DOCSLIB.ORG

Flexible and Fine-Grained Mandatory Access Control on Android For

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
Flexible and Fine-Grained Mandatory Access Control on Android For Flexible and Fine-grained Mandatory Access Control on Android for Diverse Security and Privacy Policies Sven Bugiel, Saarland University; Stephan Heuser, Fraunhofer SIT; Ahmad-Reza Sadeghi, Technische Universität Darmstadt and Center for Advanced Security Research Darmstadt This paper is included in the Proceedings of the 22nd USENIX Security Symposium. August 14–16, 2013 • Washington, D.C., USA ISBN 978-1-931971-03-4 Open access to the Proceedings of the 22nd USENIX Security Symposium is sponsored by USENIX Flexible and Fine-Grained Mandatory Access Control on Android for Diverse Security and Privacy Policies Sven Bugiel Stephan Heuser [email protected]∗ [email protected] Saarland University, Germany Fraunhofer SIT, Germany Ahmad-Reza Sadeghi [email protected] Technische Universität Darmstadt / CASED, Germany Abstract Android’s vulnerabilities. Android has been shown to be vulnerable to a number of different In this paper we tackle the challenge of providing attacks such as malicious apps and libraries that mis- a generic security architecture for the Android OS use their privileges [57, 40, 25] or even utilize root- that can serve as a flexible and effective ecosystem exploits [55, 40] to extract security and privacy sen- to instantiate different security solutions. In con- sitive information; taking advantage of unprotected trast to prior work our security architecture, termed interfaces [14, 12, 53, 32] and files [49]; confused FlaskDroid, provides mandatory access control si- deputy attacks [16]; and collusion attacks [46, 34]. multaneously on both Android’s middleware and kernel layers. The alignment of policy enforcement Solutions. On the other hand, Android’s open- on these two layers is non-trivial due to their com- source nature has made it very appealing to academic pletely different semantics. We present an efficient and industrial security research. Various extensions policy language (inspired by SELinux) tailored to to Android’s access control framework have been the specifics of Android’s middleware semantics. We proposed to address particular problem sets such as show the flexibility of our architecture by policy- protection of the users’ privacy [19, 28, 15, 52, 7, 30]; driven instantiations of selected security models such application centric security such as Saint enabling as the existing work Saint as well as a new privacy- developers to protect their application interfaces [39]; protecting, user-defined and fine-grained per-app ac- establishing isolated domains (usage of the phone cess control model. Other possible instantiations in private and corporate context) [9]; mitigation of include phone booth mode, or dual persona phone. Fi- collusion attacks [8], and extending Android’s Linux nally we evaluate our implementation on SE Android kernel with Mandatory Access Control [48]. 4.0.4 illustrating its efficiency and effectiveness. Observations. Analyzing the large body of litera- 1 Introduction ture on Android security and privacy one can make the following observations: First, almost all proposals Mobile devices such as smartphones and tablets have for security extensions to Android constitute manda- become very convenient companions in our daily lives tory access control (MAC) mechanisms that are tai- and, not surprisingly, also appealing to be used for lored to the specific semantics of the addressed prob- working purposes. On the down side, the increased lem, for instance, establishing a fine-grained access complexity of these devices as well as the increasing control to user’s private data or protecting the plat- amount of sensitive information (private or corporate) form integrity. Moreover, these solutions fall short stored and processed on them, from user’s location with regards to an important aspect, namely, that data to credentials for online banking and enterprise protection mechanisms operate only at a specific VPN, raise many security and privacy concerns. To- system abstraction layer, i.e., either at the middle- day the most popular and widespread smartphone ware (and/or application) layer, or at the kernel-layer. operating system is Google’s Android [4]. Thus, they omit the peculiarity of the Android OS design that each of its two software layers (middle- Author was affiliated with Technische Universität Darm- ware and kernel) is important within its respective stadt/CASED∗ at the time this work was conducted. semantics for the desired overall security and privacy. USENIX Association 22nd USENIX Security Symposium 131 Only few solutions consider both layers [8, 9], but problems of the stock Android permission framework they support only a very static policy and lack the and of related