Static Analysis for Extracting Permission Checks of a Large Scale - - PowerPoint PPT Presentation

▶
static analysis for extracting permission checks of a
SMART_READER_LITE
LIVE PREVIEW

Static Analysis for Extracting Permission Checks of a Large Scale - - PowerPoint PPT Presentation

Nov 17, 2022 206 likes •997 views

Android Framework Static Analysis for Extracting Permission Checks of a Large Scale Framework: The Challenges And Solutions for Analyzing Android Alexandre Bartel University of Luxembourg September 8, 2014 Supervisor: Yves Le Traon Advisors:

slide-1
SLIDE 1

Android Framework

Static Analysis for Extracting Permission Checks

  • f a Large Scale Framework: The Challenges And

Solutions for Analyzing Android

Alexandre Bartel

University of Luxembourg

September 8, 2014

Supervisor: Yves Le Traon Advisors: Jacques Klein & Martin Monperrus

Alexandre Bartel Static Analysis of Permission-Based Systems 1 / 22

slide-2
SLIDE 2

Android Framework

Static Analysis of a Permission-Based Security System

Application

Alexandre Bartel Static Analysis of Permission-Based Systems 2 / 22

slide-3
SLIDE 3

Android Framework

Static Analysis of a Permission-Based Security System

s 2 3 4 5

The application declares permissions p1 and p2

Application

Alexandre Bartel Static Analysis of Permission-Based Systems 2 / 22

slide-4
SLIDE 4

Android Framework

Static Analysis of a Permission-Based Security System

s 2 3 4 5 e1 e2 e3

The application declares permissions p1 and p2

Application

Alexandre Bartel Static Analysis of Permission-Based Systems 2 / 22

slide-5
SLIDE 5

Android Framework

Static Analysis of a Permission-Based Security System

s 2 3 4 5 e1 e2 e3 e4

The application declares permissions p1 and p2

Application Framework

Alexandre Bartel Static Analysis of Permission-Based Systems 2 / 22

slide-6
SLIDE 6

Android Framework

Static Analysis of a Permission-Based Security System

s 2 3 4 5 e1 e2 e3 e4

The application declares permissions p1 and p2

f 1 f 2 f 3 f 4 f 5 f 6 f 8 f 9 Application Framework

Alexandre Bartel Static Analysis of Permission-Based Systems 2 / 22

slide-7
SLIDE 7

Android Framework

Static Analysis of a Permission-Based Security System

s 2 3 4 5 e1 e2 e3 e4

The application declares permissions p1 and p2

f 1 f 2 f 3 f 4 f 5 f 6 f 8 f 9 ck1 ck2 Application Framework

Alexandre Bartel Static Analysis of Permission-Based Systems 2 / 22

slide-8
SLIDE 8

Android Framework

Static Analysis of a Permission-Based Security System

s 2 3 4 5 e1 e2 e3 e4

The application declares permissions p1 and p2

f 1 f 2 f 3 f 4 f 5 f 6 f 8 f 9 ck1 ck2 p3 p2 p1 Application Framework

Alexandre Bartel Static Analysis of Permission-Based Systems 2 / 22

slide-9
SLIDE 9

Android Framework

Static Analysis of a Permission-Based Security System

e1 e2 e3 e4 f 1 f 2 f 3 f 4 f 5 f 6 f 8 f 9 ck1 ck2 p3 p2 p1 ( e1 e2 e3 e4 1 1 1 ) Application Framework

Alexandre Bartel Static Analysis of Permission-Based Systems 2 / 22

slide-10
SLIDE 10

Android Framework

Static Analysis of a Permission-Based Security System

( e1 e2 e3 e4 1 1 1 )     p1 p2 p3 e1 1 e2 1 e3 e4 1     Application Framework

Alexandre Bartel Static Analysis of Permission-Based Systems 2 / 22

slide-11
SLIDE 11

Android Framework

Methodology to Compute Permission Set (Step 1/3)

Step 1: Extract Framework Permission Matrix

M =     p1 p2 p3 e1 1 e2 1 e3 e4 1     This step is only done once (for a given framework).

Alexandre Bartel Static Analysis of Permission-Based Systems 3 / 22

slide-12
SLIDE 12

Android Framework

Methodology to Compute Permission Set (Step 2/3)

Step 2: Extract Application Access Vector

AVapp = ( e1 e2 e3 e4 1 1 1 ) This step is done for every application.

