AW ARE : Preventing Abuse of Privacy-Sensitive Sensors via Operation - - PowerPoint PPT Presentation

▶
aw are preventing abuse of privacy sensitive sensors via
SMART_READER_LITE
LIVE PREVIEW

AW ARE : Preventing Abuse of Privacy-Sensitive Sensors via Operation - - PowerPoint PPT Presentation

Jun 22, 2023 257 likes •818 views

AW ARE : Preventing Abuse of Privacy-Sensitive Sensors via Operation Bindings Giuseppe Petracca Ahmad-Atamli Reineh Trent Jaeger gxp18@cse.psu.edu atamli@cs.ox.ac.uk tjaeger@cse.psu.edu The Pennsylvania State University University of

slide-1
SLIDE 1

AWARE: Preventing Abuse of Privacy-Sensitive Sensors via Operation Bindings

Giuseppe Petracca

gxp18@cse.psu.edu The Pennsylvania State University School of Electrical Engineering and Computer Science Institute for Networking and Security Research

Ahmad-Atamli Reineh

atamli@cs.ox.ac.uk University of Oxford, UK

  • Dept. of Electrical Engineering and Computer Science

Yuqiong Sun

yuqiong_sun@symantec.com Symantec Research Labs, US

Jens Grossklags

jens.grossklags@in.tum.de Technical University of Munich, DE

Trent Jaeger

tjaeger@cse.psu.edu The Pennsylvania State University School of Electrical Engineering and Computer Science Institute for Networking and Security Research

1

slide-2
SLIDE 2

Increasing Availability of Privacy-Sensitive Sensors

Controlling when applications may use privacy-sensitive sensors (i.e., cameras, microphones, and touch screens): Banking Screen Sharing

  • G. Petracca et al. - AWARE: Preventing Abuse of Privacy-Sensitive Sensors via Operation Bindings

Entertainment

2

slide-3
SLIDE 3

Abuse of Privacy-Sensitive Sensors

  • G. Petracca et al. - AWARE: Preventing Abuse of Privacy-Sensitive Sensors via Operation Bindings

3

slide-4
SLIDE 4

Real World Incidents

  • G. Petracca et al. - AWARE: Preventing Abuse of Privacy-Sensitive Sensors via Operation Bindings

4

slide-5
SLIDE 5

Current Authorization Mechanisms

Install-Time First-Use

  • G. Petracca et al. - AWARE: Preventing Abuse of Privacy-Sensitive Sensors via Operation Bindings

Beginning in Android 6.0 (API level 23), users grant permissions to apps while the app is running, not whey the install the app!

5

slide-6
SLIDE 6

Shortcomings

  • G. Petracca et al. - AWARE: Preventing Abuse of Privacy-Sensitive Sensors via Operation Bindings

6

slide-7
SLIDE 7

Shortcomings

  • G. Petracca et al. - AWARE: Preventing Abuse of Privacy-Sensitive Sensors via Operation Bindings

7

slide-8
SLIDE 8

Shortcomings

  • G. Petracca et al. - AWARE: Preventing Abuse of Privacy-Sensitive Sensors via Operation Bindings

8

slide-9
SLIDE 9

What Is The Access Control Problem?

  • G. Petracca et al. - AWARE: Preventing Abuse of Privacy-Sensitive Sensors via Operation Bindings

Series ISSN: XXXX-XXXX

Morgan Claypool Publishers

&

w w w . m o r g a n c l a y p o o l . c o m

Series Editor: Ravi Sandhu, University of Texas at San Antonio

&

Morgan Claypool

C M &

Morgan Claypool Publishers

&

SYNTHESIS LECTURES ON INFORMATION SECURITY, PRIV

ACY, AND TRUST

SYNTHESIS LECTURES ON INFORMATION SECURITY, PRIV

ACY, AND TRUST

About SYNTHESIs This volume is a printed version of a work that appears in the Synthesis Digital Library of Engineering and Computer Science. Synthesis Lectures provide concise, original presentations of important research and development topics, published quickly, in digital and print formats. For more information visit www.morganclaypool.com