solutions which target either the mid- required flexibility to instantiate different security dleware or the kernel layer. We base our implemen- and privacy models. tation on SE Android [48], which has already been The second observation concerns the distinguishing partially merged into the official Android source-code characteristic of application development for mobile by Google1. platforms such as Android: The underlying oper- ating systems provide app developers with clearly 2. Security policy and type enforcement at mid- defined programming interfaces (APIs) to system dleware layer. We extended Android’s middleware resources and functionality – from network access layer with type enforcement and present our policy over personal data like SMS/contacts to the onboard language, which is specifically designed for the rich sensors. This clear API-oriented system design and semantics at this layer. The alignment of middleware convergence of functionality into designated service and kernel layer policies in a system-wide security providers [54, 36] is well-suited for realizing a security framework is non-trivial, particularly due to the dif- architecture that enables fine-grained access control ferent semantics of both layers. to the resources exposed by the API. As such, mobile 3. Use-cases. We show how our security framework systems in general and Android in particular provide can instantiate selected use-cases. The first one is an better opportunities to more efficiently establish a attack-specific related work, the well-known applica- higher security standard than possible on current tion centric security solution Saint [39]. The second commodity PC platforms [31]. one is a privacy protecting solution that uses fine- grained and user-defined access control to personal Challenges and Our Goal. Based on the obser- data. We also mention other useful security models vations mentioned above, we aim to address the fol- that can be instantiated with FlaskDroid. lowing challenges in this paper: 1) Can we design a generic and practical mandatory access control ar- 4. Efficiency and effectiveness. We successfully eval- chitecture for Android-based mobile devices, that uate the efficiency and effectiveness of our solution operates on both kernel and middleware layer, and by testing it against a testbed of known attacks and is flexible enough to instantiate various security and by deriving a basic system policy which allows for privacy protecting models just by configuring security the instantiation of further use-cases. policies? More concretely, we want to create a generic security architecture which supports the instantia- 2 Background tion of already existing proposals such as Saint [39] or privacy-enhanced system components [58], or even In this section, we first present a short overview of new use-cases such as a phone booth mode. 2) To the standard Android software stack, focusing on the what extent would the API-oriented design of An- relevant security and access control mechanisms in droid allow us to minimize the complexity of the place. Afterwards, we elaborate on the SE Android desired policy? Note that policy complexity is an Mandatory Access Control (MAC) implementation. often criticized drawback of generic MAC solutions like SELinux [33] on desktop systems [54]. 2.1 Android Software Stack Android is an open-source software stack tailored to Our Contribution. In this paper, we present the mobile devices, such as smartphones and tablets. It is design and implementation of a security architec- based on a modified Linux kernel responsible for basic ture for the Android OS that addresses the above operating system services (e.g. memory management, mentioned challenges. Our design is inspired by the file system support and network access). concepts of the Flask architecture [50]: a modular Furthermore, Android consists of an application design that decouples policy enforcement from the framework implementing (most of) the Android API. security policy itself, and thus provides a generic System Services and libraries, such as the radio inter- architecture where multiple and dynamic security face layer, are implemented in C/C++. Higher-level policies can be supported by the system. In particu- services, such as System settings, the Location- and lar, our contributions are: Audiomanager, are implemented in Java. Together, 1. System-wide security framework. We present an these components comprise the middleware layer. Android security framework that operates on both 1http://www.osnews.com/story/26477/Android_4_2_ the middleware and kernel layer. It addresses many alpha_contains_SELinux 132 22nd USENIX Security Symposium USENIX Association Android applications (apps) are implemented in during installation and checked by reference monitors Java and may contain native code. They are posi- in the Linux kernel at runtime.