Alexandre Bartel Static Analysis of Permission-Based Systems 4 / 22

slide-13
SLIDE 13

Android Framework

Methodology to Compute Permission Set (Step 3/3)

Step 3: Infer Permission Set of the Application

IPapp = ( 1 1 1 ) ·     1 1 1     IPapp = ( 1 ) This step is done for every application.

Alexandre Bartel Static Analysis of Permission-Based Systems 5 / 22

slide-14
SLIDE 14

Android Framework

Android Framework Call Graph Construction

e1 e2 e3 e4 f 1 f 2 f 3 f 4 f 5 f 6 f 8 f 9 ck1 ck2 p3 p2 p1 Framework

Alexandre Bartel Static Analysis of Permission-Based Systems 6 / 22

slide-15
SLIDE 15

Android Framework

Android Framework Call Graph Construction

e1 e2 e3 e4 f 1 f 2 f 3 f 4 f 5 f 6 f 8 f 9 ck1 ck2 p3 p2 p1 Framework

Alexandre Bartel Static Analysis of Permission-Based Systems 6 / 22

slide-16
SLIDE 16

Android Framework

Android Framework Call Graph Construction

e1 e2 e3 e4 f 1 f 2 f 3 f 4 f 5 f 6 f 8 f 9 ck1 ck2 p3 p2 p1 Framework

Alexandre Bartel Static Analysis of Permission-Based Systems 6 / 22

slide-17
SLIDE 17

Android Framework

Android Framework Call Graph Construction

e1 e2 e3 e4 f 1 f 2 f 3 f 4 f 5 f 6 f 8 f 9 ck1 ck2 p3 p2 p1 Framework

Alexandre Bartel Static Analysis of Permission-Based Systems 6 / 22

slide-18
SLIDE 18

Android Framework

Android Framework Call Graph Construction

e1 e2 e3 e4 f 1 f 2 f 3 f 4 f 5 f 6 f 8 f 9 ck1 ck2 p3 p2 p1 Framework

Alexandre Bartel Static Analysis of Permission-Based Systems 6 / 22

slide-19
SLIDE 19

Android Framework

Call Graph Construction Techniques for Java

▶ Not precise: CHA (based on class hierarchy)

▶ CHA essential (1/4) ▶ CHA intelligent (2/4)

▶ Field sensitive: Spark

▶ Spark naive (3/4) ▶ Spark intelligent (4/4) Alexandre Bartel Static Analysis of Permission-Based Systems 7 / 22

slide-20
SLIDE 20

Android Framework

CHA Essential (1/4)

Alexandre Bartel Static Analysis of Permission-Based Systems 8 / 22

slide-21
SLIDE 21

Android Framework

CHA Essential (1/4)

▶ Uses CHA algorithm for call graph

Alexandre Bartel Static Analysis of Permission-Based Systems 8 / 22

slide-22
SLIDE 22

Android Framework

CHA Essential (1/4)

▶ Uses CHA algorithm for call graph ▶ Locates check methods in the call graph

Alexandre Bartel Static Analysis of Permission-Based Systems 8 / 22

slide-23
SLIDE 23

Android Framework

CHA Essential (1/4)

▶ Uses CHA algorithm for call graph ▶ Locates check methods in the call graph ▶ Extracts names of checked permissions

Alexandre Bartel Static Analysis of Permission-Based Systems 8 / 22

slide-24
SLIDE 24

Android Framework

CHA Essential (1/4)

▶ Uses CHA algorithm for call graph ▶ Locates check methods in the call graph ▶ Extracts names of checked permissions

Permission Set # entry points with 0 permissions 31,791 (64%) with 1 permissions 1 (< 0.01%) with 105 permissions 18,237 (36%) 50,029 (100%)

Alexandre Bartel Static Analysis of Permission-Based Systems 8 / 22

slide-25
SLIDE 25

Android Framework

CHA Essential (1/4)

▶ Uses CHA algorithm for call graph ▶ Locates check methods in the call graph ▶ Extracts names of checked permissions

Permission Set # entry points with 0 permissions 31,791 (64%) with 1 permissions 1 (< 0.01%) with 105 permissions 18,237 (36%) 50,029 (100%)

▶ Why explosion of permission set size?

