FLEXDROID: Enforcing In-App Privilege Separa;on in Android Jaebaek - - PowerPoint PPT Presentation

▶
flexdroid enforcing in app privilege separa on in android
SMART_READER_LITE
LIVE PREVIEW

FLEXDROID: Enforcing In-App Privilege Separa;on in Android Jaebaek - - PowerPoint PPT Presentation

Nov 27, 2023 283 likes •859 views

FLEXDROID: Enforcing In-App Privilege Separa;on in Android Jaebaek Seo* , Daehyeok Kim*, Donghyun Cho*, Taesoo Kim, Insik shin* * KAIST Georgia Ins;tute of Technology 1 3 rd -party libraries become popular in Android Applica;on Host code

slide-1
SLIDE 1

FLEXDROID: Enforcing In-App Privilege Separa;on in Android

Jaebaek Seo*, Daehyeok Kim*, Donghyun Cho*, Taesoo Kim†, Insik shin* * KAIST † Georgia Ins;tute of Technology

1

slide-2
SLIDE 2

3rd-party libraries become popular in Android

Applica;on 3rd-party libraries Host code

Ad, Analy;cs, Game engine, Billing, Social

2

slide-3
SLIDE 3

3rd-party libraries become popular in Android

Applica;on 3rd-party libraries Host code

Ad, Analy;cs, Game engine, Billing, Social

How can we trust them?

3

slide-4
SLIDE 4

4

slide-5
SLIDE 5

5

In NDSS 16

The Price of Free: Privacy Leakage in Personalized Mobile In-Apps Ads What Mobile Ads Know About Mobile Users Free for All! Assessing User Data Exposure to Adver;sing Libraries on Android

slide-6
SLIDE 6

6

In NDSS 16

The Price of Free: Privacy Leakage in Personalized Mobile In-Apps Ads What Mobile Ads Know About Mobile Users Free for All! Assessing User Data Exposure to Adver;sing Libraries on Android

Fundamental problem in Android’s permission system

slide-7
SLIDE 7

Problem: Android Permission System

  • The unit of trust in Android: ApplicaDon

<uses-permission ...LocaDon> <uses-permission ...Contacts>

Calendar

Denied

App Loca;on Contacts

7

slide-8
SLIDE 8

Problem: Android Permission System

  • Third-party library: having the same access

right as the host app

<uses-permission ...LocaDon> <uses-permission ...Contacts>

App Loca;on Contacts 3rd-party lib

(The unit of trust)

8

slide-9
SLIDE 9

Problem: Android Permission System

  • Third-party library: having the same access

right as the host app

<uses-permission ...LocaDon> <uses-permission ...Contacts>

App Loca;on Contacts 3rd-party lib

(The unit of trust)

A third-party library can abuse the permissions of its host app

9

slide-10
SLIDE 10

FLEXDROID

Goal: In-app privilege separa;on between a host applica;on and its third-party libraries

10

slide-11
SLIDE 11

Overview of FLEXDROID

Specifying the package name and its permissions in AndroidManifest.xml

<uses-permission ...LocaDon> <uses-permission ...Contacts>

App

Loca;on Contacts

com.ad.sdk com.ad.sdk

Deny

<flexdroid android:name=“com.ad.sdk” > <allow …LocaDon> </flexdroid>

11

slide-12
SLIDE 12

Contributions

  • 1. Report poten;al privacy threats of third-party

libraries by analyzing 100,000 real-world Android apps

  • 2. Provide an in-app privilege separa;on in Android

– Suppor;ng JNI, reflec;on, and mul;-threading

  • 3. Adopt a fault isola;on using ARM Memory Domain

to sandbox na;ve code in Android

12

slide-13
SLIDE 13

Inves;ga;ng Real-world Threats

  • Inves;gate 100,000 Android apps from Google

Play using a sta;c analysis Q1: How many third-party libraries use undocumented permissions? Q2: How many of them rely on dynamic code execu;on?

13

slide-14
SLIDE 14

Undocumented Permissions

Facebook (Social) Flurry (Analy;cs) Paypal (Billing) InMobi (Ad) Chartboost (Ad)

Required Op;onal Undocumented

14

slide-15
SLIDE 15

Undocumented Permissions

Facebook (Social) Flurry (Analy;cs) Paypal (Billing) InMobi (Ad) Chartboost (Ad)

Required Op;onal Undocumented From XXXBank:

Your One-Time Password is

  • 34819. Valid for

5 mins.

