1. Input Validation vulnerabilities in Android System Services Sukwon Choi scho668

2. Introduction  Input Validation?  Examples of conventional input validation:  Prevention of SQL injection through sanitization of user-supplied input.  Prevention of XSS (Cross-Site Scripting) .. And a few more  However, these do not cover input validation of Android System Services.

3. android system services  A group of services that are provided by the Android Framework  Bluetooth, Telephone, etc  Primary factor that differentiate Android and conventional PC  Use API calls to use these “System Services”  These System Service Methods should adopt input validation techniques to increase security.

4. Problem 1: To which extent system services misses input validation  A lot of attack vectors for Android System Services  96 Services, and 1972 Methods between those services  System services are vulnerable to input attacks  Methods doing input validation should satisfy one of these:  Method verifies atleast one argument  Method requires the app satisfies a certain condition such as permissions.  Many methods actually do validate input BUT are not adequate

5. Problem 2: How to develop a cost-effective vulnerability scanner to find the vulnerability caused by invalid input  Buzzer (Binder Fuzzer)  Buzzer acts as an ordinary third party app  It can request all the permissions which an ordinary third party app could be authorized to have  The target test system for this application is Android 5.0.1 without any modifications.

6. Buzzer: Design & Implementation  Four Sections  Service Module  Service Chooser  Request Sender/Logger  Log Analyzer

7. Buzzer: Findings  Vulnerabilities caused by system generated code.  Vulnerabilities in the ServiceManager

8. Buzzer: Findings  Vulnerabilities in WiFi System Service  Vulnerabilities in Search System Service  Vulnerabilities caused by NULL reference

9. Criticism  A lot of manual work required  Use static analysis program to analyze source code  Script to completely automate analysis of log file  Android 6.0 introduces new ways to manage permissions  Might be difficult to constantly ask for permission  Need a way to automate the process