Alexandre Bartel Static Analysis of Permission-Based Systems 8 / 22

slide-26
SLIDE 26

Android Framework

CHA Essential (1/4)

▶ Uses CHA algorithm for call graph ▶ Locates check methods in the call graph ▶ Extracts names of checked permissions

Permission Set # entry points with 0 permissions 31,791 (64%) with 1 permissions 1 (< 0.01%) with 105 permissions 18,237 (36%) 50,029 (100%)

▶ Why explosion of permission set size?

▶ Call graph goes through binder code Alexandre Bartel Static Analysis of Permission-Based Systems 8 / 22

slide-27
SLIDE 27

Android Framework

CHA Essential (1/4): The Real World System with Multiple Software Layers

(source: Gargenta, 2012) Alexandre Bartel Static Analysis of Permission-Based Systems 9 / 22

slide-28
SLIDE 28

Android Framework

CHA Essential (1/4): The Reason of the Explosion

API methods Binder transact method Services

  • nTransact

methods Services target methods ApiS1.1 S1 Sg Sh Si . . . S1m1 p0 S1m2 p0 S1m3 p1 S1m4 − S1m5 p2 S1m6 p0 S2m1 p3 . . . S3m1 p6 . . . . . .

Alexandre Bartel Static Analysis of Permission-Based Systems 10 / 22

slide-29
SLIDE 29

Android Framework

CHA Intelligent (2/4)

Alexandre Bartel Static Analysis of Permission-Based Systems 11 / 22

slide-30
SLIDE 30

Android Framework

CHA Intelligent (2/4)

▶ Uses CHA algorithm for call graph

Alexandre Bartel Static Analysis of Permission-Based Systems 11 / 22

slide-31
SLIDE 31

Android Framework

CHA Intelligent (2/4)

▶ Uses CHA algorithm for call graph ▶ Finds check methods in the call graph

Alexandre Bartel Static Analysis of Permission-Based Systems 11 / 22

slide-32
SLIDE 32

Android Framework

CHA Intelligent (2/4)

▶ Uses CHA algorithm for call graph ▶ Finds check methods in the call graph ▶ Extracts names of checked permissions

Alexandre Bartel Static Analysis of Permission-Based Systems 11 / 22

slide-33
SLIDE 33

Android Framework

CHA Intelligent (2/4)

▶ Uses CHA algorithm for call graph ▶ Finds check methods in the call graph ▶ Extracts names of checked permissions ▶ Handles system service communication through the ”Binder”

Alexandre Bartel Static Analysis of Permission-Based Systems 11 / 22

slide-34
SLIDE 34

Android Framework

CHA Intelligent (2/4): Handling Binder

Application Code

Service Call

Binder (Linux module)

getPassword() { checkPermission(); return password; }

Account System Service

r = getSystemService() p = r.getPassword()

Alexandre Bartel Static Analysis of Permission-Based Systems 12 / 22

slide-35
SLIDE 35

Android Framework

CHA Intelligent (2/4): Handling Binder

Application Code

Service Call

Binder (Linux module)

getPassword() { checkPermission(); return password; }

Account System Service

1 r = getSystemService() p = r.getPassword()

Alexandre Bartel Static Analysis of Permission-Based Systems 12 / 22

slide-36
SLIDE 36

Android Framework

CHA Intelligent (2/4): Handling Binder

Application Code

Service Call

Binder (Linux module)

getPassword() { checkPermission(); return password; }

Account System Service

1 r = getSystemService() p = r.getPassword() 2

Alexandre Bartel Static Analysis of Permission-Based Systems 12 / 22

slide-37
SLIDE 37

Android Framework

CHA Intelligent (2/4): Handling Binder

Application Code

Service Call

Binder (Linux module)

getPassword() { checkPermission(); return password; }

Account System Service

r = getSystemService() p = r.getPassword()

Alexandre Bartel Static Analysis of Permission-Based Systems 12 / 22

slide-38
SLIDE 38

Android Framework

CHA Intelligent (2/4): Handling Binder

Application Code

Service Call

Binder (Linux module)

getPassword() { checkPermission(); return password; }

Account System Service

r = getSystemService() p = r.getPassword() r = getSystemService()

Alexandre Bartel Static Analysis of Permission-Based Systems 12 / 22

slide-39
SLIDE 39

Android Framework

CHA Intelligent (2/4): Handling Binder

Application Code

Service Call

Binder (Linux module)

getPassword() { checkPermission(); return password; }

Account System Service

r = getSystemService() p = r.getPassword() r = getSystemService() reference to service getPassword() { checkPermission(); return password; }

