Arpit Jain Mtech2

Outline Introduction Attacks Solution Experimental Evaluation References

Attacks in Android Android uses sandbox model and permission based label to avoid malware attacks. Permissions assigned to an application restricts the operation application can perform on smart phone. But still vulnerable to geinimi, a type of Trojan which packages with the legitimate applications and takes extra permissions then would have been required by that application without trojan.

Permissions

Solution Security based Model: SD figure- represents the risk level of permission pairs SD Rules- defines how to determine SD of certain permission pairs. And based on this SD figure decides whether to allow application.

Types of SD Safe SD represents a safe combination of security permissions that has a threat point of 0. Normal SD means a permission pair has no clear security threat with a threat point of 1. Dangerous SD with a threat point of 5 indicates a permission combination may have threat. Severe dangerous SD with a threat point of 25 means a permission pair with serious threat to the mobile phone security.

Classification of Security Permission When analyzing the Android security permission list, we can classify them by their functions. For example: READ_SMS, RECEIVE_SMS, SEND_SMS, WRITE SMS, BROADCAST_SMS permissions all related to the SMS function.

Measuring SD dc- closed SD of the application, dij and djk – related unclosed SD, subscript i and k represent the different permission of the two pairs, and subscript j represents the same permission of the two pairs. G stands for the number of classifications the application used.

Using SD model

Evaluation Result Test with 100 of Applications, found major having threat around 20. The application affected by Geinimi get a threat point over 500

References [1]A. Shabtai, Y. Fledel, U. Kanonov, et al. “Google Android: A Comprehensive Security assessment”, IEEE Security and Privacy. [2] X. Zhang, O. Aciiçmez, and J. Seifert. “A Trusted Mobile Phone Reference Architecture via Secure Kernel”. In Proceedings of ACM workshop on Scalable Trusted Computing, November 2007.