Covert Association of Applications on Edge Devices by Processor Workload

1 Covert Association of Applications on Edge Devices by Processor Workload HangtaiLi YingboLiu RuiTan School of Computer Science and Engineering, Nanyang Technological University, Singapore {N1801735A, liuyb, tanrui}@ntu.edu.sg Abstract—The scheme of application (app) distribution systems involving incentivized third-party app vendors is a desirable option for the emerging edge computing systems. However, such a scheme also brings various security challenges as faced by the current mobile app distribution systems. In this paper, we study a threat named covert device association, in which the vendors of two apps collude to figure out which of their app installations run on the same edge device. If the two colluding apps are popular, the threat can be used to launch various types of further attacks at scale. For example, the user of the compromised edge device, who wishes to remain anonymous to one of the two apps, will be de-anonymized if the user is not anonymous to the other app. Moreover, the coalition of the two apps will have an escalated privilege set that is the union of their individual privilege sets. In this paper, we implement the threat by a reliable and ubiquitous covert channel based on the edge device’s processor workload. The implementations on three edge devices (two smartphones and an embedded compute board) running Android and Android Things do not require any privileged permissions. Our implementations cover three attack scenarios of 1) two apps running on the same Android phone, 2) Fig. 1: Covert device association among colluding apps on an app and a web session in the Tor browser running on the same mobile or edge OSes (e.g., Android and Android Things). Android phone, and 3) two apps running on the same Android Things device. Experiments show that the covert channel gives at least 0.25 bps data rate and the covert device association takes at most 3.2 minutes. being adopted by emerging OSes that target a broader scope of edge devices, such as Ubuntu IoT, Windows IoT, and Android Things. Different from end devices that mostly run I. INTRODUCTION device manufacturers’ firmwares only, edge devices face a The Internet has been fast expanding its edge to interconnect unique challenge of security risks brought by the admission a wide spectrum of smart devices (e.g., embedded sensors, of third-party apps. Although the mobile OS security has smartphones, wearables, and home appliances) and form the received extensive research attention [3]–[5] and the security arXiv:2001.01204v2 [cs.CR] 10 Jan 2020 Internet of Things (IoT). It is estimated that, by 2019, there of prevalent mobile OSes has been continually hardened, the are about 26.66 billion IoT devices [1]. This quantity is attack-defense race will continue and the emerging edge OSes predicted to be doubled by 2022 [2]. The IoT devices can may not be incorporated with the latest security enhancements be roughly categorized into two classes of end devices and that have been adopted by the mobile OSes. edge devices. An end device is often a smart version of a The mobile and edge OSes mostly allow the user to traditional special-purpose physical object. As the end devices run multiple apps concurrently. The communications among do not provide generic computing services, their computing different apps should be performed over the overt channels. units are often customized by the manufacturers. Various smart For instance, in Android, the inter-app interactions should be home appliances are representative examples, such as smart implemented using Android APIs such that the Android OS lights, toothbrushes, body scales, etc. Differently, edge devices can monitor such communications [6] and keep the user’s often provide some form of generic computing services and awareness if needed. The covert communications among apps can serve as the intermediaries between the end devices and that the OS is unaware of will present a serious threat on the cloud backend. Examples include smartphones (as mobile the user’s security and privacy [7]. In this paper, we study edges), set-top boxes, and home gateways. a minimal form of inter-app covert communication called The current prevalent mobile operating systems (OSes), e.g., covert device association, which is illustrated by Fig. 1. Android and iOS, have fostered thriving application (app) Specifically, the vendors of two apps collude stealthily. Any distribution systems involving large communities of third- two installations of their apps, referred to as x and y, can party app vendors and users. Such an app-centric model is determine whether they run on the same device. If yes, they are 2 associated and can exchange massive data over the wideband information relevant to the processor’s utilized cycles and the Internet channel consisting of x’s and y’s connections to their dynamic voltage and frequency scaling (DVFS). The accesses cloud backends as well as the communication channel between to these files do not require privileged permissions. We also the two colluding vendors. present