Account System Service

Alexandre Bartel Static Analysis of Permission-Based Systems 12 / 22

slide-40
SLIDE 40

Android Framework

CHA Intelligent (2/4): Handling Binder

Application Code

Service Call

Binder (Linux module)

getPassword() { checkPermission(); return password; }

Account System Service

r = getSystemService() p = r.getPassword() r = getSystemService() reference to service getPassword() { checkPermission(); return password; }

Account System Service

p = r.getPassword()

Alexandre Bartel Static Analysis of Permission-Based Systems 12 / 22

slide-41
SLIDE 41

Android Framework

CHA Intelligent (2/4): Handling Binder

Application Code

Service Call

Binder (Linux module)

getPassword() { checkPermission(); return password; }

Account System Service

r = getSystemService() p = r.getPassword() r = getSystemService() reference to service getPassword() { checkPermission(); return password; }

Account System Service

p = r.getPassword()

Alexandre Bartel Static Analysis of Permission-Based Systems 12 / 22

slide-42
SLIDE 42

Android Framework

CHA Intelligent Results (2/4)

Permission Set # entry points (CHA Intelligent) # entry points (CHA Essential) with 0 permissions 32,924 (65.8%) 32,924 (64%) with 1 permissions 39 (0.08%) 1 (< 0.01%) with 2 permissions 55 (0.12%) 0 (0%) with > 65 permissions 17,011 (34.0%) 18,237 (36%) 50,029 (100%) 50,029 (100%)

Alexandre Bartel Static Analysis of Permission-Based Systems 13 / 22

slide-43
SLIDE 43

Android Framework

Spark Naive (3/4)

▶ Off-the-shelf

Alexandre Bartel Static Analysis of Permission-Based Systems 14 / 22

slide-44
SLIDE 44

Android Framework

Spark Naive (3/4)

▶ Off-the-shelf ▶ Only about 1800 methods are analyzed: why?

Alexandre Bartel Static Analysis of Permission-Based Systems 14 / 22

slide-45
SLIDE 45

Android Framework

Spark Naive (3/4)

▶ Off-the-shelf ▶ Only about 1800 methods are analyzed: why?

▶ Static methods Alexandre Bartel Static Analysis of Permission-Based Systems 14 / 22

slide-46
SLIDE 46

Android Framework

Spark Naive (3/4)

▶ Off-the-shelf ▶ Only about 1800 methods are analyzed: why?

▶ Static methods

▶ This approach completely fails

Alexandre Bartel Static Analysis of Permission-Based Systems 14 / 22

slide-47
SLIDE 47

Android Framework

Spark Naive (3/4)

▶ Off-the-shelf ▶ Only about 1800 methods are analyzed: why?

▶ Static methods

▶ This approach completely fails

→ generate entry point “wrappers” to initialize objects

Alexandre Bartel Static Analysis of Permission-Based Systems 14 / 22

slide-48
SLIDE 48

Android Framework

Spark Intelligent (4/4)

Alexandre Bartel Static Analysis of Permission-Based Systems 15 / 22

slide-49
SLIDE 49

Android Framework

Spark Intelligent (4/4)

▶ Generates entry point wrappers

Alexandre Bartel Static Analysis of Permission-Based Systems 15 / 22

slide-50
SLIDE 50

Android Framework

Spark Intelligent (4/4)

▶ Generates entry point wrappers ▶ Handles system services initialization and managers

initialization

Alexandre Bartel Static Analysis of Permission-Based Systems 15 / 22

slide-51
SLIDE 51

Android Framework

Spark Intelligent (4/4)

API methods Binder transact method Services

  • nTransact

methods Services target methods ApiS1.1 S1 Sg Sh Si . . . S1m1 p0 S1m2 p0 S1m3 p1 S1m4 − S1m5 p2 S1m6 p0 S2m1 p3 . . . S3m1 p6 . . . . . .

Alexandre Bartel Static Analysis of Permission-Based Systems 16 / 22

slide-52
SLIDE 52

Android Framework

Spark Intelligent (4/4)

API methods Binder transact method Services

  • nTransact

methods Services target methods ApiS1.1 S1 Sg Sh Si . . . S1m1 p0 S1m2 p0 S1m3 p1 S1m4 − S1m5 p2 S1m6 p0 S2m1 p3 . . . S3m1 p6 . . . . . .