Ravi Sandhu, Series Editor

ISBN: 978-1-59829-212-1

9 781598 292121 90000

OPERATING SYSTEM SECURITY

JAEGER

Operating System Security

Trent Jaeger, The Pennsylvania State University Operating systems provide the fundamental mechanisms for securing computer processing. Since the 1960s,

  • perating systems designers have explored how to build “secure” operating systems — operating systems whose

mechanisms protect the system against a motivated adversary. Recently, the importance of ensuring such security has become a mainstream issue for all operating systems. In this book, we examine past research that outlines the requirements for a secure operating system and research that implements example systems that aim for such requirements. For system designs that aimed to satisfy these requirements, we see that the complexity of software systems often results in implementation challenges that we are still exploring to this day. However, if a system design does not aim for achieving the secure operating system requirements, then its security features fail to protect the system in a myriad of ways. We also study systems that have been retrofit with secure operating system features after an initial deployment. In all cases, the conflict between function on one hand and security

  • n the other leads to difficult choices and the potential for unwise compromises. From this book, we hope that

systems designers and implementers will learn the requirements for operating systems that effectively enforce security and will better understand how to manage the balance between function and security.

Operating System Security

Trent Jaeger 9

slide-10
SLIDE 10

Confused Deputy Problem

Permission holder (Android system) may be tricked into using its permissions (sensor access) based on a misleading/malicious request (from an app) Typically related to servers being tricked into unauthorized file access E.g., web server serving a password file by mishandling malicious request Goal in this case: System only grants sensor access when system and user approve How does the Android system validate user approval? How do users know what they are approving? Good news: Android system can capture all user input events

  • G. Petracca et al. - AWARE: Preventing Abuse of Privacy-Sensitive Sensors via Operation Bindings

10

slide-11
SLIDE 11

Proposed Defenses

Input-Driven Access Control (IDAC) Authorize an operation request that immediately follows a user input event

  • G. Petracca et al. - AWARE: Preventing Abuse of Privacy-Sensitive Sensors via Operation Bindings

User inputs associated with operation authorizations Binding between the user inputs and the authorized operations still unknown to the system!

11

slide-12
SLIDE 12

Proposed Defenses

User-Driven Access Control (UDAC) Applications must use system-defined gadgets associated with particular operations

  • G. Petracca et al. - AWARE: Preventing Abuse of Privacy-Sensitive Sensors via Operation Bindings

Binding between the user input and the authorized operation explicit to the system Binding still not explicit to the user!

12

slide-13
SLIDE 13

Limitations of Prior Work

Leverage the user as weak link to circumvent protection mechanisms! “User Interface Attacks” User may fail to: Identify the application requesting sensor access Recognize subtle changes in the Graphic User Interface (GUI) Understand the operation granted by a particular gadget

  • G. Petracca et al. - AWARE: Preventing Abuse of Privacy-Sensitive Sensors via Operation Bindings

13

slide-14
SLIDE 14

User Interface Attacks (Bait-and-Switch)

Window A x Interac(on #1

  • G. Petracca et al. - AWARE: Preventing Abuse of Privacy-Sensitive Sensors via Operation Bindings

14

slide-15
SLIDE 15

User Interface Attacks (Bait-and-Switch)

Window A x Interac(on #2

  • G. Petracca et al. - AWARE: Preventing Abuse of Privacy-Sensitive Sensors via Operation Bindings

15

slide-16
SLIDE 16

User Interface Attacks (Bait-and-Switch)

Window A x Interac(on #3

  • G. Petracca et al. - AWARE: Preventing Abuse of Privacy-Sensitive Sensors via Operation Bindings

16

slide-17
SLIDE 17

User Interface Attacks (Bait-and-Switch)

Window A x Interac(on #4

  • G. Petracca et al. - AWARE: Preventing Abuse of Privacy-Sensitive Sensors via Operation Bindings

