A11y attacks: Exploiting accessibility in operating systems

Proceedings of the ACM Conference on Computer and Communications Security

Volumn , Issue , 2014, Pages 103-115

  Jang, Yeongjin ^a   Song, Chengyu ^a   Chung, Simon P ^a   Wang, Tielei ^a   Lee, Wenke ^a  

^a Georgia Institute of Technology   (United States)

Author keywords

Accessibility; Assistive technology; Attacks

Indexed keywords

ANDROID (OPERATING SYSTEM); COMMERCE; DISPLAY DEVICES; ECONOMIC AND SOCIAL EFFECTS; ELECTRONIC TRADING; IOS (OPERATING SYSTEM); SECURITY OF DATA; USER INTERFACES;

ACCESSIBILITY; ASSISTIVE TECHNOLOGY; ATTACKS; COMPUTING SUBSYSTEMS; DESIGN AND IMPLEMENTATIONS; PROBLEMS AND CHALLENGES; SECURITY EVALUATION; SECURITY VULNERABILITIES;

MOBILE SECURITY;

EID: 84910596985     PISSN: 15437221     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1145/2660267.2660295     Document Type: Conference Paper

References (36)

1. Android Developers. Security tips. http://developer.android.com/training/articles/security-tips.html.
2. Apple, Inc. Accessibility. http://www.apple.com/accessibility/resources/,.
3. Apple, Inc. The ios environment. https://developer.apple.com/library/ios/documentation/iphone/conceptual/iphoneosprogrammingguide/TheiOSEnvironment/TheiOSEnvironment.html,.
4. O. Begemann. Remote View Controllers in iOS 6. http://oleb.net/blog/2012/10/remote-view-controllers-in-ios-6/.
5. K. J. Biba. Integrity considerations for secure computer systems. Technical report, DTIC Document, 1977.
6. S. Bugiel, L. Davi, A. Dmitrienko, T. Fischer, A.-R. Sadeghi, and B. Shastry. Towards taming privilege-escalation attacks on android. In 19th Annual Network & Distributed System Security Symposium (NDSS), volume 17, pages 18-25, 2012.
7. E. Chin, A. P. Felt, K. Greenwood, and D. Wagner. Analyzing inter-application communication in android. In Proceedings of the 9th international conference on Mobile systems, applications, and services, pages 239-252. ACM, 2011.
8. K. Cook. [patch] security: Yama lsm. http://lwn.net/Articles/393012/.
9. L. Davi, A. Dmitrienko, A.-R. Sadeghi, and M. Winandy. Privilege escalation attacks on android. In Information Security, pages 346-360. Springer, 2011.
10. L. Davidson. Windows 7 uac whitelist: Proof-of-concept source code. http://www.pretentiousname.com/misc/W7E-Source/win7-uac-poc-details.html.
11. J. Edwards. There's a huge password security quirk in ios 7 that lets siri control your iphone. http://www.businessinsider.com/password-security-flaw-in-ios-7-lets-siri-control-your-iphone-2013-9.
12. W. Enck, P. Gilbert, B.-G. Chun, L. P. Cox, J. Jung, P. Mc-Daniel, and A. Sheth. Taintdroid: An information-flow tracking system for realtime privacy monitoring on smartphones. In OSDI, volume 10, pages 1-6, 2010.
13. A. P. Felt, H. J. Wang, A. Moshchuk, S. Hanna, and E. Chin. Permission re-delegation: Attacks and defenses. In USENIX Security Symposium, 2011.
14. Go Launcher Dev Team. Go launcher ex notification. https://play.google.com/store/apps/details?id=com.gau.golauncherex.notification.
15. Google Inc. Section 508 Compliance (VPAT). https://www.google.com/sites/accessibility.html.
16. M. Grace, Y. Zhou, Z. Wang, and X. Jiang. Systematic detection of capability leaks in stock android smartphones. In Proceedings of the 19th Annual Symposium on Network and Distributed System Security, 2012.