Alexandre Bartel Static Analysis of Permission-Based Systems 16 / 22

slide-53
SLIDE 53

Android Framework

Spark Intelligent (4/4)

API methods Binder transact method Services

  • nTransact

methods Services target methods ApiS1.1 S1 Sg Sh Si . . . S1m1 p0 S1m2 p0 S1m3 p1 S1m4 − S1m5 p2 S1m6 p0 S2m1 p3 . . . S3m1 p6 . . . . . .

Alexandre Bartel Static Analysis of Permission-Based Systems 16 / 22

slide-54
SLIDE 54

Android Framework

Spark Intelligent (4/4)

API methods Binder transact method Services

  • nTransact

methods Services target methods ApiS1.1 S1 Sg Sh Si . . . S1m1 p0 S1m2 p0 S1m3 p1 S1m4 − S1m5 p2 S1m6 p0 S2m1 p3 . . . S3m1 p6 . . . . . . i n j e c t s e r v i c e

Alexandre Bartel Static Analysis of Permission-Based Systems 16 / 22

slide-55
SLIDE 55

Android Framework

Spark Intelligent (4/4)

API methods Binder transact method Services

  • nTransact

methods Services target methods ApiS1.1 S1 Sg Sh Si . . . S1m1 p0 S1m2 p0 S1m3 p1 S1m4 − S1m5 p2 S1m6 p0 S2m1 p3 . . . S3m1 p6 . . . . . . i n j e c t s e r v i c e

Alexandre Bartel Static Analysis of Permission-Based Systems 16 / 22

slide-56
SLIDE 56

Android Framework

Spark Intelligent Results (4/4)

Permission Set # entry points (Spark Intelli- gent) # entry points (CHA Intelligent) # entry points (CHA Essential) with 0 permissions 42,895 (98.77%) 32,924 (65.8%) 32,924 (64%) with 1 permissions 471 (1.08%) 39 (0.08%) 1 (< 0.01%) with 2 permissions 48 (0.11%) 55 (0.12%) 0 (0%) with 3 permissions 10 (0.01%) 0 (0%) 0 (0%) with > 3 permissions 3 (0.02%) 17,011 (34.0%) 18,237 (36%) 43,427 (100%) 50,029 (100%) 50,029 (100%)

Alexandre Bartel Static Analysis of Permission-Based Systems 17 / 22

slide-57
SLIDE 57

Android Framework

Spark Intelligent Results (4/4)

Permission Set # entry points (Spark Intelli- gent) # entry points (CHA Intelligent) # entry points (CHA Essential) with 0 permissions 42,895 (98.77%) 32,924 (65.8%) 32,924 (64%) with 1 permissions 471 (1.08%) 39 (0.08%) 1 (< 0.01%) with 2 permissions 48 (0.11%) 55 (0.12%) 0 (0%) with 3 permissions 10 (0.01%) 0 (0%) 0 (0%) with > 3 permissions 3 (0.02%) 17,011 (34.0%) 18,237 (36%) 43,427 (100%) 50,029 (100%) 50,029 (100%) classes are removed to speed up the experiment

Alexandre Bartel Static Analysis of Permission-Based Systems 17 / 22

slide-58
SLIDE 58

Android Framework

Evaluation (1/3): Android 4

Comparison Spark Intelligent vs. PScout [1]

[1] K. W. Y. Au, Y. F. Zhou, Z. Huang, and D. Lie. Pscout: analyzing the android permission specification. In Proceedings of the 2012 ACM conference on Computer and communications security, 2012. Alexandre Bartel Static Analysis of Permission-Based Systems 18 / 22

slide-59
SLIDE 59

Android Framework

Evaluation (1/3): Android 4

Comparison Spark Intelligent vs. PScout [1]

Permission set Number of Methods #API Methods in Spark and PScout 468 (100%) Identical 289 (61.75%) we find less permission checks 176 (37.60%) we find more permission checks 3 (0.64%)

[1] K. W. Y. Au, Y. F. Zhou, Z. Huang, and D. Lie. Pscout: analyzing the android permission specification. In Proceedings of the 2012 ACM conference on Computer and communications security, 2012. Alexandre Bartel Static Analysis of Permission-Based Systems 18 / 22

slide-60
SLIDE 60

Android Framework

Evaluation (1/3): Android 4

Comparison Spark Intelligent vs. PScout [1]

Permission set Number of Methods #API Methods in Spark and PScout 468 (100%) Identical 289 (61.75%) we find less permission checks 176 (37.60%) we find more permission checks 3 (0.64%)

▶ We are more precise (ex: 1 permission against 5 for entry

point exitKeyguardSecurely(...))