17

slide-18
SLIDE 18

User Interface Attacks (Bait-and-Switch)

Window A x Interac(on #5

  • G. Petracca et al. - AWARE: Preventing Abuse of Privacy-Sensitive Sensors via Operation Bindings

18

slide-19
SLIDE 19

User Interface Attacks (Bait-and-Switch)

Window A x Interac(on #4

“Bait-and-Switch A:ack”

The applica*on maintained the windowing display context but switched the widget to record audio

  • G. Petracca et al. - AWARE: Preventing Abuse of Privacy-Sensitive Sensors via Operation Bindings

19

slide-20
SLIDE 20

User Interface Attacks (Application Spoofing) Window A x

  • G. Petracca et al. - AWARE: Preventing Abuse of Privacy-Sensitive Sensors via Operation Bindings

20

slide-21
SLIDE 21

User Interface Attacks (Application Spoofing)

A click by the user allows the Legi(mate App to record audio

Window A x

  • G. Petracca et al. - AWARE: Preventing Abuse of Privacy-Sensitive Sensors via Operation Bindings

21

slide-22
SLIDE 22

User Interface Attacks (Application Spoofing) Window A x

A click by the user allows the Spoofing App to record audio

“Applica(on Spoofing A:ack”

  • G. Petracca et al. - AWARE: Preventing Abuse of Privacy-Sensitive Sensors via Operation Bindings

22

slide-23
SLIDE 23

Proposed Defenses

User-Driven Access Control (UDAC) Applications must use system-defined gadgets associated with particular operations Compatibility Issue

  • G. Petracca et al. - AWARE: Preventing Abuse of Privacy-Sensitive Sensors via Operation Bindings

23

slide-24
SLIDE 24

Proposed Defenses

No Customization 3,000,000+ apps Need Redesign

  • G. Petracca et al. - AWARE: Preventing Abuse of Privacy-Sensitive Sensors via Operation Bindings

User-Driven Access Control (UDAC) Applications must use system-defined gadgets associated with particular operations

24

slide-25
SLIDE 25

Research Objectives

Prevent User Interface Attacks Maintain a low authorization effort for the user Ensure compatibility with existing applications Ensure a performance overhead not perceivable by the user

  • G. Petracca et al. - AWARE: Preventing Abuse of Privacy-Sensitive Sensors via Operation Bindings

25

slide-26
SLIDE 26

Preventing Operation Switching Attacks

Goal: Prevent applications from changing the mapping between a widget and the associated operation

  • G. Petracca et al. - AWARE: Preventing Abuse of Privacy-Sensitive Sensors via Operation Bindings

Window A x

Take Photo Record Video

26-1

slide-27
SLIDE 27

Preventing Operation Switching Attacks

Goal: Prevent applications from changing the mapping between a widget and the associated operation

  • G. Petracca et al. - AWARE: Preventing Abuse of Privacy-Sensitive Sensors via Operation Bindings

Window A x

Take Photo Record Video

26-2

slide-28
SLIDE 28

Preventing Operation Switching Attacks

Goal: Prevent applications from changing the mapping between a widget and the associated operation

  • G. Petracca et al. - AWARE: Preventing Abuse of Privacy-Sensitive Sensors via Operation Bindings

Window A x

Insights: Bind each user input event (e) with the widget (w) displayed on the screen by the application (app)

27

slide-29
SLIDE 29

Preventing Operation Switching Attacks

Goal: Prevent applications from changing the mapping between a widget and the associated operation

  • G. Petracca et al. - AWARE: Preventing Abuse of Privacy-Sensitive Sensors via Operation Bindings

Window A x

Insights: Bind each user input event (e) with the widget (w) displayed on the screen by the application (app) Intercept the operation request (op) then bind it to the application identity (app) and the set of sensors (S) targeted by the operation capturePhoto()

28

slide-30
SLIDE 30

Preventing Operation Switching Attacks

Goal: Prevent applications from changing the mapping between a widget and the associated operation

  • G. Petracca et al. - AWARE: Preventing Abuse of Privacy-Sensitive Sensors via Operation Bindings

