Machigar Ongtang, Stephen McLaughlin, William Enck, Patrick McDaniel Department of Computer Science and Engineering The Pennsylvania State University ACSCA /12/8 1 Advanced Defense Laboratory

Outline IIntroduction SSmartphone Application Security AAndroid AApplication Policies SSAINT Policy SSAINT Architecture RRelated Work CConclusion 2009/12/8 2 Advanced Defense Laboratory

Introduction  Applications on mobile platform  Apple’s App Store Apple’s App Store  Android’s Market Android’s Market  BlackBerry App World BlackBerry App World  Android Security  Using permission label 2009/12/8Advanced Defense Laboratory 3

Introduction (cont.)  In Manifest.xml:  You can not use the functions which are not in your application permission 2009/12/8Advanced Defense Laboratory 4

Introduction (cont.)  Users are impossible to make good choices about the application permissions  The Android system protects the phone from malicious applications, but provides severely limited infrastructure for applications to protect themselves 2009/12/8Advanced Defense Laboratory 5

Introduction (cont.)  Android Security Framework  Permission Assignment Policy  Interface Exposure Policy  Interface Use Policy  Secure Application INTeraction (Saint) framework  Installation-time Policy  Runtime Policy 2009/12/8Advanced Defense Laboratory 6

Outline IIntroduction SSmartphone Application Security AAndroid AApplication Policies SSAINT Policy SSAINT Architecture RRelated Work CConclusion 2009/12/8 7 Advanced Defense Laboratory

Smartphone Application Security  Example: 2009/12/8Advanced Defense Laboratory 8 PeronalShopper only trust Secure Payment and Trust Checkout. Password vault app contain bugs in v1.1. So application needs the new version. If Ledger has the permission to access Internet, it might leak transaction info. PersonalShopper can get location info only if it holds the permissions.

Outline IIntroduction SSmartphone Application Security AAndroid AApplication Policies SSAINT Policy SSAINT Architecture RRelated Work CConclusion 2009/12/8 9 Advanced Defense Laboratory

Android /12/8Advanced Defense Laboratory 10

Android (cont.)  Applications are ostensibly isolated  Android IPC : Binder and Intent Android IPC  ioctl driver  Intent Filter: 2009/12/8Advanced Defense Laboratory 11

Android (cont.)  Activity  Display on screen 2009/12/8Advanced Defense Laboratory 12

Android (cont.)  Service  Background process 2009/12/8Advanced Defense Laboratory 13

Android (cont.)  Broadcast Receiver  Asynchronous event notification 2009/12/8Advanced Defense Laboratory 14

Android (cont.)  Content Provider  Share data between applications  Do not use Intents  Use URI (Uniform Resource Identifier) 2009/12/8Advanced Defense Laboratory 15

Android (cont.)  Permission label in Android Permission label in Android  Normal  Dangerous  Signature  signatureOrSystem  Developers can define permission labels to access their interface  But developers indirectly influence security 2009/12/8Advanced Defense Laboratory 16

Outline IIntroduction SSmartphone Application Security AAndroid AApplication Policies SSAINT Policy SSAINT Architecture RRelated Work CConclusion 2009/12/8 17 Advanced Defense Laboratory

Application Policies  Policy Tree:  Double-stoke boxes is supported by Android 2009/12/8Advanced Defense Laboratory 18

Application Policies (cont.)  Signature-based policy (1.2)  Define set of except signatures  Configuration-based policy (1.3)  E.g., Application version and the set of request permissions 2009/12/8Advanced Defense Laboratory 19

Application Policies (cont.)  Signature-based policy (2.2)  Configuration-based policy (2.3)  Phone Context-based Policy (2.4) 2009/12/8Advanced Defense Laboratory 20

Application Policies (cont.)  Install-time Policy Example  com.abc.lbs with “QueryByLocation” service  Developer Permission: com.abc.perm.getloc  Permission: ACCESS_LOCATION  Runtime Policy Example  com.ok.shopper wants to check the payment application  Signature checks 2009/12/8Advanced Defense Laboratory 21

Outline IIntroduction SSmartphone Application Security AAndroid AApplication Policies SSAINT Policy SSAINT Architecture RRelated Work CConclusion 2009/12/8 22 Advanced Defense Laboratory

SAINT Policy 2009/12/8Advanced Defense Laboratory 23 Install-Time Run-Time

SAINT Policy (cont.)  Install-time Policy Example 2009/12/8Advanced Defense Laboratory 24

SAINT Policy (cont.)  Runtime Policy  Access policy  Identify the caller’s security requirements  Expose policy  Identify the callee’s security requirements  Saint is a “conjunctional default allow policy” 2009/12/8Advanced Defense Laboratory 25

SAINT Policy (cont.)  Runtime Policy Example 2009/12/8Advanced Defense Laboratory 26

SAINT Policy (cont.)  Administrative Policy  May users override the system/application policies?  Operational Policy 2009/12/8Advanced Defense Laboratory 27

Outline IIntroduction SSmartphone Application Security AAndroid AApplication Policies SSAINT Policy SSAINT Architecture RRelated Work CConclusion 2009/12/8 28 Advanced Defense Laboratory

SAINT Architecture  Saint Installer  PackageParser / PackageManager  Insert each policy into AppPolicy provider only if its permission label is declared by the application 2009/12/8Advanced Defense Laboratory 29

SAINT Architecture (cont.)  Saint Mediator 2009/12/8Advanced Defense Laboratory 30

SAINT Architecture (cont.)  AppPolicy Provider  SQLite  verifyPermissionGrant API  insertApplicationPolicy API  FrameworkPolicyManager  Only FrameworkPolicyManager can update AppPolicy provider 2009/12/8Advanced Defense Laboratory 31

Outline IIntroduction SSmartphone Application Security AAndroid AApplication Policies SSAINT Policy SSAINT Architecture RRelated Work CConclusion 2009/12/8 32 Advanced Defense Laboratory

Related Work  Kirin  Enforce install policies  Application Security Framework by OMTP  Certificate-based mechanism  Symbian  Symbian-signed 2009/12/8Advanced Defense Laboratory 33

Related Work (cont.)  Linux Security Module (LSM) Framework  Isolation  SELinux on OpenMoko  Rao et al.  MAC system  Windows Mobile.Net  Bind each application to a behavioral profile enforced at runtime 2009/12/8Advanced Defense Laboratory 34

Outline IIntroduction SSmartphone Application Security AAndroid AApplication Policies SSAINT Policy SSAINT Architecture RRelated Work CConclusion 2009/12/8 35 Advanced Defense Laboratory

Conclusion  Saint framework  Install-time and runtime policy enforcement 2009/12/8Advanced Defense Laboratory 36