[1] K. W. Y. Au, Y. F. Zhou, Z. Huang, and D. Lie. Pscout: analyzing the android permission specification. In Proceedings of the 2012 ACM conference on Computer and communications security, 2012. Alexandre Bartel Static Analysis of Permission-Based Systems 18 / 22

slide-61
SLIDE 61

Android Framework

Evaluation (1/3): Android 4

Comparison Spark Intelligent vs. PScout [1]

Permission set Number of Methods #API Methods in Spark and PScout 468 (100%) Identical 289 (61.75%) we find less permission checks 176 (37.60%) we find more permission checks 3 (0.64%)

▶ We are more precise (ex: 1 permission against 5 for entry

point exitKeyguardSecurely(...))

▶ We are less precise: we not analyze some modules (ex:

non-Java code)

[1] K. W. Y. Au, Y. F. Zhou, Z. Huang, and D. Lie. Pscout: analyzing the android permission specification. In Proceedings of the 2012 ACM conference on Computer and communications security, 2012. Alexandre Bartel Static Analysis of Permission-Based Systems 18 / 22

slide-62
SLIDE 62

Android Framework

Evaluation (2/3): Android 2.2

[1] A. Felt, E. Chin, S. Hanna, D. Song, and D. Wagner. Android permissions demystified. In ACM CCS, 2011. Alexandre Bartel Static Analysis of Permission-Based Systems 19 / 22

slide-63
SLIDE 63

Android Framework

Evaluation (2/3): Android 2.2

Comparison Spark Intelligent vs. Stowaway [1]

→ Stowaway = Testing Approach

[1] A. Felt, E. Chin, S. Hanna, D. Song, and D. Wagner. Android permissions demystified. In ACM CCS, 2011. Alexandre Bartel Static Analysis of Permission-Based Systems 19 / 22

slide-64
SLIDE 64

Android Framework

Evaluation (2/3): Android 2.2

Comparison Spark Intelligent vs. Stowaway [1]

→ Stowaway = Testing Approach

Results

▶ 552 / 673 entry points are “correct”

[1] A. Felt, E. Chin, S. Hanna, D. Song, and D. Wagner. Android permissions demystified. In ACM CCS, 2011. Alexandre Bartel Static Analysis of Permission-Based Systems 19 / 22

slide-65
SLIDE 65

Android Framework

Evaluation (2/3): Android 2.2

Comparison Spark Intelligent vs. Stowaway [1]

→ Stowaway = Testing Approach

Results

▶ 552 / 673 entry points are “correct” ▶ 119 / 673 have more permissions

[1] A. Felt, E. Chin, S. Hanna, D. Song, and D. Wagner. Android permissions demystified. In ACM CCS, 2011. Alexandre Bartel Static Analysis of Permission-Based Systems 19 / 22

slide-66
SLIDE 66

Android Framework

Evaluation (2/3): Android 2.2

Comparison Spark Intelligent vs. Stowaway [1]

→ Stowaway = Testing Approach

Results

▶ 552 / 673 entry points are “correct” ▶ 119 / 673 have more permissions ▶ At least 3 entry points in Stowaway were missing permissions

[1] A. Felt, E. Chin, S. Hanna, D. Song, and D. Wagner. Android permissions demystified. In ACM CCS, 2011. Alexandre Bartel Static Analysis of Permission-Based Systems 19 / 22

slide-67
SLIDE 67

Android Framework

Evaluation (2/3): Android 2.2

Comparison Spark Intelligent vs. Stowaway [1]

→ Stowaway = Testing Approach

Results

▶ 552 / 673 entry points are “correct” ▶ 119 / 673 have more permissions ▶ At least 3 entry points in Stowaway were missing permissions

Testing (1) yields an under-approximation.

