Byron Alleman Will Galloway Jesse McCall

Permission Based Security Model Users can only use features for which their permissions grant them access Abstracts the hierarchy system More freedom than the hierarchy system More secure in theory because nothing is trusted unless they have permissions Pretty much pioneered by Android

Android Permissions Overview Android treats all applications as untrustworthy users Each app runs in its own virtual machine If an application has special needs it must request permission Attempting to access a system feature that the application doesn’t have permission for either results in the feature not starting or a security error

Android Permissions Continued… Requested permissions are displayed in the Play store Android assigns the application a unique linux user ID Permissions requested by an application are declared in the application’s AndroidManifest.xml file

ProsCons Applications should only have access to features they require to function as intended Ideally applications wont be able to negatively impact other applications or the user Applications can request more permissions than they require Leaves system open to possible malicious attack

Types of Permissions Normal Low-risk permissions Automatically granted Example: Flashlight, Read SD card contents Dangerous Higher-risk permissions that the user must confirm before installing the application Can negatively impact the user Example: Internet Access, Send SMS

Types of Permissions continued Signature Permissions that the system only grants if the requesting application is signed with the same certificate as the application that declared the permission. Automatically granted Signature/System Permissions that the system only grants to apps that are in the Android system image or signed with the same certificate Automatically granted

Application Defined Permissions Applications can enforce their own defined permissions. Ensures self-protection and preservation of the application. Applications can specify exactly what outside applications can access of its resources.

The Problem Many users don’t understand the permissions system Many users ignore the permissions Permission descriptions aren’t always clear Permission location can easily be overlooked in the Play store

Survey Results 51.9% of surveyed always read permissions before downloading an app 44.3% of surveyed feel that all permissions are easy to comprehend 78.2% of surveyed have decided not to install an app based on its permissions

How to Fix Educate users about permissions and their impact Locate potentially hazardous applications on the device Better layout for permissions on the Play Store Advise users to be cautious when downloading from the third party app stores (like Amazon Market)

Other Applications Pocket Permissions App Profiles DroidRanger Stowaway

Our App Lists all permissions used by apps, grouped by apps Lists all apps that use each permission List apps that have a high risk based on permissions User guide to permissions Explains permissions Show the risk of each permission Tips for Android safety

DEMO

QUESTIONS?