1. DeepDroid: Dynamically Enforcing Enterprise Policy on Android Devices Fall 2015 Instructor: Kun Sun, Ph.D.

2. Roadmap  Introduction  Overview  DeepDroid-Permission  DeepDroid-Behavior  Evaluation  Conclusion

3. Introduction  Smartphones are increasingly adopted in workspace  “51% of end users rely on smartphones to perform daily business activities.”——Cisco  However, Android devices are not easily managed for system design  Permission: Coarse and not configurable  Device Administration API  SEAndroid: legacy phones(85.8%<version 4.3), inadequate MAC in middleware

4. Current Status  Device OEMs add their own management APIs  Samsung SAFE & Knox  HTC APIs  3LM APIs  …  MDM vendors bustle about all these extended APIs

5. Current Research  Customize system to enforce policies  Require tremendous modification to source code  Portability issue for Android branches and OEMs  Rewrite Android apps  Intercept security sensitive APIs from multiple layers  Lack of isolation between App and management code

6. Roadmap  Introduction  Overview  DeepDroid-Permission  DeepDroid-Behavior  Evaluation  Conclusion

7. Overview  centralized controller  system_server for middleware permissions  client-server architecture  system services, content providers, etc.  Communication-Binder  RPC to services/Callbacks  Intent  Content Providers  Messengers  Ashmem  … system_server / system/bin/mediaserver com.android.phone android.process.acore android.process.media ……

8. Overview (cont.)  Operations inside of process boundary  Based on Linux system calls  Comply with Linux DAC  Linux privilege authorized right after process creation  setgroups/setresgid/setresuid Activity Manager Create process that can: read/write sdcard access network use camera read contacts

9. Our approach  Dynamic memory instrumentation / system/bin/mediaserver com.android.phone android.process.acore android.process.media …… system_server behavior extraction & enforcement flexible permission

10. Our approach (cont.)  System call tracking  Tracking process creation for privilege authorization  Tracking process operations zygote app1 app2 app3

11. Why our approach?  Stable system architecture  permission mechanism, system services, binder realization, etc.  Reduce source code modification to configuration  carry little burden on vendor customization  Central management  isolation  transparent to apps

12. Roadmap  Introduction  Overview  DeepDroid-Permission  DeepDroid-Behavior  Evaluation  Conclusion

13. DeepDroid-Permission  system_server is the core of permission mechanism.  A few checking interfaces Permission Check inter- process Monitoring Code  Enterprise Policy Repository system_server  Key: Java method redirection

14. DeepDroid-Permission

15. --runtime-init --setuid=10028 --setgid=10028 --setgroups=1015, 3003, 1006, 1007 android.app.ActivityThread DeepDroid-Permission  Some permissions (user groups) are checked in Kernel. system_server zygoteapp process monitoring fork 1: launch request 2: recognize app 3: reset groups & track until setuid

16. Roadmap  Introduction  Overview  DeepDroid-Permission  DeepDroid-Behavior  Evaluation  Conclusion

17. DeepDroid-Behavior  Interactions between apps and system services  ioctl(binderFd, BINDER_WRITE_READ, &bwr)  By tampering Global Offset Table (GOT) of libbinder.so access to services call-backs Intent ContentProviders Messenger ashmem …… app libc.so system_serverandroid.process.acore libbinder.so … Behavior Enforcement upper layers upper layers Binder driver

18. DeepDroid-Behavior  Synchronous invocation  E.g., getLastKnownLocation(), getDeviceId() return value requests system process BR_TRANSACTION BC_REPLY pairwise within binder thread interfaces defined in aidl & in.java reflect on write buffer

19. DeepDroid-Behavior  Asynchronous invocation  With oneway callback(e.g., onLocationChanged) callback value get a remote handle system process BC_TRANSACTION reflect on write buffer interfaces defined in aidl or in.java counterpart recognization 1)servicemanager 2)IBinder instances

20. DeepDroid-Behavior  Parameter types  IBinder: map remote handles to uid/pid  ParcelFileDescriptor: shared memory (content provider, media, etc.)  Parcelable: rebuild objects with built-in CREATOR

21. Roadmap  Introduction  Overview  DeepDroid-Permission  DeepDroid-Behavior  Evaluation  Conclusion

22. Tested Resources ResourcePermissionGroupPEP 1 Process IMEI READ_PHONE_STATE package com.android.phone Phone # READ_PHONE_STATE package location ACCESS_FINE_LOCATION packagesystem_server contacts READ_CONTACTS packageandroid.process.acore camera CAMERA camerapackage/ PCG 2 mediaserver account GET_ACCOUNTS packagesystem_server logs READ_LOGS log PCG 2 app process network INTERNET inetpackage/ PCG 2 SMS SEND_SMS package com.android.phone 1 PEP: permission enforcement point 2 PCG ： Process Creation Guard

23. Tested Devices DeviceAndroid OS Nexus S(Samsung)Android OS 2.3.6 Sony LT29iAndroid OS 4.1.2 Android OS 4.2.2 Galaxy Nexus(Samsung)Android OS 4.0 Samsung Galaxy Note IIAndroid OS 4.1 Samsung Galaxy Note 3Android OS 4.3 Nexus 5(LG)Android OS 4.4 Meizu MX IIFlyme 3.2 (Android OS 4.2.1) Huawei Honor 3cAndroid OS 4.2

24. Performance

25. Performance (cont.)

26. Normal Quadrant Traced Quadrant Normal CaffeineMark Trace CaffeineMark MX II2508.52507.66367.26207.5 LT29i4653.84553.614125.513998.5 Nexus S1750.01705.65982.85959.9 Benchmark Scores

27. Roadmap  Introduction  Overview  DeepDroid-Permission  DeepDroid-Behavior  Evaluation  Conclusion

28. Conclusion  We propose a framework to achieve a fine- grained control on Android resources.  DeepDroid dynamically instruments and traces core processes of Android system. Based on stable structures across multiple OS versions, DeepDroid is easily ported.  DeepDroid requires little firmware configuration rather than customizing Android source code.