Publication Type

Journal Article

Version

publishedVersion

Publication Date

6-2014

Abstract

Android security has been a hot spot recently in both academic research and public concerns due to numerous instances of security attacks and privacy leakage on Android platform. Android security has been built upon a permission based mechanism which restricts accesses of third-party Android applications to critical resources on an Android device. Such permission based mechanism is widely criticized for its coarse-grained control of application permissions and difficult management of permissions by developers, marketers, and end-users. In this paper, we investigate the arising issues in Android security, including coarse granularity of permissions, incompetent permission administration, insufficient permission documentation, over-claim of permissions, permission escalation attack, and TOCTOU (Time of Check to Time of Use) attack. We illustrate the relationships among these issues, and investigate the existing countermeasures to address these issues. In particular, we provide a systematic review on the development of these countermeasures, and compare them according to their technical features. Finally, we propose several methods to further mitigate the risk in Android security.

Keywords

Android security, Permission based security, Access control, Granularity of access control, Policy administration, Over-claim of permission, Permission escalation attack

Discipline

Computer Sciences | Information Security

Research Areas

Cybersecurity

Publication

Computers and Security

Volume

43

First Page

205

Last Page

218

ISSN

0167-4048

Identifier

10.1016/j.cose.2014.02.007

Publisher

Elsevier

Additional URL

http://doi.org/10.1016/j.cose.2014.02.007

Download

Share

COinS