the results of evaluating the implementations including The covert device association capability is a stepping stone the impact of interfering computing tasks on the covert channel for a number of further attacks that can be launched by the and smartphone’s heat generation caused by the modulation of associated x and y, including but not limited to the following: bits using processor workload. Results show that, the processor De-anonymization: If the user provides a meaningful identity workload-based covert channel gives at least 0.25 bps data rate with zero empirical bit error rate and maintains the smartphone (e.g., e-mail address or phone number) to x, the y, to which the user wishes to keep anonymous, can obtain the user’s identity temperature below human body temperature. With the 0.25 bps data rate, the covert device association can be completed from the vendor of x over the Internet channel. Particularly, within 3.2 minutes. in this paper, we will show that the y can be a web session running in a mobile Tor browser [8] for anonymity and it can The remainder of this paper is organized as follows. Sec- tion II reviews related work. Section III overviews the covert establish the covert association with a local app x. device association threat. Section IV presents prototype imple- Privilege escalation: Current mobile OSes feature meticu- mentations. Section V presents evaluation results. Section VI lously designed permission control mechanisms to manage discusses countermeasures. Section VII concludes this paper. the information that can be accessed by individual apps. Edge OSes will likely adopt similar designs for edge security. II. RELATED WORK However, through the Internet channel, the associated x and Device fingerprinting and covert channel are two topics can access the information that is defined by the union of y related to the device association threat studied in this paper. ’s and ’s permission sets. Therefore, the privileges of both x y This section reviews the related work in these two topics. x and y are stealthily escalated beyond the awareness of the Device fingerprinting uses device-unique metrics to identify victim edge OS. and track devices. In [14], the accelerometer measurements of The above follow-up attacks launched based on the covert a smartphone are used to construct a hardware fingerprint. The device association can occur at large scales when the two study shows that the entropy of the fingerprint is sufficient to apps are installed on many edge devices. Therefore, the covert uniquely identify a device among thousands of devices with a device association can be a widespread threat should the edge low probability of collision. OSes and the corresponding app distribution systems prevail. In [15], smartphones’ microphones and speakers are shown In this paper, we investigate the covert device association to provide hardware fingerprints. via the edge processor workload. Existing studies [9]–[12] The study [16] shows that a picture captured by a smart- have shown the feasibility of various covert channels via phone camera contains the camera’s fingerprint. Most of touchscreen brightness, vibration actuation and sensing, and such fingerprinting techniques are developed for sensor-rich etc., on mobile OSes. However, they focus on the local data smartphones. The wider spectrum of edge devices may not exchange collusion between two apps that may require non- be equipped with the used sensors. Moreover, when such trivial synchronization mechanisms. Moreover, some covert fingerprinting techniques are used for device association, the channels (e.g., touchscreen) are not ubiquitous on a wider two colluding apps x and y need to access the same fingerprint spectrum of edge platforms. Therefore, although the local bearing sensors. The fingerprint extraction and match pro- data exchange collusion via the identified covert channels cesses often incur considerable compute overhead. In contrast, has been shown feasible, they are inefficient and may not the covert device association technique in this paper uses be always available. Differently, in this paper, we show via the processors that are pervasively available on any edge extensive experiments that the processor workload provides a devices. The process of demodulating the processor workload reliable covert channel that is ubiquitous on edge hardware to information bits involves light computation only. platforms. Moreover, the studied covert device association A covert channel is a communication channel that is not requires a simple synchronization mechanism (i.e., scheduled by design and not managed by the OS. The covert channel rendezvous) and minimizes the usage of the covert channel by between two processes running on the same device is often moving the data exchange collusion to the cloud backends. In based on a shared resource. Memory access-based covert summary, the high availability, the simple synchronization, and channels between two virtual machines in the cloud computing the minimal usage of the processor workload covert channel environment have been studied [17]–[19].

Load more