research-article

Public Access

CASE: Comprehensive Application Security Enforcement on COTS Mobile Devices

Authors:

Kapil SinghAuthors Info & Claims

MobiSys '16: Proceedings of the 14th Annual International Conference on Mobile Systems, Applications, and Services

Pages 375 - 386

https://doi.org/10.1145/2906388.2906413

Published: 20 June 2016 Publication History

All formats PDF

Abstract

Without violating existing app security enforcement, malicious modules inside apps, such as a library or an external class, can steal private data and abuse sensitive capabilities meant for other modules inside the same apps. These so-called "module-level attacks" are quickly emerging, fueled by the pervasive use of third-party code in apps and the lack of module-level security enforcement on mobile platforms.

To systematically thwart the threats, we build CASE, an automatic app patching tool used by app developers to enable module-level security in their apps built for COTS Android devices. During runtime, patched apps enforce developer-supplied security policies that regulate interactions among modules at the granularity of a Java class. Requiring no changes or special support from the Android OS, the enforcement is complete in covering inter-module crossings in apps and is robust against malicious Java and native app modules. We evaluate CASE with 420 popular apps and a set of Android's unit tests. The results show that CASE is fully compatible with the tested apps and incurs an average performance overhead of 4.9%.

References

[1]

Chinese taomike monetization library steals sms messages. http://researchcenter.paloaltonetworks.com/2015/10/chinese-taomike-monetization-library-steals-sms-messages/.

[2]

Michael Backes, Sven Bugiel, Sebastian Gerling, and Philipp von Styp-Rekowsky. Android security framework: Extensible multi-layered access control on Android. In ACSAC, 2014.

Digital Library

[3]

Alastair R. Beresford, Andrew Rice, Nicholas Skehin, and Ripduman Sohan. MockDroid: Trading privacy for application functionality on smartphones. In HotMobile, 2011.

Digital Library

[4]

Sven Bugiel, Lucas Davi, Alexandra Dmitrienko, Thomas Fischer, Ahmad-Reza Sadeghi, and Bhargava Shastry. Towards taming privilege-escalation attacks on Android. In NDSS, 2012.

[5]

Sven Bugiel, Stephan Heuser, and Ahmad-Reza Sadeghi. Flexible and fine-grained mandatory access control on Android for diverse security and privacy policies. In USENIX Security, 2013.

Digital Library

[6]

Mauro Conti, Vu Thien Nga Nguyen, and Bruno Crispo. CRePE: Context-related policy enforcement for Android. In ISC, 2011.

Digital Library

[7]

Benjamin Davis and Hao Chen. RetroSkeleton: Retrofitting Android apps. In MobiSys, 2013.

Digital Library

[8]

Benjamin Davis, Ben Sanders, Armen Khodaverdian, and Hao Chen. I-ARM-Droid: A rewriting framework for in-app reference monitors for Android applications. 2012.

[9]

William Enck, Peter Gilbert, Seungyeop Han, Vasant Tendulkar, Byung-Gon Chun, Landon P. Cox, Jaeyeon Jung, Patrick McDaniel, and Anmol N. Sheth. TaintDroid: An information-flow tracking system for realtime privacy monitoring on smartphones. ACM Trans. Comput. Syst., 2014.

Digital Library

[10]

Stephan Heuser, Adwait Nadkarni, William Enck, and Ahmad-Reza Sadeghi. ASM: A programmable interface for extending Android security. In USENIX Security, 2014.

Digital Library

[11]

Peter Hornyack, Seungyeop Han, Jaeyeon Jung, Stuart Schechter, and David Wetherall. These aren't the droids you're looking for: Retrofitting Android to protect data from imperious applications. In ACM CCS, 2011.

Digital Library

[12]

Trend Micro Inc. Library file in certain android apps connects to c&c servers. http://blog.trendmicro.com/trendlabs-security-intelligence/library-file-in-certain-android-apps-connects-to-cc-servers/, 2012.

[13]

Jinseong Jeon, Kristopher K. Micinski, Jeffrey A. Vaughan, Ari Fogel, Nikhilesh Reddy, Jeffrey S. Foster, and Todd Millstein. Dr. Android and Mr. Hide: Fine-grained permissions in Android applications. In ACM SPSM, 2012.

Digital Library

[14]

Mohammad Nauman, Sohail Khan, and Xinwen Zhang. Apex: Extending Android permission model and enforcement with user-defined runtime constraints. In ACM ASIACCS, 2010.

Digital Library

[15]

Machigar Ongtang, Stephen McLaughlin, William Enck, and Patrick McDaniel. Semantically rich application-centric security in android. In ACSAC, 2009.