Window A x

Insights: Bind each user input event (e) with the widget (w) displayed on the screen by the application (app) Intercept the operation request (op) then bind it to the application identity (app) and the set of sensors (S) targeted by the operation Request the user to authorize the binding request explicitly

29

slide-31
SLIDE 31

AWARE’s Operation Binding

(app, S, op, e, w, c)

app = application associated with widget and operation request S = set of sensors targeted by the request

  • p = operation being requested

e = user input event w = user interface widget c = user interface configuration containing the widget + activity window call graph

  • G. Petracca et al. - AWARE: Preventing Abuse of Privacy-Sensitive Sensors via Operation Bindings

AWare Binding Request Allow Instagram to use the front Camera to take Pictures when pressing ?

Allow Deny

AWARE: Authorization Framework extending OS middleware to make access to privacy-sensitive sensors explicit to both the system and the user System User

30

slide-32
SLIDE 32

AWARE’s Explicit Binding Request

AWare Binding Request Allow Instagram to use the front Camera to take Pictures when pressing ?

Allow Deny

  • G. Petracca et al. - AWARE: Preventing Abuse of Privacy-Sensitive Sensors via Operation Bindings

app (Application ID) Currently (First-Use)

AWARE

31

slide-33
SLIDE 33

AWARE’s Explicit Binding Request

  • G. Petracca et al. - AWARE: Preventing Abuse of Privacy-Sensitive Sensors via Operation Bindings

S (Set of Sensors)

AWare Binding Request Allow Instagram to use the front Camera to take Pictures when pressing ?

Allow Deny

32

slide-34
SLIDE 34

AWARE’s Explicit Binding Request

  • G. Petracca et al. - AWARE: Preventing Abuse of Privacy-Sensitive Sensors via Operation Bindings

AWare Binding Request Allow Instagram to use the front Camera to take Pictures when pressing ?

Allow Deny

  • p

(Requested Operation)

33

slide-35
SLIDE 35

AWARE’s Explicit Binding Request

  • G. Petracca et al. - AWARE: Preventing Abuse of Privacy-Sensitive Sensors via Operation Bindings

AWare Binding Request Allow Instagram to use the front Camera to take Pictures when pressing ?

Allow Deny

e (Input Event)

34

slide-36
SLIDE 36

AWARE’s Explicit Binding Request

  • G. Petracca et al. - AWARE: Preventing Abuse of Privacy-Sensitive Sensors via Operation Bindings

AWare Binding Request Allow Instagram to use the front Camera to take Pictures when pressing ?

Allow Deny

w (Widget)

35

slide-37
SLIDE 37

Effect: Enable the user to verify the association between the operation being authorized (app, S, op) and the widget (w) used to obtain the user input event (e) to initiate the operation Advantages: Avoid authorizing an unwanted operation by a user input event (IDAC) Apps are allowed to choose the widgets to associate with particular operations (UDAC)

Preventing Operation Switching Attacks

  • G. Petracca et al. - AWARE: Preventing Abuse of Privacy-Sensitive Sensors via Operation Bindings

Window A x

Goal: Prevent applications from changing the mapping between a widget and the associated operation

36

slide-38
SLIDE 38

Preventing Bait-and-Switch Attacks

Goal: Prevent applications from changing the user interface configuration for a widget

  • G. Petracca et al. - AWARE: Preventing Abuse of Privacy-Sensitive Sensors via Operation Bindings

Window A x

capturePhoto()

37

slide-39
SLIDE 39

Preventing Bait-and-Switch Attacks

Goal: Prevent applications from changing the user interface configuration for a widget

  • G. Petracca et al. - AWARE: Preventing Abuse of Privacy-Sensitive Sensors via Operation Bindings

Window A x

Insights: Bind the operation request (app, S, op) with the user interface configuration (c) used to display the widget (w) to elicit a user input event (e) Define a display context as set of structural features of the most enclosing activity window containing the widget (w) capturePhoto()

widget’s position background border window title widget’s size

38

slide-40
SLIDE 40

Preventing Bait-and-Switch Attacks

Goal: Prevent applications from changing the user interface configuration for a widget

  • G. Petracca et al. - AWARE: Preventing Abuse of Privacy-Sensitive Sensors via Operation Bindings

Window A x

Effects: Identify instance of the same window (i.e., display context) with a different widget Identify same widget presented in a different window (i.e., display context) Advantage: User does not need to check for subtle changes to the widgets or their display context (IDAC and UDAC). Changes detected and flagged by the system automatically.