Load more

Recommended publications
  • Win32 API 1.Pdf
    Win32 Programming for Microsoft Windows NT Windows NT is designed to address the changing requirements of the computing world. It is written mainly in C and is crafted in such a way as to make its functionality extensible, and to ease the porting of the code from one hardware platform to another. This enables the ability to take advantage of multiprocessor and RISC computers, and to distribute tasks to other computers on the network, transparently. Whilst providing applications and users with the ability to use the power of local and remote machines, Windows NT must offer compatibility to applications and users. Users must feel comfortable with the interface, and be able to run existing high-volume applications. Existing applications have to port simply to the new environment to take advantage of its power. So, the user interface is compatible with existing Microsoft systems and existing programming APIs are supported and have been extended. To be considered a major player in the server arena, Windows NT has to offer reliable, robust support for ‘mission critical’ software. This means the system should be fault tolerant, protecting itself from malfunction and from external tampering. It should behave predictably and applications should not be able to adversely affect the system or each other. It should also have a security policy to protect the use of system resources, and implement resource quotas and auditing. Networking is built in, with high level programming and user interfaces available. Remote access to other machines on various networks is almost transparent. Because applications have to perform to an expected level, the system should be fast and responsive on each hardware platform.
    [Show full text]
  • Installation and Configuration Guide
    NetApp SANtricity® SMI-S Provider 11.53 Installation and Configuration Guide December 2019 | 215-13407_C0 [email protected] Table of Contents About This Guide ............................................................................................................................. 1 Overview of the NetApp SANtricity SMI-S Provider ...................................................................... 1 What’s New ................................................................................................................................1 Abbreviations, Acronyms, Terms, and Definitions ........................................................................ 1 Supported Profiles and Subprofiles ............................................................................................. 1 Supported Operating Systems for SMI-S .................................................................................... 2 Supported Firmware Versions ........................................................................................................ 3 System Requirements ..................................................................................................................... 3 Installing and Uninstalling SMI-S Provider ..................................................................................... 4 Windows operating system install and uninstall process ............................................................... 4 Installing SMI-S Provider (Windows operating system) .....................................................
    [Show full text]
  • Windows Kernel Hijacking Is Not an Option: Memoryranger Comes to The
    WINDOWS KERNEL HIJACKING IS NOT AN OPTION: MEMORYRANGER COMES TO THE RESCUE AGAIN Igor Korkin, PhD Independent Researcher Moscow, Russian Federation [email protected] ABSTRACT The security of a computer system depends on OS kernel protection. It is crucial to reveal and inspect new attacks on kernel data, as these are used by hackers. The purpose of this paper is to continue research into attacks on dynamically allocated data in the Windows OS kernel and demonstrate the capacity of MemoryRanger to prevent these attacks. This paper discusses three new hijacking attacks on kernel data, which are based on bypassing OS security mechanisms. The first two hijacking attacks result in illegal access to files open in exclusive access. The third attack escalates process privileges, without applying token swapping. Although Windows security experts have issued new protection features, access attempts to the dynamically allocated data in the kernel are not fully controlled. MemoryRanger hypervisor is designed to fill this security gap. The updated MemoryRanger prevents these new attacks as well as supporting the Windows 10 1903 x64. Keywords: hypervisor-based protection, Windows kernel, hijacking attacks on memory, memory isolation, Kernel Data Protection. 1. INTRODUCTION the same high privilege level as the OS kernel, and they also include a variety The security of users’ data and of vulnerabilities. Researchers applications depends on the security of consider that “kernel modules (drivers) the OS kernel code and data. Modern introduce additional attack surface, as operating systems include millions of they have full access to the kernel’s lines of code, which makes it address space” (Yitbarek and Austin, impossible to reveal and remediate all 2019).
    [Show full text]
  • Role Based Access Control on MLS Systems Without Kernel Changes
    Role Based Access Control on For example, roles in a bank may include the role of teller or accountant. Each of these roles has a set of MLS Systems without Kernel privileges or transactions that they can p erform, includ- Changes ing some privileges that are available to b oth roles. Roles can b e hierarchical. For example, some roles in a hospital D. Richard Kuhn may b e health care provider, nurse, and do ctor. The do c- National Institute of Standards and Technology tor role may include all privileges available to the nurse Gaithersburg, Maryland 20899 role, which in turn includes all the privileges available to the health care provider role. Roles have b een used in a variety of forms for com- Abstract puter system security for at least 20 years, and several prop osals for incorp orating roles into existing access con- Role based access control (RBAC) is attracting increas- trol mechanisms have b een published [2], [3], [4]. More ing attention as a security mechanism for b oth commer- recently, formal defnitions for general-purp ose RBAC no- cial and many military systems. This pap er shows how tions have b een prop osed [5], [6], [7]. RBAC can b e implemented using the mechanisms avail- This pap er shows how RBAC can b e implemented able on traditional multi-level security systems that im- using the controls available on traditional lattice-based plement information fow p olicies. The construction from multi-level secure systems. This approach presents a MLS to RBAC systems is signifcant b ecause it shows that number of advantages: the enormous investment in MLS systems can b e lever- aged to pro duce RBAC systems.