Digital Library

[16]

Paul Pearce, Adrienne Porter Felt, Gabriel Nunez, and David Wagner. AdDroid: Privilege separation for applications and advertisers in Android. In ACM ASIACCS, 2012.

Digital Library

[17]

Giovanni Russello, Arturo Blas Jimenez, Habib Naderi, and Wannes van der Mark. FireDroid: Hardening security in almost-stock Android. In ACSAC, 2013.

Digital Library

[18]

Shashi Shekhar, Michael Dietz, and Dan S. Wallach. AdSplit: Separating smartphone advertising from applications. In USENIX Security, 2012.

Digital Library

[19]

Stephen Smalley and Robert Craig. Security Enhanced (SE) Android: Bringing flexible MAC to Android. In NDSS, 2013.

[20]

Mengtao Sun and Gang Tan. NativeGuard: Protecting Android applications from third-party native libraries. In ACM WiSec, 2014.

Digital Library

[21]

Symantec. Ad library behind pulled ios apps also used in android development. http://www.symantec.com/connect/blogs/ad-library-behind-pulled-ios-apps-also-used-android-development, 2015.

[22]

Xueqiang Wang, Kun Sun, Yuewu Wang, and Jiwu Jing. DeepDroid: Dynamically enforcing enterprise policy on Android devices. In NDSS, 2015.

[23]

Yifei Wang, Srinivas Hariharan, Chenxi Zhao, Jiaming Liu, and Wenliang Du. Compac: Enforce component-level access control in Android. In ACM CODASPY, 2014.

Digital Library

[24]

Chiachih Wu, Yajin Zhou, Kunal Patel, Zhenkai Liang, and Xuxian Jiang. AirBag: Boosting smartphone resistance to malware infection. In NDSS, 2014.

[25]

Rubin Xu, Hassen Saidi, and Ross Anderson. Aurasium: Practical policy enforcement for android applications. In USENIX Security, 2012.

Digital Library

[26]

Yajin Zhou, Kunal Patel, Lei Wu, Zhi Wang, and Xuxian Jiang. Hybrid user-level sandboxing of third-party Android apps. In ACM ASIACCS, 2015.

Digital Library

Cited By

Qiu JYang XWu HZhou YLi JMa J(2022)LibCapsule: Complete Confinement of Third-Party Libraries in Android ApplicationsIEEE Transactions on Dependable and Secure Computing10.1109/TDSC.2021.307581719:5(2873-2889)Online publication date: 1-Sep-2022
https://doi.org/10.1109/TDSC.2021.3075817
Narain SNoubir G(2019)Mitigating Location Privacy Attacks on Mobile Devices using Dynamic App SandboxingProceedings on Privacy Enhancing Technologies10.2478/popets-2019-00202019:2(66-87)Online publication date: 4-May-2019
https://doi.org/10.2478/popets-2019-0020
Yao ZMirzamohammadi SAmiri Sani APayer MLie DMannan MBackes MWang X(2018)MilkomedaProceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security10.1145/3243734.3243772(1455-1469)Online publication date: 15-Oct-2018
https://dl.acm.org/doi/10.1145/3243734.3243772
Show More Cited By

Index Terms

CASE: Comprehensive Application Security Enforcement on COTS Mobile Devices
1. Security and privacy
  1. Software and application security

Recommendations

A Case Study of Research through the App Store: Leveraging the System UI as a Playing Field for Improving the Design of Smartphone Launchers

With a growing number of mobile applications available on application stores and the improved capabilities of smartphones, people download more applications to their devices. Researchers began to leverage this momentum for distributing applications to ...
Detecting wearable app permission mismatches: a case study on Android wear
ESEC/FSE 2017: Proceedings of the 2017 11th Joint Meeting on Foundations of Software Engineering

Wearable devices are becoming increasingly popular. These wearable devices run what is known as wearable apps. Wearable apps are packaged with handheld apps, that must be installed on the accompanying handheld device (e.g., phone).

Given that ...
Android App Permission and Users’ Adoption: A Case Study of Mental Health Application
Human Aspects of Information Security, Privacy and Trust
Abstract
The prevalent use of mobile devices makes mobile applications (apps) a promising approach to enhance mental healthcare. However, at the same time, users’ information privacy and security becomes a serious concern due to the ubiquitous data ...

