ISA 673 Operating Systems Security Exploring the Android Platform

Battery Utilization Monitoring Project Goals – Track usage by resource and process – Modify resource scheduling to ensure fairness Approach – Low-level (kernel level) – High enough to associate processes to resource requests 12/2/20152ISA673 - Operating Systems Security

The Problem Resource monitoring mostly done in user- mode – Relies on system services and system calls for data – Kernel-mode malware can easily subvert it Malware power usage largely unstudied – Studies limited – Full system instrumentation not available 12/2/2015ISA673 - Operating Systems Security3

System Approach 12/2/2015ISA673 - Operating Systems Security4 Kernel Instrumentation Services Table Hooking Wake Lock Monitoring Driver Modification Other ( Undiscovered ) Data Collection Kernel-mode Collection Module Procfs Bridge to User-mode Upload to PC for Analysis Data Analysis Statistical Analysis Charts & Graphs Identify Trends Modify Scheduler Real-time Power Monitor Process Queuing Changes Security vs. Battery Life Trade-offs

12/2/2015ISA673 - Operating Systems Security5 Progress to Date Kernel Instrumentation Services Table Hooking Wake Lock Monitoring Driver Modification Other (Undiscovered) Data Collection Kernel-mode Collection Module Procfs Bridge to User-mode Upload to PC for Analysis Data Analysis Statistical Analysis Charts & Graphs Identify Trends Modify Scheduler Real-time Power Monitor Process Queuing Changes Security vs. Battery Life Trade-offs

Design Philosophy System changes are dangerous without data Iterative approach allows for intelligent refinement Modular design for flexibility Analysis built into the design – Demonstrates success/failure of system changes 12/2/2015ISA673 - Operating Systems Security6

Development Process 12/2/20157ISA673 - Operating Systems Security Instrument Kernel Drivers Collect Battery Usage Data Analyze Data/Identify Trends Modify Kernel Scheduler

Desktop PCAndroid Phone System Architecture 12/2/2015ISA673 - Operating Systems Security8 User Mode Kernel Mode Batterymine Audio Video WiFi Bluetooth 3G Batterymine Daemon proc_fs Data Collection Analysis Engine Scheduling Data

Kernel Module Records per-process usage of resources Records per-interval usage of battery Writes tab-separated data to proc_fs Interface allows easy instrumentation of kernel Supports multiple instrumentation strategies 12/2/2015ISA673 - Operating Systems Security9

Instrumentation Strategy Build Batterymine into Android kernel Modify code for most-used drivers Attribute device usage to process where possible Attribute to “Idle” otherwise. Pros: Simple, allows for iterative development Cons: – Requires intimate knowledge of driver code – Hardware dependent – Process ID not always available 12/2/2015ISA673 - Operating Systems Security10

Module Interface enum power_consumer_type { idle = 0, wifi, bluetooth, audio, threeG, video }; void bm_logDeviceUsage(enum power_consumer_type devType, struct timespec usageTime); void bm_logProcDeviceUsage(enum power_consumer_type devType, pid_t processID, struct timespec usageTime); #define BM_GET_START_TIME struct timespec ts = current_kernel_time() #define BM_GET_DIFF_TIME timespec_sub(current_kernel_time(), ts) 12/2/2015ISA673 - Operating Systems Security11

Sample Instrumentation void myAudioDeviceFunc(char *szPointer) { BM_GET_START_TIME(); if(NULL != szPointer) { bm_logDeviceUsage(audio, BM_GET_DIFF_TIME); return; } //...driver code... bm_logDeviceUsage(audio, BM_GET_DIFF_TIME); } 12/2/2015ISA673 - Operating Systems Security12

Statistical Analysis How much battery is used for each device? Collect device usage per process at a time interval Execute Multiple Regression 12/2/2015ISA673 - Operating Systems Security13

Raw Battery Data 12/2/2015ISA673 - Operating Systems Security14

Resource Usage Stats 12/2/2015ISA673 - Operating Systems Security15

Power Consumption Per Resource 12/2/2015ISA673 - Operating Systems Security16

Multiple Regression Y = a + b1*X1 + b2*X bn * Xn where Y : Battery Usage N: Number of devices bi: Coefficient of each device Xi: usage(process time) of device Xi 12/2/2015ISA673 - Operating Systems Security17

Output Coefficients Intercept Audio Wifi /2/2015ISA673 - Operating Systems Security18

Wifi Output

Project Successes Wins – Complete data collection and analysis engine Supports any instrumentation strategy Capable of comparing/contrasting instrumentation techniques – Partial instrumentation of kernel drivers Real-time data collection Minimal driver code change – Gained knowledge of kernel architecture 12/2/2015ISA673 - Operating Systems Security20

Project Shortcomings Picked infeasible approach to kernel instrumentation – Requires too many driver changes – Requires intimate knowledge of each driver – Hardware dependent Cannot validate analysis – Did not collect enough data Have not approached scheduler changes – Last step in process 12/2/2015ISA673 - Operating Systems Security21

How to Find More Info Project hosted on Google Code – Code – Subversion support – Full source of modified kernel Wiki – Build and Install instructions – Culmination of research Downloads – Latest build of binaries – Slides 12/2/2015ISA673 - Operating Systems Security22