Case Study 2018/9/20 Evaluation – Case Study Explicit Capability Leaks (with Arguments) HTC com.android.mms  com.htc.messaging.service.SmsSenderService Intent with Extras

Evaluation – Case Study 2018/9/20 Evaluation – Case Study Explicit Capability Leaks (with Arguments) Samsung Epic 4G CALL_PHONE Technical assistance HTC RECORD_AUDIO

Evaluation – Case Study 2018/9/20 Evaluation – Case Study Implicit Capability Leaks HTC Wildfire S com.android.MessageTab Use CALL_PRIVILEGED w/o declaring it in manifest file sharedUserId: “android.uid.shared” com.android.MessageTab.ContactDetailMessageActivity2 android.mms.ui.MessageUtils.getMakeCallDirectlyIntent()

2018/9/20 Evaluation Performance – processing time

Discussion Confused deputy attack Avoid unsafely exposing capabilities 2018/9/20 Discussion Confused deputy attack Inter-app interactions are usually application-specific, so it’s hard for Android framework to infer the associated semantics Avoid unsafely exposing capabilities Develop a validator tool releasing w/ Android SDK App-defined permissions 3rd-party capability leaks

Related Work Problems with Permissions Information Leak Detection 2018/9/20 Related Work Problems with Permissions Kirin, Soundcomber, Guess Who’s Texting You Information Leak Detection TaintDroid Market Issue DroidRanger

2018/9/20 Conclusions Capability leaks present a tangible threat to security and privacy on existing Android smartphones We present a system, Woodpecker, to detect these capability leaks