Comments

Information & Contributors

Information

Published In

cover image ACM Conferences

MobiSys '16: Proceedings of the 14th Annual International Conference on Mobile Systems, Applications, and Services

June 2016

440 pages

ISBN:9781450342698

DOI:10.1145/2906388

General Chairs:
Rajesh Balan
Singapore Management University
,
Archan Misra
Singapore Management University
,
Program Chairs:
Sharad Agarwal
Microsoft
,
Cecilia Mascolo
University of Cambridge

Copyright © 2016 ACM.

Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. Copyrights for components of this work owned by others than the author(s) must be honored. Abstracting with credit is permitted. To copy otherwise, or republish, to post on servers or to redistribute to lists, requires prior specific permission and/or a fee. Request permissions from [email protected].

Sponsors

SIGMOBILE: ACM Special Interest Group on Mobility of Systems, Users, Data and Computing

In-Cooperation

SIGOPS: ACM Special Interest Group on Operating Systems

Publisher

Association for Computing Machinery

New York, NY, United States

Publication History

Published: 20 June 2016

Permissions

Request permissions for this article.

Request Permissions

Check for updates

Author Tags

Qualifiers

Research-article

Funding Sources

Conference

MobiSys'16

Sponsor:

SIGMOBILE

MobiSys'16: The 14th Annual International Conference on Mobile Systems, Applications, and Services

June 26 - 30, 2016

Singapore, Singapore

Acceptance Rates

MobiSys '16 Paper Acceptance Rate 31 of 197 submissions, 16%;

Overall Acceptance Rate 274 of 1,679 submissions, 16%

Contributors

Other Metrics

View Article Metrics

Bibliometrics & Citations

Bibliometrics

Article Metrics

8
Total Citations
View Citations
400
Total Downloads

Downloads (Last 12 months)61
Downloads (Last 6 weeks)18

Reflects downloads up to 10 Feb 2025

Other Metrics

View Author Metrics

Citations

Cited By

Qiu JYang XWu HZhou YLi JMa J(2022)LibCapsule: Complete Confinement of Third-Party Libraries in Android ApplicationsIEEE Transactions on Dependable and Secure Computing10.1109/TDSC.2021.307581719:5(2873-2889)Online publication date: 1-Sep-2022
https://doi.org/10.1109/TDSC.2021.3075817
Narain SNoubir G(2019)Mitigating Location Privacy Attacks on Mobile Devices using Dynamic App SandboxingProceedings on Privacy Enhancing Technologies10.2478/popets-2019-00202019:2(66-87)Online publication date: 4-May-2019
https://doi.org/10.2478/popets-2019-0020
Yao ZMirzamohammadi SAmiri Sani APayer MLie DMannan MBackes MWang X(2018)MilkomedaProceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security10.1145/3243734.3243772(1455-1469)Online publication date: 15-Oct-2018
https://dl.acm.org/doi/10.1145/3243734.3243772
Zhu XLi JZhou YMa J(2018)AdCapsule: Practical Confinement of Advertisements in Android ApplicationsIEEE Transactions on Dependable and Secure Computing10.1109/TDSC.2018.2814999(1-1)Online publication date: 2018
https://doi.org/10.1109/TDSC.2018.2814999
Zhang YDai JZhang XHuang SYang ZYang MChen H(2018)Detecting third-party libraries in Android applications with high precision and recall2018 IEEE 25th International Conference on Software Analysis, Evolution and Reengineering (SANER)10.1109/SANER.2018.8330204(141-152)Online publication date: Mar-2018
https://doi.org/10.1109/SANER.2018.8330204
Liu YDu DXia YChen HZang BLiang Z(2018)SplitPass: A Mutually Distrusting Two-Party Password ManagerJournal of Computer Science and Technology10.1007/s11390-018-1810-y33:1(98-115)Online publication date: 26-Jan-2018
https://doi.org/10.1007/s11390-018-1810-y
Krupp BJesenseky DSzampias A(2017)SPEProxy: Enforcing fine grained security and privacy controls on unmodified mobile devices2017 IEEE 8th Annual Ubiquitous Computing, Electronics and Mobile Communication Conference (UEMCON)10.1109/UEMCON.2017.8248985(520-526)Online publication date: Oct-2017
https://doi.org/10.1109/UEMCON.2017.8248985
Tuncay GDemetriou SGunter CWeippl EKatzenbeisser SKruegel CMyers AHalevi S(2016)DracoProceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security10.1145/2976749.2978322(104-115)Online publication date: 24-Oct-2016
https://dl.acm.org/doi/10.1145/2976749.2978322

View Options

View options

PDF

View or Download as a PDF file.

eReader

View online with eReader.

EPUB

View this article in ePub.

Login options

Check if you have access through your login credentials or your institution to get full access on this article.

Full Access

Get this Publication

Figures

Tables

Media

View Table of Conten