15

slide-16
SLIDE 16

Analysis of Real-World Apps

  • Control-flow and data dependency

– Class Inheritance

  • Dynamic run;me behavior

– Java Na;ve Interface (JNI) – Run;me class loading – Reflec;on

71.5% 17.1% 27.9% 49.6%

16

slide-17
SLIDE 17

Challenges

  • Control-flow and data dependency

à Naïvely separa;ng third-party libraries from the host app is not applicable

  • Dynamic run;me behavior

à Sta;cally or dynamically detec;ng malicious behaviors introduces low accuracy

17

slide-18
SLIDE 18

Threat Model

  • Poten;ally malicious third-party libraries

– Obfuscated code and logic

  • Use of dynamic features

(e.g., JNI, reflec;on, mul;-threading)

  • App developers specifying permissions of

each third-party library

18

slide-19
SLIDE 19

SYSTEM DESIGN

19

slide-20
SLIDE 20

Key Idea Adjus;ng permissions dynamically whenever an app requests a resource

20

slide-21
SLIDE 21

Dynamic Permission Adjustment

Permissions of third-party library

  • Loca;on

Permissions of host applica;on

  • Loca;on
  • Contacts

When execu;ng the host applicaDon’s code

App Permissions

21

slide-22
SLIDE 22

Dynamic Permission Adjustment

Permissions of third-party library

  • Loca;on

Permissions of host applica;on

  • Loca;on
  • Contacts

When execu;ng the 3rd-party lib’s code

App Permissions

22

slide-23
SLIDE 23

Iden;fica;on of Executed Code

  • 1. Iden;fy the principal using stack inspec;on
  • 2. Apply the stack inspec;on to Android
  • 3. Protect the integrity of call stack informa;on

against asacks via:

– JNI – Reflec;on – Mul;-threading

23

slide-24
SLIDE 24

Stack Inspec;on in Security Context

Process of determining the permissions allowed to the current thread according to principals shown in the call stack

P Call stack ê A com.A.func;onA B com.B.func;onB C com.C.func;onC

Perm = Perm(A) ∩ Perm(B) ∩ Perm(C)

24

slide-25
SLIDE 25

Inter-process Stack Inspec;on

Internet Dalvik App

Kernel Space User Space

SD Card File Sysm Dalvik Loca;on Manager

Permission Checker

Dalvik PM

Permission Checker

25

slide-26
SLIDE 26

Inter-process Stack Inspec;on

Internet Dalvik App

Kernel Space User Space

SD Card File Sysm Dalvik Loca;on Manager

Permission Checker

Dalvik PM Stack Transmission Channel Stack Tracer

26

slide-27
SLIDE 27

Poten;al Asack Surface

Dalvik App

Kernel Space User Space

Dalvik Loca;on Manager Dalvik PM Stack Transmission Channel Stack Tracer

JNI Reflection Multi-threading

27

slide-28
SLIDE 28

Poten;al Asack Surface

  • Compromising stack tracer
  • Manipula;ng Dalvik call stack
  • Hijacking the control data

e.g., code injec;on on Dalvik func;ons, manipula;ng code pointers JNI JNI, Reflection, Multi-threading JNI

28

slide-29
SLIDE 29

Protec;ng Integrity of Call Stack

  • JNI Sandbox
  • Defense mechanism against asacks via

reflec;on

  • Defense mechanism against asacks via

mul;-threading

  • JNI Sandbox
  • Defense mechanism against asacks via

reflec;on

  • Defense mechanism against asacks via

mul;-threading

29

slide-30
SLIDE 30

JNI Sandbox

  • Inspired by ARMlock (CCS’14),

applying Fault Isola5on using ARM Memory Domain to Android

  • Key Idea

– Regard JNI code of 3rd-party libraries as poten;ally malicious code – Run JNI in an isolated and restricted memory domain

30

slide-31
SLIDE 31

Fault Isola;on using ARM Memory Domain

App address space Java domain

31

libc.so libdvm.so Heap Stack Thread Local Storage (TLS) …

slide-32
SLIDE 32

JNI domain

Fault Isola;on using ARM Memory Domain

App address space Java domain

libc.so libdvm.so Heap Stack Thread Local Storage (TLS) …

32

slide-33
SLIDE 33

JNI domain

Fault Isola;on using ARM Memory Domain

App address space Java domain

FLEXDROID allows Dalvik VM to access both memory domains

Dalvik VM

33

slide-34
SLIDE 34

JNI domain

Fault Isola;on using ARM Memory Domain

App address space Java domain

by setting Domain Access Control Register of each thread

JNI code

34

slide-35
SLIDE 35

JNI domain

Fault Isola;on using ARM Memory Domain

App address space Java domain

JNI code

Domain Fault

35

slide-36
SLIDE 36

Memory and Shared Libraries for JNI

App address space Java domain JNI domain

libc.so Heap Stack TLS … Stay in Java domain!!