    [Show full text]
  • NSA Security-Enhanced Linux (Selinux)
    Integrating Flexible Support for Security Policies into the Linux Operating System http://www.nsa.gov/selinux Stephen D. Smalley [email protected] Information Assurance Research Group National Security Agency ■ Information Assurance Research Group ■ 1 Outline · Motivation and Background · What SELinux Provides · SELinux Status and Adoption · Ongoing and Future Development ■ Information Assurance Research Group ■ 2 Why Secure the Operating System? · Information attacks don't require a corrupt user. · Applications can be circumvented. · Must process in the clear. · Network is too far. · Hardware is too close. · End system security requires a secure OS. · Secure end-to-end transactions requires secure end systems. ■ Information Assurance Research Group ■ 3 Mandatory Access Control · A ªmissing linkº of security in current operating systems. · Defined by three major properties: ± Administratively-defined security policy. ± Control over all subjects (processes) and objects. ± Decisions based on all security-relevant information. ■ Information Assurance Research Group ■ 4 Discretionary Access Control · Existing access control mechanism of current OSes. · Limited to user identity / ownership. · Vulnerable to malicious or flawed software. · Subject to every user©s discretion (or whim). · Only distinguishes admin vs. non-admin for users. · Only supports coarse-grained privileges for programs. · Unbounded privilege escalation. ■ Information Assurance Research Group ■ 5 What can MAC offer? · Strong separation of security domains · System, application, and data integrity · Ability to limit program privileges · Processing pipeline guarantees · Authorization limits for legitimate users ■ Information Assurance Research Group ■ 6 MAC Implementation Issues · Must overcome limitations of traditional MAC ± More than just Multi-Level Security / BLP · Policy flexibility required ± One size does not fit all! · Maximize security transparency ± Compatibility for applications and existing usage.
    [Show full text]
  • An Access Control Model for Preventing Virtual Machine Escape Attack
    future internet Article An Access Control Model for Preventing Virtual Machine Escape Attack Jiang Wu ,*, Zhou Lei, Shengbo Chen and Wenfeng Shen School of Computer Engineering and Science, Shanghai University, Shanghai 200444, China; [email protected] (Z.L.); [email protected] (S.C.); [email protected] (W.S.) * Correspondence: [email protected]; Tel: +86-185-0174-6348 Academic Editor: Luis Javier Garcia Villalba Received: 26 March 2017; Accepted: 23 May 2017; Published: 2 June 2017 Abstract: With the rapid development of Internet, the traditional computing environment is making a big migration to the cloud-computing environment. However, cloud computing introduces a set of new security problems. Aiming at the virtual machine (VM) escape attack, we study the traditional attack model and attack scenarios in the cloud-computing environment. In addition, we propose an access control model that can prevent virtual machine escape (PVME) by adapting the BLP (Bell-La Padula) model (an access control model developed by D. Bell and J. LaPadula). Finally, the PVME model has been implemented on full virtualization architecture. The experimental results show that the PVME module can effectively prevent virtual machine escape while only incurring 4% to 8% time overhead. Keywords: virtual security; virtual machine escape; access control; BLP model; PVME model 1. Introduction Cloud computing treats IT resources, data and applications as a service provided to the user through network, which is a change in the way of how data is modeled. Currently, the world’s leading IT companies have developed and published their own cloud strategies, such as Google, Amazon, and IBM.
