On the effectiveness of API-level access control using bytecode rewriting in Android

ASIA CCS 2013 - Proceedings of the 8th ACM SIGSAC Symposium on Information, Computer and Communications Security

Volumn , Issue , 2013, Pages 25-36

  Hao, Hao ^a   Singh, Vicky ^a   Du, Wenliang ^a  

^a Syracuse University   (United States)

Author keywords

access control; Android; bytecode rewriting

Indexed keywords

ANDROID; ANDROID APPLICATIONS; ANDROID OPERATING SYSTEMS; ANDROID PLATFORMS; BYTECODE REWRITING; POTENTIAL ATTACK; SYSTEMATIC EVALUATION; SYSTEMATIC STUDY;

ROBOTS; STATIC ANALYSIS;

ACCESS CONTROL;

EID: 84877944138     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1145/2484313.2484317     Document Type: Conference Paper

References (28)

1. Android developer. http://www.developer.android.com/about/versions/ android-4.0.3.html.
2. Android reverse engineering honeynet project. http://www.honeynet.org/ node/783.
3. Binder. http://www.developer.android.com/ reference/andrdoid/os/Binder. html.
4. Bytecode for the dalvik vm. http://www.source.android.com/tech/dalvik- bytecode.html.
5. Commonsware camera application. http://github.com/commonsguy/cw-omnibus.
6. Jni tips. http://www.developers.android.com.guide/practices/jni.html.
7. Naming a package. http://www.docs.oracle.com/javase/tutorial/package/ namingpkgs.html.
8. smali: An assembler/disassembler for android's dex format. http://www.code.google.com/p/smali.
9. Swi handlers. http://www.infocenter.arm.com/help/index.jsp?topic=/com. arm.doc.dui0040d/Cacdfeci.html.
10. Android binder: Android interprocess communication. 2011.
11. A. Bartel, J. Klein, K. Allix, Y. Traon, and M. Monperrus. Improving privacy on android smartphones through in-vivo bytecode instrumentation. CoRR, abs/1208.4536, 2012.
12. A. Chander, J. C. Mitchell, and I. Shin. Mobile code security by java bytecode instrumentation. pages 1027-1040, 2001.
13. E. Chin, A. P. Felt, K. Greenwood, and D. Wanger. Analyzing inter-application communication in android. In Proceedings of the 9th International Conference on Mobile system, application and serivecs, 2011.
14. B. Davis, B. Sanders, A. Khodaverdian, and H. Chen. I-arm-droid: A rewriting framework for in-app reference monitors for android applications. In IEEE Mobile Security Technologies, 2012.
15. W. Enck, P. Gilbert, B. Chun, L. P. Cox, J. Jung, P. McDaniel, and A. N. Sheth. Taintdroid: an information-flow tracking system for realtime privacy monitoring on smartphones. In Proceedings of the 9th USENIX Conference on Operating Systems Design and Implementation, pp.1-6, 2010.
16. U. Erlingsson. The inlined reference monitor approach to security policy enforcement. 2004.
17. A. P. Felt, E. Chin, S. Hanna, D. Song, and D. Wagner. Android permissions demystified. In Proceedings of the 18th ACM Conference on Computer and Communication Security, 2011.
18. P. Hornyack, S. Han, J. Jung, S. Schechter, and D. Wetherall. "these aren't the droids you're looking for": Retrofitting android to protect data from imperious applications. In Proceedings of the 18th ACM conference on Computer and communication security, 2011.
19. J. Jeon, K. K. Micinski, and J. A. Vaughan. Dr. android and mr. hide: Fine-grained security policies on unmodified android. Technical Report, Department of Computer Science, University of Maryland, 2011.
20. M. Nauman, S. Khan, and X. Zhang. Apex: Extending android permission model and enforcement with user-defined runtime constraints. in Proceedings of the 5th ACM Symposium on Information, Computer and Communications Security, 2010.
21. D. Poo, D. Kiong, and S. Ashok. Object-oriented programming and java, 2nd edition. 2007.
22. N. Reddy, J. Jeon, J. Vaughan, T. Millstein, and J. Foster. Application-centric security policies on unmodified android. UCLA Computer Science Department, Technical Report, 2011.
23. D. Reynaud, E. C. R. Shin, T. R. Magrino, E. X. Wu, and D. Song. Freemarket: Shopping for free in android applications. In Proceedings of the 19th Annual Symposium on Network and Distributed System Security, 2012.
24. A. Rudys and D. S. Wallach. Enforceing java run-time properties using bytecode rewriting. 2002.
25. S. Shekhar, M. Dietz, and D. S. Wallach. Adsplit: Separating smartphone advertising from applications. CoRR,abs/102.4030, 2012.
26. R. Xu, H. Saidi, and R. Anderson. Aurasium: Practical policy enforcement for android applications. In Proceedings of the 21st USENIX Security Symposium, 2012.
27. Y. Zhou, Z. Wang, W. Zhou, and X. Jiang. Hey, you, get off of my market: Detection malicious apps in official and alternative android markets. In Proceedings of the 19th Annual Symposium on Network and Distributed System Security, 2012.
28. Y. Zhou, X.Zhang, X. Jiang, and V. Freeh. Taming information-stealing smartphone applications(on android). Trust and Trustworthy Computing, pp.93-107, 2011.