Conference Proceeding Article
Android allows applications to communicate with system service via system service helper so that applications can use various functions wrapped in the system services. Meanwhile, system services leverage the service helpers to enforce security mechanisms, e.g. input parameter validation, to protect themselves against attacks. However, service helpers can be easily bypassed, which poses severe security and privacy threats to system services, e.g., privilege escalation, function execution without users’ interactions, system service crash, and DoS attacks. In this paper, we perform the first systematic study on such vulnerabilities and investigate their impacts. We develop a tool to analyze all system services in the newly released Android system. Among the 104 system services and over 3,400 system service methods in the system, we discover 22 vulnerable service interfaces that can be exploited to launch real-world attacks. Furthermore, we implement and construct attacks to demonstrate the impacts of these vulnerabilities. In particular, by utilizing these vulnerabilities, these attacks result in implicit user fingerprint authentication in background, NFC data retrieval in background, Bluetooth service crash, and Android system crash.
Android, Service helpers, System services, Vulnerabilities
Databases and Information Systems | Software Engineering | Systems Architecture
Intelligent Systems and Decision Analytics
Security and privacy in communication networks: SecureComm 2016: Guangzhou, China, October 10-12
City or Country
GU, Yachong; CHENG, Yao; YING, Lingyun; LU, Yemian; LI, Qi; and SU, Purui.
Exploiting android system services through bypassing service helpers. (2017). Security and privacy in communication networks: SecureComm 2016: Guangzhou, China, October 10-12. 198, 44-62. Research Collection School Of Information Systems.
Available at: http://ink.library.smu.edu.sg/sis_research/3809
Creative Commons License
This work is licensed under a Creative Commons Attribution-Noncommercial-No Derivative Works 4.0 License.