    [Show full text]
  • File Permissions Do Not Restrict Root
    Filesystem Security 1 General Principles • Files and folders are managed • A file handle provides an by the operating system opaque identifier for a • Applications, including shells, file/folder access files through an API • File operations • Access control entry (ACE) – Open file: returns file handle – Allow/deny a certain type of – Read/write/execute file access to a file/folder by – Close file: invalidates file user/group handle • Access control list (ACL) • Hierarchical file organization – Collection of ACEs for a – Tree (Windows) file/folder – DAG (Linux) 2 Discretionary Access Control (DAC) • Users can protect what they own – The owner may grant access to others – The owner may define the type of access (read/write/execute) given to others • DAC is the standard model used in operating systems • Mandatory Access Control (MAC) – Alternative model not covered in this lecture – Multiple levels of security for users and documents – Read down and write up principles 3 Closed vs. Open Policy Closed policy Open Policy – Also called “default secure” • Deny Tom read access to “foo” • Give Tom read access to “foo” • Deny Bob r/w access to “bar” • Give Bob r/w access to “bar • Tom: I would like to read “foo” • Tom: I would like to read “foo” – Access denied – Access allowed • Tom: I would like to read “bar” • Tom: I would like to read “bar” – Access allowed – Access denied 4 Closed Policy with Negative Authorizations and Deny Priority • Give Tom r/w access to “bar” • Deny Tom write access to “bar” • Tom: I would like to read “bar” – Access
    [Show full text]
  • Multilevel Security (MLS)
    Multilevel Security (MLS) Database Security and Auditing Multilevel Security (MLS) Definition and need for MLS – Security Classification – Secrecy-Based Mandatory Policies: Bell- LaPadula Model – Integrity-based Mandatory Policies: The Biba Model – Limitation of Mandatory Policies Hybrid Policies – The Chinese Wall Policy Definition and need for MLS Multilevel security involves a database in which the data stored has an associated classification and consequently constraints for their access MLS allows users with different classification levels to get different views from the same data MLS cannot allow downward leaking, meaning that a user with a lower classification views data stored with a higher classification Definition and need for MLS Usually multilevel systems are with the federal government Some private systems also have multilevel security needs MLS relation is split into several single-level relations, A recovery algorithm reconstructs the MLS relation from the decomposed single-level relations At times MLS updates cannot be completed because it would result in leakage or destruction of secret information Definition and need for MLS In relational model, relations are tables and relations consist of tuples (rows) and attributes (columns) Example: Consider the relation SOD(Starship, Objective, Destination) Starship Objective Destination Enterprise Exploration Talos Voyager Spying Mars Definition and need for MLS The relation in the example has no classification associated with it in a relational model The same example in MLS with
    [Show full text]
  • Multilevel Adaptive Security System
    Copyright Warning & Restrictions The copyright law of the United States (Title 17, United States Code) governs the making of photocopies or other reproductions of copyrighted material. Under certain conditions specified in the law, libraries and archives are authorized to furnish a photocopy or other reproduction. One of these specified conditions is that the photocopy or reproduction is not to be “used for any purpose other than private study, scholarship, or research.” If a, user makes a request for, or later uses, a photocopy or reproduction for purposes in excess of “fair use” that user may be liable for copyright infringement, This institution reserves the right to refuse to accept a copying order if, in its judgment, fulfillment of the order would involve violation of copyright law. Please Note: The author retains the copyright while the New Jersey Institute of Technology reserves the right to distribute this thesis or dissertation Printing note: If you do not wish to print this page, then select “Pages from: first page # to: last page #” on the print dialog screen The Van Houten library has removed some of the personal information and all signatures from the approval page and biographical sketches of theses and dissertations in order to protect the identity of NJIT graduates and faculty. ABSTRACT MULTILEVEL ADAPTIVE SECURITY SYSTEM by Hongwei Li Recent trends show increased demand for content-rich media such as images, videos and text in ad-hoc communication. Since such content often tends to be private, sensitive, or paid for, there exists a requirement for securing such information over resource constrained ad hoc networks.
