Publication Type

Conference Proceeding Article

Version

publishedVersion

Publication Date

6-2017

Abstract

Android allows applications to communicate with system service via system service helper so that applications can use various functions wrapped in the system services. Meanwhile, system services leverage the service helpers to enforce security mechanisms, e.g. input parameter validation, to protect themselves against attacks. However, service helpers can be easily bypassed, which poses severe security and privacy threats to system services, e.g., privilege escalation, function execution without users’ interactions, system service crash, and DoS attacks. In this paper, we perform the first systematic study on such vulnerabilities and investigate their impacts. We develop a tool to analyze all system services in the newly released Android system. Among the 104 system services and over 3,400 system service methods in the system, we discover 22 vulnerable service interfaces that can be exploited to launch real-world attacks. Furthermore, we implement and construct attacks to demonstrate the impacts of these vulnerabilities. In particular, by utilizing these vulnerabilities, these attacks result in implicit user fingerprint authentication in background, NFC data retrieval in background, Bluetooth service crash, and Android system crash.

Keywords

Android, Service helpers, System services, Vulnerabilities

Discipline

Databases and Information Systems | Software Engineering | Systems Architecture

Publication

Security and privacy in communication networks: SecureComm 2016: Guangzhou, China, October 10-12

Volume

198

First Page

44

Last Page

62

ISBN

9783319596075

Identifier

10.1007/978-3-319-59608-2_3

Publisher

Springer Verlag

City or Country

Cham

Additional URL

https://doi.org./10.1007/978-3-319-59608-2_3

Download

Share

COinS