×

Once root always a threat: analyzing the security threats of Android permission system. (English) Zbl 1337.94090

Susilo, Willy (ed.) et al., Information security and privacy. 19th Australasian conference, ACISP 2014, Wollongong, NSW, Australia, July 7–9, 2014. Proceedings. Berlin: Springer (ISBN 978-3-319-08343-8/pbk). Lecture Notes in Computer Science 8544, 354-369 (2014).
Summary: Android permission system enforces access control to those privacy-related resources in Android phones. Unfortunately, the permission system could be bypassed when the phone is rooted. On a rooted phone, processes can run with root privilege and can arbitrarily access any resources without permission. Many people are willing to root their Android phones to uninstall pre-installed applications, flash third party ROMs, backup their phones and so on. People use rootkit tools to root their phones. The mainstream rootkit tools in China are provided by some well-known security vendors. Besides root, these vendors also provide the one-click-unroot function to unroot a phone. The unroot process gives users a feeling that their phones will roll back to the original safe state. In this paper, we present the security threats analysis of permission system on phones rooted once and unrooted later. On these phones, two categories of attacks: tampering data files attack and tampering code files attack are carried out. Also, the attacks’ detection rate, damage degree, influence range, and survivability in the real word are analyzed. Analysis result shows even under Antivirus’ monitoring, these attacks towards permission system can still be carried out and survive after the phone is unrooted. Therefore, the permission system faces a long-term compromise. The potential defense solutions are also discussed.
For the entire collection see [Zbl 1291.94003].

MSC:

94A60 Cryptography
68P25 Data encryption (aspects in computer science)
PDFBibTeX XMLCite
Full Text: DOI