Window A x Window A x Window A x

39

slide-41
SLIDE 41

Preventing Application Spoofing Attacks

Goal: Prevent applications from replacing the foreground activity window of another application

  • G. Petracca et al. - AWARE: Preventing Abuse of Privacy-Sensitive Sensors via Operation Bindings

Window A x Window A x

Activity Window Hijacking

40

slide-42
SLIDE 42

Preventing Application Spoofing Attacks

Goal: Prevent applications from replacing the foreground activity window of another application

  • G. Petracca et al. - AWARE: Preventing Abuse of Privacy-Sensitive Sensors via Operation Bindings

Insight: Construct an Activity Window Call Graph (G) where nodes represent activity windows and edges represent enabled transitions (i.e., user inputs or system events)

e1 e2 e3 e5 a_w1 a_w2 bg a_w4

{w1,,w2} {w3}

a_w3 e4 e6 e7 e8

41

slide-43
SLIDE 43

Preventing Application Spoofing Attacks

Goal: Prevent applications from replacing the foreground activity window of another application

  • G. Petracca et al. - AWARE: Preventing Abuse of Privacy-Sensitive Sensors via Operation Bindings

Effects: Activity Window Call Graph (G) built while the application runs Record the relationships among windows used by an application Advantage: Identify and block activity window hijacking (IDAC and UDAC)

Window A x Window A x 42

slide-44
SLIDE 44

Maintain a Low Authorization Effort for the User

Insights: Use a caching mechanism for operation bindings Remove an operation binding from cache if an app changes the way it elicits an operation Effect: “The application will be automatically allowed to perform the requested operation on the set of sensors whenever the user produces the same input event using the same widget within the same user interface configuration” Advantages: Require an explicit user's authorization only the first time an operation binding is identified (First-Use) Ensure that operation bindings do not become stale Prevent an operation from being authorized in multiple ways Reduce manual authorization by users

  • G. Petracca et al. - AWARE: Preventing Abuse of Privacy-Sensitive Sensors via Operation Bindings

Goal: Limit the number of explicit authorizations by the user

43

slide-45
SLIDE 45

Ensure Compatibility with Existing Apps

Insights: No external libraries No code annotation No app code rewriting Dynamic monitoring and creation of operation bindings Effect: Can be integrated with existing off-the-shelf operating systems Advantages: Facilitate adoption and deployability No effort or burden for app developers

  • G. Petracca et al. - AWARE: Preventing Abuse of Privacy-Sensitive Sensors via Operation Bindings

Goal: Allow applications to choose how they elicit user approval for use of a sensor

44

slide-46
SLIDE 46

Experimental Evaluation

Prototyped (Android OS 6.0.1_r5) Tested (Nexus 5 and Nexus 5X smartphones) Research Questions: To what degree is the AWARE operation binding concept assisting the users in avoiding attacks? (Effectiveness) What is the decision overhead imposed to users due to per-configuration access control? (Usability) How many existing apps malfunctioned due to the integration of AWARE? (Compatibility) What is the performance overhead imposed by AWARE for the operation binding construction and enforcement? (Performance)

  • G. Petracca et al. - AWARE: Preventing Abuse of Privacy-Sensitive Sensors via Operation Bindings

45

slide-47
SLIDE 47

Effectiveness

To what degree is the AWARE operation binding concept assisting the users in avoiding attacks? Laboratory-Based User Study (90 Participants) Groups: Install-Time, First-Use, Input-Driven, System-Defined Gadgets, and AWARE

