ISA 673 Operating Systems Security Exploring the Android Platform

The Problem Resource monitoring mostly done in user- mode – Relies on system services and system calls for data – Kernel-mode malware can easily subvert it Malware power usage largely unstudied – Studies limited – Full system instrumentation not available 1/9/2016ISA673 - Operating Systems Security2

Battery Utilization Monitoring Project Goals – Track usage by resource and process – Modify resource scheduling to ensure fairness Approach – Low-level (kernel level) – High enough to associate processes to resource requests 1/9/20163ISA673 - Operating Systems Security

Development Process 1/9/20164ISA673 - Operating Systems Security Instrument Kernel Drivers Collect Battery Usage Data Analyze Data/Identify Trends Modify Kernel Scheduler

System Approach 1/9/2016ISA673 - Operating Systems Security5 Kernel Instrumentation Services Table Hooking Wake Lock Monitoring Driver Modification Other (Undiscovered ) Data Collection Kernel-mode Collection Module Procfs Bridge to User-mode Upload to PC for Analysis Data Analysis Statistical Analysis Charts & Graphs Identify Trends Modify Scheduler Real-time Power Monitor Process Queuing Changes Security vs. Battery Life Trade-offs

Design Philosophy System changes are dangerous without data Iterative approach allows for intelligent refinement Modular design for flexibility Analysis built into the design – Demonstrates success/failure of system changes 1/9/2016ISA673 - Operating Systems Security6

1/9/2016ISA673 - Operating Systems Security7 Progress to Date Kernel Instrumentation Services Table Hooking Wake Lock Monitoring Driver Modification Other (Undiscovered) Data Collection Kernel-mode Collection Module Procfs Bridge to User-mode Upload to PC for Analysis Data Analysis Statistical Analysis Charts & Graphs Identify Trends Modify Scheduler Real-time Power Monitor Process Queuing Changes Security vs. Battery Life Trade-offs

Desktop PCAndroid Phone System Architecture 1/9/2016ISA673 - Operating Systems Security8 User Mode Kernel Mode Batterymine Audio Video WiFi Bluetooth 3G Batterymine Daemon proc_fs Data Collection Analysis Engine Scheduling Data

Kernel Module Records per-process usage of resources Records per-interval usage of battery Writes tab-separated data to proc_fs Interface allows easy instrumentation of kernel Supports multiple instrumentation strategies 1/9/2016ISA673 - Operating Systems Security9

Instrumentation Strategy Build Batterymine into Android kernel Modify code for most-used drivers Attribute device usage to process where possible Attribute to “Idle” otherwise. Pros: Simple, allows for iterative development Cons: – Requires intimate knowledge of driver code – Hardware dependent – Process ID not always available 1/9/2016ISA673 - Operating Systems Security10

Module Interface enum power_consumer_type { idle = 0, wifi, bluetooth, audio, threeG, video }; void bm_logDeviceUsage(enum power_consumer_type devType, struct timespec usageTime); void bm_logProcDeviceUsage(enum power_consumer_type devType, pid_t processID, struct timespec usageTime); #define BM_GET_START_TIME struct timespec ts = current_kernel_time() #define BM_GET_DIFF_TIME timespec_sub(current_kernel_time(), ts) 1/9/2016ISA673 - Operating Systems Security11

Sample Instrumentation void myAudioDeviceFunc(char *szPointer) { BM_GET_START_TIME(); if(NULL != szPointer) { bm_logDeviceUsage(audio, BM_GET_DIFF_TIME); return; } //...driver code... bm_logDeviceUsage(audio, BM_GET_DIFF_TIME); } 1/9/2016ISA673 - Operating Systems Security12

Statistical Analysis Problem Approach Multiple Regression Output 1/9/2016ISA673 - Operating Systems Security13

Problem We need to figure it out how much battery is used for each device. 1/9/2016ISA673 - Operating Systems Security14

Approach Collect the device usage data for each process for every time interval. For each time interval, device usage is collected with battery reduction. Execute Multiple Regression 1/9/2016ISA673 - Operating Systems Security15

Multiple Regression Y = a + b 1 *X 1 + b 2 *X b n * X n where Y : Battery Usage N: Number of devices b i : Coefficient of each device X i : usage(process time) of device X i 1/9/2016ISA673 - Operating Systems Security16

Output 1/9/2016ISA673 - Operating Systems Security17 Coefficients Intercept Audio Wifi

Wifi Output

Project Successes Wins – Complete data collection and analysis engine Supports any instrumentation strategy Capable of comparing/contrasting instrumentation techniques – Partial instrumentation of kernel drivers Real-time data collection Minimal driver code change – Gained knowledge of kernel architecture 1/9/2016ISA673 - Operating Systems Security19

Project Failures Picked infeasible approach to kernel instrumentation – Requires too many driver changes – Requires intimate knowledge of each driver – Hardware dependent Cannot validate analysis – Did not collect enough data Have not approached scheduler changes – Last step in process 1/9/2016ISA673 - Operating Systems Security20

How to Find More Info. Project hosted on Google Code – Code – Subversion support – Full source of modified kernel Wiki – Build and Install instructions – Culmination of research Downloads – Latest build of binaries – Slides 1/9/2016ISA673 - Operating Systems Security21