1. An Example of an Android Security Extension YAASE - Yet Another Android Security Extension

2. YAASE Main Features A Policy-based System for Controlling Information Flow Fine-grained Data Filtering No modifications to Android API No trust on apps Control over IPC and system-level calls (internet) Data filtering capabilities Tuneable

3. YAASE Architecture Grey = New components added Dashed = Modified Android components

4. Policy-based AC Terms A policy is a rule that governs the behaviour of a system PEP stands for Policy Enforcement Point It is responsible for intercepting the requests and enforcing the access control decisions PDP stands for Policy Decision Point It is responsible for evaluating policies and coming up with a decision Policy Provider is the repository where policies are stored

5. YAASE Policy Language PolicyName: Requester can do operation on Resource [have to perform action] handle dataLabelExpression By default, if no policy is specified no action is granted!

6. Example of a Privilege Escalation FeedMe: A news feed app requiring access to internet NavApp: A navigation app requiring access to GPS

7. Policies for Apps PolFeedMe: FeedME can do send on Internet handle “NoLabels” PolNavApp: NavApp can do access on GPS handle “FineLocation”

8. Restrict Approach Sandbox System Sandbox P2P1 FeedMeNavAppAndroid Apps C P1 GPS P2 NET SS AA Policy Provider YAASE PDP Access to NavApp PEP

9. Sandbox System Sandbox P2P1 FeedMeNavAppAndroid Apps C P1 GPS P2 NET SS AA Policy Provider YAASE PDP PEP Restrict Approach

10. Sandbox System Sandbox P2P1 FeedMeNavAppAndroid Apps C P1 GPS P2 NET SS AA Policy Provider YAASE PDP PEP

11. Restrict Approach Sandbox System Sandbox P2P1 FeedMeNavAppAndroid Apps C P1 GPS P2 NET SS AA NO ACCESS Policy Provider YAASE PDP PEP

12. Relaxed Approach Sandbox System Sandbox P2P1 FeedMeNavAppAndroid Apps C P1 GPS P2 NET SS AA Policy Provider YAASE PDP PEP

13. Relaxed Approach Sandbox System Sandbox P2P1 FeedMe D:FL NavAppAndroid Apps C P1 GPS P2 NET SS AA Policy Provider YAASE PDP PEP

14. Relaxed Approach Sandbox System Sandbox P2P1 FeedMeNavAppAndroid Apps C P1 GPS P2 NET SS AA Policy Provider YAASE PDP INTERNET D:FL PEP

15. Enforced Policy PolFeedMe: FeedME can do send on Internet handle “NoLabels”

16. Relaxed Approach Sandbox System Sandbox P2P1 FeedMeNavAppAndroid Apps C P1 GPS P2 NET SS AA Policy Provider YAASE PDP INTERNET D:FL PEP

17. Final Thoughts Standard Android Security framework is insufficient Plethora of security extensions have been presented Now it is time that Google starts to take some actions

18. Readings Russello, Giovanni, et al. "Yaase: Yet another android security extension." Privacy, security, risk and trust (passat), 2011 ieee third international conference on and 2011 ieee third international conference on social computing (socialcom). IEEE, 2011.

19. Questions?