  • G. Petracca et al. - AWARE: Preventing Abuse of Privacy-Sensitive Sensors via Operation Bindings

46

slide-48
SLIDE 48

Effectiveness

  • G. Petracca et al. - AWARE: Preventing Abuse of Privacy-Sensitive Sensors via Operation Bindings

To what degree is the AWARE operation binding concept assisting the users in avoiding attacks? Laboratory-Based User Study (90 Participants) Groups: Install-Time, First-Use, Input-Driven, System-Defined Gadgets, and AWARE

47

slide-49
SLIDE 49

Effectiveness

To what degree is the AWARE operation binding concept assisting the users in avoiding attacks? Experimental Results: TASK 1: Operation performed by app not visible (Exception for Access Control Gadgets) Attack Prevention Rate: First-Use 7% vs AWARE 100% (UDAC) TASK 2 and TASK 3: Users were successfully tricked by switching the user interface configuration! Attack Prevention Rate: UDAC 13% vs AWARE 93% TASK 4: Real identity of the app performing the operation was not visible to users Attack Prevention Rate: All Others 7% vs AWARE 100%

  • G. Petracca et al. - AWARE: Preventing Abuse of Privacy-Sensitive Sensors via Operation Bindings

48

slide-50
SLIDE 50

Usability

What is the decision overhead imposed to users due to per-configuration access control? Field-Based User Study (24 Participants) 21 apps (7 categories)* 1 week (Comparison with First-Use)

  • G. Petracca et al. - AWARE: Preventing Abuse of Privacy-Sensitive Sensors via Operation Bindings

4 explicit authorizations per-application on average with AWare vs. 2 for first-use *www.statistica.com

49

slide-51
SLIDE 51

Compatibility

How many existing apps malfunctioned due to the integration of AWARE? Android Compatibility Test Suite (CTS): 1,000 apps (Google Play) 13 hours and 28 minutes Experimental Results: 126,681 passed tests over 126,686 [Viber] Camera and microphone probing at reboot (No impact on video or voice calls)

  • G. Petracca et al. - AWARE: Preventing Abuse of Privacy-Sensitive Sensors via Operation Bindings

50

slide-52
SLIDE 52

Performance

What is the performance overhead imposed by AWARE for the operation binding construction and enforcement? Android UI/Application Exerciser Monkey: 1,000 apps (Google Play) Nexus 5 and Nexus 5X Microbenchmark: Access requests for operation targeting privacy-sensitive sensors 10,000 operations About 3% overhead on microbenchmarks Experimental Results: 0.33% system-wide performance overhead About 3 MB of memory for the operation binding cache and window call graphs

  • G. Petracca et al. - AWARE: Preventing Abuse of Privacy-Sensitive Sensors via Operation Bindings

51

slide-53
SLIDE 53

Conclusion

Authorization of sensor operations explicit to both system and user (Operation Binding + Explicit Authorization) Up to 100% user interface attack prevention (only up to 13% with alternative approaches) Low user effort (Caching of Bindings when the user interface configuration is same for the same operation) 4 explicit authorizations per-application on average Compatible with existing applications (No app modification or redesign) Only 5 minor compatibility issues out of 1,000 tested apps Negligible Performance Overhead (limited number of authorization hooks and quick retrieval of bindings) 0.33% performance overhead and 3 MB of memory

  • G. Petracca et al. - AWARE: Preventing Abuse of Privacy-Sensitive Sensors via Operation Bindings

52

slide-54
SLIDE 54

Thank You For Your Attention!

Giuseppe Petracca

Ph.D. Candidate gxp18@cse.psu.edu https//sites.psu.edu/petracca/ Source Code: https:/github.com/gxp18/AWare

Research Funded by:

53

slide-55
SLIDE 55

Approach Overview

  • G. Petracca et al. - AWARE: Preventing Abuse of Privacy-Sensitive Sensors via Operation Bindings

AWARE Authorization Workflow

54