Mobile Security

Question 1

Android Security Goals

Answer 1

1. Isolate individual applications
2. Protect system resources from applications
3. Vet applications “online”
4. Protect data of the user

Question 2

Android security architecture

Answer 2

1. Apps are carefully vetted server-side and only approved apps can be installed from the “market”
2. Apps run in a Java-like sandbox, restricted to user-granted permissions
3. Apps leverage well-defined API channels to communicate with other apps
4. The system is hardened against local user (app-based) attacks

Question 3

Android system security

Answer 3

• Leverages the Linux kernel as a foundation
  -> Process isolation (application runs as its unique user, permissions on file system)
  -> User-based permission model
  -> Extensible mechanism for secure IPC
  -> Configurable (trim down kernel to limit exposure)
  -> Effective resource isolation when accessing hardware
  -> Safe defaults: Verified boot, file system encryption, TEE, ASLR/Fortify/Stack canaries, …

Question 4

Android App limitations

Answer 4

• Apps run in a private folder
• Can start other apps (main activity is always “exported”)
• Can show things on screen
• Everything else requires a permission

Question 5

Android attack vectors: intent

Answer 5

• Unauthorized intent receipt: Attacker creates an intent filter, receives other apps’ intents that contain privileged information
• Intent spoofing: Attacker sends a malicious intent to an intent processor

Question 6

Android attack vectors: communication

Answer 6

• Insecure Internet communication: Wireshark intercepts traffic
• Bluetooth, NFC, IR is not restricted: Peripherals are not protected against malicious apps, any app may access any paired device. This is an issue of the granularity of the privileges. There’s only one Bluetooth privilege, privileges are per app, not per connected device

Question 7

Android attack vectors: privileges

Answer 7

• Overprivileged app: confused deputy, bugs in application can be leveraged by attacker to gain privileges

Question 8

Android attack vectors: lack of (device) updates

Answer 8

• Core problem with Android: fragmentation and heterogeneity
• Devices are not updated:
  -> Vendors are interested in selling, not updating
  -> Vendors are interested in customizing and branding
• Solution: bundle some updates with play services