    [Show full text]
  • Looking Back: Addendum
    Looking Back: Addendum David Elliott Bell Abstract business environment produced by Steve Walker’s Com- puter Security Initiative.3 The picture of computer and network security painted in What we needed then and what we need now are “self- my 2005 ACSAC paper was bleak. I learned at the con- less acts of security” that lead to strong, secure commercial ference that the situation is even bleaker than it seemed. products.4 Market-driven self-interest does not result in al- We connect our most sensitive networks to less-secure net- truistic product decisions. Commercial and government ac- works using low-security products, creating high-value tar- quisitions with tight deadlines are the wrong place to ex- gets that are extremely vulnerable to sophisticated attack or pect broad-reaching initiatives for the common good. Gov- subversion. Only systems of the highest security are suffi- ernment must champion selfless acts of security separately cient to thwart such attacks and subversions. The environ- from acquisitions. ment for commercial security products can be made healthy again. 3 NSA Has the Mission In 1981, the Computer Security Evaluation Center was 1 Introduction established at the National Security Agency (NSA). It was charged with publishing technical standards for evaluating In the preparation of a recent ACSAC paper [1], I con- trusted computer systems, with evaluating commercial and firmed my opinion that computer and network security is in GOTS products, and with maintaining an Evaluated Prod- sad shape. I also made the editorial decision to soft-pedal ucts List (EPL) of products successfully evaluated. NSA criticism of my alma mater, the National Security Agency.
    [Show full text]
  • Access Control and Operating System
    Outline (may not finish in one lecture) Access Control and Operating Access Control Concepts Secure OS System Security • Matrix, ACL, Capabilities • Methods for resisting • Multi-level security (MLS) stronger attacks OS Mechanisms Assurance • Multics • Orange Book, TCSEC John Mitchell – Ring structure • Common Criteria • Amoeba • Windows 2000 – Distributed, capabilities certification • Unix Some Limitations – File system, Setuid • Information flow • Windows • Covert channels – File system, Tokens, EFS • SE Linux – Role-based, Domain type enforcement Access control Access control matrix [Lampson] Common Assumption Objects • System knows who the user is File 1 File 2 File 3 … File n – User has entered a name and password, or other info • Access requests pass through gatekeeper User 1 read write - - read – OS must be designed monitor cannot be bypassed User 2 write write write - - Reference Subjects monitor User 3 - - - read read User process ? Resource … User m read write read write read Decide whether user can apply operation to resource Two implementation concepts Capabilities Access control list (ACL) File 1 File 2 … Operating system concept • “… of the future and always will be …” • Store column of matrix User 1 read write - Examples with the resource User 2 write write - • Dennis and van Horn, MIT PDP-1 Timesharing Capability User 3 - - read • Hydra, StarOS, Intel iAPX 432, Eros, … • User holds a “ticket” for … • Amoeba: distributed, unforgeable tickets each resource User m read write write • Two variations References – store
    [Show full text]
  • The Flask Security Architecture: System Support for Diverse Security Policies
    The Flask Security Architecture: System Support for Diverse Security Policies Ray Spencer Secure Computing Corporation Stephen Smalley, Peter Loscocco National Security Agency Mike Hibler, David Andersen, Jay Lepreau University of Utah http://www.cs.utah.edu/flux/flask/ Abstract and even many types of policies [1, 43, 48]. To be gen- erally acceptable, any computer security solution must Operating systems must be flexible in their support be flexible enough to support this wide range of security for security policies, providing sufficient mechanisms for policies. Even in the distributed environments of today, supporting the wide variety of real-world security poli- this policy flexibility must be supported by the security cies. Such flexibility requires controlling the propaga- mechanisms of the operating system [32]. tion of access rights, enforcing fine-grained access rights and supporting the revocation of previously granted ac- Supporting policy flexibility in the operating system is cess rights. Previous systems are lacking in at least one a hard problem that goes beyond just supporting multi- of these areas. In this paper we present an operating ple policies. The system must be capable of supporting system security architecture that solves these problems. fine-grained access controls on low-level objects used to Control over propagation is provided by ensuring that perform higher-level functions controlled by the secu- the security policy is consulted for every security deci- rity policy. Additionally, the system must ensure that sion. This control is achieved without significant perfor- the propagation of access rights is in accordance with mance degradation through the use of a security decision the security policy.
    [Show full text]