17. J. Han, E. Owusu, L. Nguyen, A. Perrig, and J. Zhang. Accomplice: Location inference using accelerometers on smartphones. In Communication Systems and Networks (COMSNETS), 2012 Fourth International Conference on, pages 1-9, Jan 2012.
18. S. Jana and V. Shmatikov. Memento: Learning secrets from process footprints. In IEEE Symposium on Security and Privacy (Oakland '12), 2012.
19. B. Lau, Y. Jang, C. Song, T. Wang, P. H. Chung, and P. Royal. Mactans: Injecting malware into iOS devices via malicious chargers. In Proceedings of Black Hat USA, 2013.
20. L. Lu, Z. Li, Z. Wu, W. Lee, and G. Jiang. Chex: statically vetting android apps for component hijacking vulnerabilities. In Proceedings of the 2012 ACM conference on Computer and communications security, pages 229-240. ACM, 2012.
21. C. McLawhorn. Recent development: Leveling the accessibility playing field: Section 508 of the rehabilitation act. NORTH CAROLINA JOURNAL OF LAW & TECHNOLOGY, 3(1):63-100, 2001.
22. Microsoft. Windows integrity mechanism design. http://msdn.microsoft.com/en-us/library/bb625963.aspx, .
23. Microsoft. Windows vista integrity mechanism technical reference. http://msdn.microsoft.com/en-us/library/bb625964.aspx, .
24. Microsoft Corporation. Microsoft and section 508. http://www.microsoft.com/enable/microsoft/section508.aspx, .
25. Microsoft Corporation. User account control. http://windows.microsoft.com/en-us/windows7/products/features/user-account-control, .
26. S. Motiee, K. Hawkey, and K. Beznosov. Do windows users follow the principle of least privilege?: investigating user account control practices. In Proceedings of the Sixth Symposium on Usable Privacy and Security, SOUPS '10, New York, NY, USA, 2010. ACM.
27. Motorola Inc. Moto X Features: Touchless Control. http://www.motorola.com/us/Moto-X-Features-Touchless-Control/motox-features-2-touchless.html.
28. G. Ou. Vista Speech Command exposes remote exploit. http://www.zdnet.com/blog/ou/vista-speech-command-exposes-remote-exploit/416.
29. PoPs. Pops ringtons & notifications. https://play.google.com/store/apps/details?id=com.pops.app.
30. F. Roesner, T. Kohno, A. Moshchuk, B. Parno, H. J.Wang, and C. Cowan. User-Driven Access Control: Rethinking Permission Granting in Modern Operating Systems. In Proceedings of the IEEE Symposium on Security and Privacy, 2012.
31. R. Schlegel, K. Zhang, X. yong Zhou, M. Intwala, A. Kapadia, and X. Wang. Soundcomber: A stealthy and context-aware sound trojan for smartphones. In NDSS, 2011.
32. The United States Government. Section 508 Of The Rehabilitation Act. http://www.section508.gov/Section-508-Of-The-Rehabilitation-Act.
33. T. Wang, K. Lu, L. Lu, S. Chung, and W. Lee. Jekyll on ios: When benign apps become evil. In The 22nd USENIX Security Symposium (SECURITY), 2013.
34. L. Wu, M. Grace, Y. Zhou, C. Wu, and X. Jiang. The impact of vendor customizations on Android security. In ACM conference on Computer and communications security (CCS '13), 2013.
35. N. Xu, F. Zhang, Y. Luo,W. Jia, D. Xuan, and J. Teng. Stealthy video capturer: A new video-based spyware in 3g smartphones. In Proceedings of the Second ACM Conference on Wireless Network Security, WiSec '09, New York, NY, USA, 2009. ACM.
36. Y. Zhou and X. Jiang. Detecting passive content leaks and pollution in android applications. In Proceedings of the 20th Annual Symposium on Network and Distributed System Security, 2013.