1. More Security and Programming Language Work on SmartPhones
Karthik Dantu and Steve Ko

2. Epicc
Octeau et al., “Effective Inter-Component Communication Mapping in Android with Epicc: An Essential Step Towards Holistic Security Analysis”
Static analysis for detecting Intent send calls and receive calls

3. Background on Intent Intent is a message data type
A sender can send an Intent with action, category, and data.
This can optionally be targeted to a specific class.
A static receiver declares its Intent receiving capability in its manifest file.
A dynamic receiver can register at runtime.

4. Why Analyze Intents?
Using Intent is a primary mechanism for inter-component and inter-app communication.
Colluding apps: some apps might collude for malicious behavior
Permission by-passing: some apps use other apps’ capabilities to by-pass permission requirements

5. What to Detect Intent entry points Intent exit points
What values (i.e., target, action, category, and data) are passed to match senders and receivers

6. What to Detect

7. General Approach
Parse the app’s manifest to detect static Intent receivers
Analyze the app’s code to detect Intent send call sites and dynamic receivers
Dynamic receivers use intentFilter.addAction()
Use Interprocedural Distributive Environment (IDE) analysis to get the values for each Intent
This is the focus of the paper.

8. General Approach

9. IDE
A general framework that tracks how variables are influenced in the program execution.
Roughly,
For each instruction execution, a user-supplied environment transformer is called to track how variables of interest change.
Once the environment transformers are supplied, algorithms exist to solve the problem efficiently (i.e., solving the IDE problem).

10. Example Flow

11. Another Example

12. Epicc’s Environment Transformers
ComponentName(packagename, classname) transformers
Bundle transformers
Intent transformers
IntentFilter transformers

13. ComponentName Transformers
ComponentName(packagename, classname) transformers
Tracks packagename and classname used for an Intent.
Two transformers
Branch ComponentName transformer: per-branch tracking
ConponentName transformer: combining all branches (union)

14. Bundle Transformers Tracks values passed to Bundle Two passes
First pass: identifies all added and removed values.
Second pass: combines the results to derive actual values.

15. Intent and IntentFilter Transformers
Intent transformer: tracks Intent definitions and uses ComponentName & Bundle values.
IntentFilter transformer: identifies dynamic registration (i.e., intentFilter.addAction()),

16. Precision Results

17. Comparison

18. Stowaway Felt et al., “Android Permissions Demystified”
Stowaway is a tool to analyze Android apps to report overprivileged apps, i.e., apps that request permissions that they do not need.
In addition, Stowaway builds an API-permission map for Android.

19. Why Overprivileged Apps?
(Disclaimer: I don’t quite see this is important)
To evaluate the effectiveness of installation-time permissions enforcement
Increase the impact of bugs or vulnerabilities
Principle of least privilege

20. Background on Permissions
Per-API protection
Developers request.
Installers grant.
Enforced by the framework
Two special cases
Content providers (based on URIs & paths)
Intents

21. Background on Permissions
Permission enforcement

22. Permission Check Step 1: Derive API-permission mappings
Step 2: Analyze apps to see if any permission is requested without using any corresponding API

23. Permission Map Three mechanisms
Feedback-directed testing using a test case generator, Randoop
Custom test case generation, i.e., method unit tests
Manual verification

24. Permission Map Content provider permissions
Collecting URIs (from android.provider package and testing)
Intent permissions
Collecting strings from the public API documentation

25. Permission Map Results
Comparison to Android 2.2 documentation
Stowaway: 1259 API calls
Android: 78 API calls (6 incorrect)
1259 API calls (6.45% of all API methods)
Unused permissions
BRICK

26. Permission Map Results
Largely no hierarchy
WRITE_CONTACTS is not a substitute for READ_CONTACTS
But ACCESS_COARSE_LOCATION is weaker than ACCESS_FINE_LOCATION

27. Stowaway Static analysis tool
Looks at disassembled DEX (using Dedexer)
Identifies API calls, content providers calls, and intent send/receive calls
Handles Java reflection
Java.lang.reflect.Method.invoke(), etc.

28. Stowaway Results Dataset: 900 Android apps
323 apps (35.8%) as overprivileged

29. Summary Epicc: static analysis for detecting Intent sender/receiver
Stowaway: static analysis for detecting overprivileged apps