36

slide-37
SLIDE 37

Memory and Shared Libraries for JNI

  • Shared libraries (e.g., libc.so), heap, stack and

TLS are in Java domain

– JNI cannot access them

à FLEXDROID provides JNI with independent shared libraries, heap, stack and TLS

37

slide-38
SLIDE 38

Defense against Reflec;on

  • Problem: A third-party library can dynamically

generate a class with the package name of its host applica;on

38

slide-39
SLIDE 39

Defense against Reflec;on

  • Problem: A third-party library can dynamically

generate a class with the package name of its host applica;on

P Call stack ê H com.host.C.runCallback L com.host.B.malFunc

package com.malicious.lib class A method launch_attack generateClass(“com.host.B”) generateClass(“com.host.B”, “malFunction”) loadClass(“com.host.B”) com.host.C.setCallback(new com.host.B()) end method end class

39

slide-40
SLIDE 40

Defense against Reflec;on

  • Problem: A third-party library can dynamically

generate a class with the package name of its host applica;on

P Call stack ê H com.host.C.runCallback L com.host.B.malFunc

package com.malicious.lib class A method launch_attack generateClass(“com.host.B”) generateClass(“com.host.B”, “malFunction”) loadClass(“com.host.B”) com.host.C.setCallback(new com.host.B()) end method end class

com.malicious.lib

FLEXDROID maintains the informa;on of class loader 40

slide-41
SLIDE 41

Implementa;on

  • Android 4.4.4 Kitkat / Linux 3.4.0

41

# of Files InserDon (LoC) DeleDon (LoC) Kernel 28 1831 25 Android Framework 46 1466 77 Dalvik VM 24 6081 22 Bionic 23 2827 70 Others 12 95 24 Total 133 12300 218

slide-42
SLIDE 42

EVALUATION

42

slide-43
SLIDE 43

Overview

  • How effec;ve is FLEXDROID’s policy to restrict

third-party libraries?

  • How easy is it to adopt FLEXDROID’s policy to

exis;ng Android apps?

  • How much performance overhead does

FLEXDROID impose when adopted?

43

slide-44
SLIDE 44

Blocking Permissions with FLEXDROID

  • Choosing 8 third-party libraries from

real-world apps

  • Repackaging their host applica;ons with

FLEXDROID policy

– No permission given to third-party libraries

à Denying all accesses to resources from third-party libraries

44

slide-45
SLIDE 45

Blocking Permissions with FLEXDROID

  • Choosing 8 third-party libraries from

real-world apps

  • Repackaging their host applica;ons with

FLEXDROID policy

– No permission given to third-party libraries

à Denying all accesses to resources from third-party libraries

FLEXDROID can block permission abuses of 3rd-party libs

45

slide-46
SLIDE 46

Blocking Permissions with FLEXDROID

  • By modifying only AndroidManifest.xml

à Easy to adopt FLEXDROID’s policy

<flexdroid android:name=“com.ebay.redlasersdk”> <!-- no permission --> </flexdroid>

46

slide-47
SLIDE 47

Backward Compa;bility

  • Run 32 popular apps from Google Play without any

modifica;on in FLEXDROID

  • Check to see if each of them crashes during the

execu;on

à 27 of 32 apps run as normal

Other apps crashed due to JNI sandbox

à FLEXDROID has a high backward compa;bility

47

slide-48
SLIDE 48

Performance Evalua;on

  • Environment sexng

– Nexus 5 – Turning on all cores with maximum CPU frequency

  • Micro-benchmark
  • Macro-benchmark

– K-9 email app

48

slide-49
SLIDE 49

Micro-benchmark Result

Main factors of performance overheads

  • 1. Inter-process stack inspec;on
  • 2. Sandbox switch

(i.e., switch to JNI domain / Java domain)

à 438 ~ 594 μs à 89 μs

49

slide-50
SLIDE 50

Macro-benchmark Result

In the experiment using K-9 email app

  • 1. Launching the app
  • 2. Send an email

à 1.55 % à 1.13 %

50

slide-51
SLIDE 51

Macro-benchmark Result

In the experiment using K-9 email app

  • 1. Launching the app
  • 2. Send an email

à 1.55 % à 1.13 %

FLEXDROID incurs reasonable performance overheads

51

slide-52
SLIDE 52

Conclusion

  • Problem: Privacy threats from 3rd-party libraries
  • FLEXDROID: Extension of Android permission system

– Suppor;ng in-app privilege separa;on – Resistant against asacks via JNI, reflec;on and mul;-threading – Showing reasonable performance overheads

52

slide-53
SLIDE 53

Thank you!

53

slide-54
SLIDE 54

BACKUP SLIDE

54

slide-55
SLIDE 55

Backward Compa;bility Issues

  • 5 crashed apps

– Waze Social GPS Map & Travel – Uber – Adobe Acrobat Reader – Facebook – UC Browser Pthread / TLS mmap() Many JNI libraries (29 and 20, respec;vely) à too complicated to manually analyze them free()

55

slide-56
SLIDE 56

Previous Works

  • AdRisk (Wisec’ 12)

– Report private threats from ad libraries

  • AdSplit (Usenix Sec’ 12) / AdDroid (AsiaCCS’ 12)

– Separate an ad library from its host app

  • Na;veGuard (WiSec’ 14)

– Separate a library wrisen in na;ve code from its host app

  • Compac (CODASPY’ 14)

– Suggest an idea similar to inter-process stack inspec;on

56