A NALYZING I NTER -A PPLICATION C OMMUNICATION IN A NDROID Erika - PowerPoint PPT Presentation

A NALYZING I NTER -A PPLICATION C OMMUNICATION IN A NDROID Erika Chin Adrienne Porter Felt Kate Greenwood David Wagner UC Berkeley

I NTER -A PPLICATION C OMMUNICATION Yelp App • Eavesdropping Attacks • Injection Attacks Inter-Application Communication Malicious Other App Maps App Dialer App App 2

O RGANIZATION ¢ Android communication model ¢ Security analysis of Android ¢ ComDroid ¢ Analysis of third-party applications ¢ Recommendations 3

A NDROID O VERVIEW ¢ Intents = Android IPC ¢ Applications are divided into components ¢ Intents can be sent between components ¢ Intents can be used for intra- and inter-application communication Receiver Sender Intent 4

E XPLICIT I NTENTS Name: MapActivity Map Yelp App To: MapActivity Only the specified destination receives this message 5

I MPLICIT I NTENTS Handles Action: VIEW Map App Yelp Handles Action: DISPLAYTIME Clock Implicit Intent App Action: VIEW 6

I MPLICIT I NTENTS Handles Action: VIEW Map App Yelp Handles Action: VIEW Browser Implicit Intent App Action: VIEW 7

S ECURITY A NALYSIS O F A NDROID 8

C OMMON D EVELOPER P ATTERN : U NIQUE A CTION S TRINGS IMDb App Handles Actions: willUpdateShowtimes , showtimesNoLocationError Showtime Results UI Search Implicit Intent Action: willUpdateShowtimes 9

10

C OMMON D EVELOPER P ATTERN : U NIQUE A CTION S TRINGS IMDb App Handles Actions: willUpdateShowtimes , showtimesNoLocationError Showtime Results UI Search Implicit Intent Action: willUpdateShowtimes 11

ATTACK #1: E AVESDROPPING IMDb App Eavesdropping App Handles Action: willUpdateShowtimes , showtimesNoLocationError Showtime Malicious Search Receiver Implicit Intent Action: willUpdateShowtimes 12 Sending Implicit Intents makes communication public

ATTACK #2: I NTENT S POOFING Malicious IMDb App Injection Handles Action: App willUpdateShowtimes , showtimesNoLocationError Malicious Results UI Component Action: showtimesNoLocationError 13 Receiving Implicit Intents makes the component public

14 Typical case Attack case

ATTACK #3: M AN IN THE M IDDLE IMDb App Man-in-the-Middle App Handles Action: Handles Action: willUpdateShowtimes , willUpdateShowtimes , showtimesNoLocation showtimesNoLocationError Error Showtime Results UI Malicious Search Receiver Action: Action: willUpdateShowtimes showtimesNoLocation Error 15

ATTACK #4: S YSTEM I NTENT S POOFING ¢ Background – System Broadcast — Event notifications sent by the system — Some can only be sent by the system ¢ Receivers become accessible to all applications when listening for system broadcast 16

App 1 S YSTEM B ROADCAST Component Handles Action: BootCompleted System Notifier App 2 Component Handles Action: BootCompleted Action: App 3 BootCompleted Component 17 Handles Action: BootCompleted

S YSTEM I NTENT S POOFING : F AILED A TTACK Malicious App 1 App Handles Action: BootCompleted Malicious Component Component Action: BootCompleted 18

S YSTEM I NTENT S POOFING : S UCCESSFUL A TTACK Malicious App 1 App Handles Action: BootCompleted Malicious Component Component To: App1.Component 19

R EAL W ORLD E XAMPLE : ICE A PP ¢ ICE App: Allows doctors access to medical information on phones ¢ Contains a component that listens for the BootCompleted system broadcast ¢ On receipt of the Intent, it exits the application and locks the screen 20

R EAL W ORLD E XAMPLE : ICE 21

C OM D ROID Security Android Warnings for Executable ComDroid Exposed File Communication ComDroid analyzes applications to detect Intent- based attack surfaces 22

E VALUATION ¢ Manually verified ComDroid’s warnings for 20 applications ¢ 60% of applications examined have at least 1 exploitable IPC vulnerability Type # of # of Apps Warnings Severe Vulnerability 34 12 Bad Practice 16 6 Spurious Warning 6 6 23

R ECOMMENDATIONS ¢ Treat inter- and intra-application communication as different cases ¢ Prevent public internal communication — 21% of severe vulnerabilities — 63% of bugs due to bad practice ¢ Verify system broadcasts — 6% of severe vulnerabilities — 13% of bugs due to bad practice ¢ Can be fixed by either developers or platform 24

R ELATED W ORK ¢ Enck et al. – introduces information leakage through Broadcast Intents and information injection into Receivers ¢ Burns – discusses other common developers’ errors 25

C ONCLUSION ¢ Applications may be vulnerable to other applications through Android Intent communication ¢ Many developers misuse Intents or do not realize the consequences of their program design ¢ 60% of applications examined had at least 1 vulnerability ¢ ComDroid tool to be publically accessible soon at 26 www.comdroid.org

Thank you! Any questions? 27