[1] A. Felt, E. Chin, S. Hanna, D. Song, and D. Wagner. Android permissions demystified. In ACM CCS, 2011. Alexandre Bartel Static Analysis of Permission-Based Systems 19 / 22

slide-68
SLIDE 68

Android Framework

Evaluation (2/3): Android 2.2

Comparison Spark Intelligent vs. Stowaway [1]

→ Stowaway = Testing Approach

Results

▶ 552 / 673 entry points are “correct” ▶ 119 / 673 have more permissions ▶ At least 3 entry points in Stowaway were missing permissions

Testing (1) yields an under-approximation. Static (2) Analysis yields an over-approximation.

[1] A. Felt, E. Chin, S. Hanna, D. Song, and D. Wagner. Android permissions demystified. In ACM CCS, 2011. Alexandre Bartel Static Analysis of Permission-Based Systems 19 / 22

slide-69
SLIDE 69

Android Framework

Evaluation (2/3): Android 2.2

Comparison Spark Intelligent vs. Stowaway [1]

→ Stowaway = Testing Approach

Results

▶ 552 / 673 entry points are “correct” ▶ 119 / 673 have more permissions ▶ At least 3 entry points in Stowaway were missing permissions

Testing (1) yields an under-approximation. Static (2) Analysis yields an over-approximation. Combining the (1) and (2) to have “correct” results?

[1] A. Felt, E. Chin, S. Hanna, D. Song, and D. Wagner. Android permissions demystified. In ACM CCS, 2011. Alexandre Bartel Static Analysis of Permission-Based Systems 19 / 22

slide-70
SLIDE 70

Android Framework

Evaluation (3/3): Permission Gaps in Real World Applications

Alexandre Bartel Static Analysis of Permission-Based Systems 20 / 22

slide-71
SLIDE 71

Android Framework

Evaluation (3/3): Permission Gaps in Real World Applications

▶ 742 Freewarelovers applications:

Alexandre Bartel Static Analysis of Permission-Based Systems 20 / 22

slide-72
SLIDE 72

Android Framework

Evaluation (3/3): Permission Gaps in Real World Applications

▶ 742 Freewarelovers applications: 96 (13%) have a permission gap

Alexandre Bartel Static Analysis of Permission-Based Systems 20 / 22

slide-73
SLIDE 73

Android Framework

Evaluation (3/3): Permission Gaps in Real World Applications

▶ 742 Freewarelovers applications: 96 (13%) have a permission gap ▶ 679 Android Market applications:

Alexandre Bartel Static Analysis of Permission-Based Systems 20 / 22

slide-74
SLIDE 74

Android Framework

Evaluation (3/3): Permission Gaps in Real World Applications

▶ 742 Freewarelovers applications: 96 (13%) have a permission gap ▶ 679 Android Market applications: 35 (5%) have a permission gap

Alexandre Bartel Static Analysis of Permission-Based Systems 20 / 22

slide-75
SLIDE 75

Android Framework

Evaluation (3/3): Permission Gaps in Real World Applications

▶ 742 Freewarelovers applications: 96 (13%) have a permission gap ▶ 679 Android Market applications: 35 (5%) have a permission gap

1 permission 2 permissions 3+ permissions 20 40 60 80 100 76 19 5 68 18 14 #percentage Freewarelovers Google Play

Alexandre Bartel Static Analysis of Permission-Based Systems 20 / 22

slide-76
SLIDE 76

Android Framework

Contributions Summary

▶ Empirically demonstrated that off-the-shelf static analysis can

not address the extraction of permissions in Android

▶ Static analysis of Android requires inner knowledge of the

stack

▶ Static analysis components must be put together:

  • 1. Entry point initialization
  • 2. String analysis
  • 3. Service initialization
  • 4. Service redirection

Alexandre Bartel Static Analysis of Permission-Based Systems 21 / 22

slide-77
SLIDE 77

Android Framework

Contributions Summary

  • Alexandre Bartel, Jacques Klein, Martin Monperrus, and Yves Le Traon.

Automatically Securing Permission-Based Software by Reducing the Attack Surface: An Application to Android. In Proceedings of the 27th IEEE/ACM International Conference On Automated Software Engineering (ASE), 2012. Short paper. [cication count: 26]

  • Alexandre Bartel, Jacques Klein, Martin Monperrus, and Yves Le Traon.

Static Analysis for Extracting Permission Checks of a Large Scale Framework: The Challenges And Solutions for Analyzing Android. In IEEE Transactions on Software Engineering (TSE), 2014.

Alexandre Bartel Static Analysis of Permission-Based Systems 22 / 22