Flexible and Fine-grained Mandatory on Android for Diverse Security and Privacy Policies Sven Bugiel, Saarland University; Stephan Heuser, Fraunhofer SIT; Ahmad-Reza Sadeghi, Technische Universität Darmstadt and Center for Advanced Security Research Darmstadt

This paper is included in the Proceedings of the 22nd USENIX Security Symposium. August 14–16, 2013 • Washington, D.C., USA ISBN 978-1-931971-03-4

Open access to the Proceedings of the 22nd USENIX Security Symposium is sponsored by USENIX Flexible and Fine-Grained on Android for Diverse Security and Privacy Policies

Sven Bugiel Stephan Heuser [email protected]∗ [email protected] Saarland University, Germany Fraunhofer SIT, Germany Ahmad-Reza Sadeghi [email protected] Technische Universität Darmstadt / CASED, Germany

Abstract Android’s vulnerabilities. Android has been shown to be vulnerable to a number of different In this paper we tackle the challenge of providing attacks such as malicious apps and libraries that mis- a generic security architecture for the Android OS use their privileges [57, 40, 25] or even utilize root- that can serve as a flexible and effective ecosystem exploits [55, 40] to extract security and privacy sen- to instantiate different security solutions. In con- sitive information; taking advantage of unprotected trast to prior work our security architecture, termed interfaces [14, 12, 53, 32] and files [49]; confused FlaskDroid, provides mandatory access control si- deputy attacks [16]; and collusion attacks [46, 34]. multaneously on both Android’s middleware and kernel layers. The alignment of policy enforcement Solutions. On the other hand, Android’s open- on these two layers is non-trivial due to their com- source nature has made it very appealing to academic pletely different semantics. We present an efficient and industrial security research. Various extensions policy language (inspired by SELinux) tailored to to Android’s access control framework have been the specifics of Android’s middleware semantics. We proposed to address particular problem sets such as show the flexibility of our architecture by policy- protection of the users’ privacy [19, 28, 15, 52, 7, 30]; driven instantiations of selected security models such application centric security such as Saint enabling as the existing work Saint as well as a new privacy- developers to protect their application interfaces [39]; protecting, user-defined and fine-grained per-app ac- establishing isolated domains (usage of the phone cess control model. Other possible instantiations in private and corporate context) [9]; mitigation of include phone booth mode, or dual persona phone. Fi- collusion attacks [8], and extending Android’s nally we evaluate our implementation on SE Android kernel with Mandatory Access Control [48]. 4.0.4 illustrating its efficiency and effectiveness. Observations. Analyzing the large body of litera- 1 Introduction ture on Android security and privacy one can make the following observations: First, almost all proposals Mobile devices such as smartphones and tablets have for security extensions to Android constitute manda- become very convenient companions in our daily lives tory access control (MAC) mechanisms that are tai- and, not surprisingly, also appealing to be used for lored to the specific semantics of the addressed prob- working purposes. On the down side, the increased lem, for instance, establishing a fine-grained access complexity of these devices as well as the increasing control to user’s private data or protecting the plat- amount of sensitive information (private or corporate) form integrity. Moreover, these solutions fall short stored and processed on them, from user’s location with regards to an important aspect, namely, that data to credentials for online banking and enterprise protection mechanisms operate only at a specific VPN, raise many security and privacy concerns. To- system abstraction layer, i.e., either at the middle- day the most popular and widespread smartphone ware (and/or application) layer, or at the kernel-layer. is Google’s Android [4]. Thus, they omit the peculiarity of the Android OS design that each of its two software layers (middle- Author was affiliated with Technische Universität Darm- ware and kernel) is important within its respective stadt/CASED∗ at the time this work was conducted. semantics for the desired overall security and privacy.

USENIX Association 22nd USENIX Security Symposium 131 Only few solutions consider both layers [8, 9], but problems of the stock Android permission framework they support only a very static policy and lack the and of related solutions which target either the mid- required flexibility to instantiate different security dleware or the kernel layer. We base our implemen- and privacy models. tation on SE Android [48], which has already been The second observation concerns the distinguishing partially merged into the official Android source-code characteristic of application development for mobile by Google1. platforms such as Android: The underlying oper- ating systems provide app developers with clearly 2. Security policy and type enforcement at mid- defined programming interfaces () to system dleware layer. We extended Android’s middleware resources and functionality – from network access layer with type enforcement and present our policy over personal data like SMS/contacts to the onboard language, which is specifically designed for the rich sensors. This clear API-oriented system design and semantics at this layer. The alignment of middleware convergence of functionality into designated service and kernel layer policies in a system-wide security providers [54, 36] is well-suited for realizing a security framework is non-trivial, particularly due to the dif- architecture that enables fine-grained access control ferent semantics of both layers. to the resources exposed by the API. As such, mobile 3. Use-cases. We show how our security framework systems in general and Android in particular provide can instantiate selected use-cases. The first one is an better opportunities to more efficiently establish a attack-specific related work, the well-known applica- higher security standard than possible on current tion centric security solution Saint [39]. The second commodity PC platforms [31]. one is a privacy protecting solution that uses fine- grained and user-defined access control to personal Challenges and Our Goal. Based on the obser- data. We also mention other useful security models vations mentioned above, we aim to address the fol- that can be instantiated with FlaskDroid. lowing challenges in this paper: 1) Can we design a generic and practical mandatory access control ar- 4. Efficiency and effectiveness. We successfully eval- chitecture for Android-based mobile devices, that uate the efficiency and effectiveness of our solution operates on both kernel and middleware layer, and by testing it against a testbed of known attacks and is flexible enough to instantiate various security and by deriving a basic system policy which allows for privacy protecting models just by configuring security the instantiation of further use-cases. policies? More concretely, we want to create a generic security architecture which supports the instantia- 2 Background tion of already existing proposals such as Saint [39] or privacy-enhanced system components [58], or even In this section, we first present a short overview of new use-cases such as a phone booth mode. 2) To the standard Android software stack, focusing on the what extent would the API-oriented design of An- relevant security and access control mechanisms in droid allow us to minimize the complexity of the place. Afterwards, we elaborate on the SE Android desired policy? Note that policy complexity is an Mandatory Access Control (MAC) implementation. often criticized drawback of generic MAC solutions like SELinux [33] on desktop systems [54]. 2.1 Android Software Stack Android is an open-source software stack tailored to Our Contribution. In this paper, we present the mobile devices, such as smartphones and tablets. It is design and implementation of a security architec- based on a modified responsible for basic ture for the Android OS that addresses the above operating system services (e.g. memory management, mentioned challenges. Our design is inspired by the file system support and network access). concepts of the Flask architecture [50]: a modular Furthermore, Android consists of an application design that decouples policy enforcement from the framework implementing (most of) the Android API. security policy itself, and thus provides a generic System Services and libraries, such as the radio inter- architecture where multiple and dynamic security face layer, are implemented in C/C++. Higher-level policies can be supported by the system. In particu- services, such as System settings, the Location- and lar, our contributions are: Audiomanager, are implemented in Java. Together, 1. System-wide security framework. We present an these components comprise the middleware layer. Android security framework that operates on both 1http://www.osnews.com/story/26477/Android_4_2_ the middleware and kernel layer. It addresses many alpha_contains_SELinux

132 22nd USENIX Security Symposium USENIX Association Android applications (apps) are implemented in during installation and checked by reference monitors Java and may contain native code. They are posi- in the Linux kernel at runtime. tioned at the top of the software stack (application layer) and use kernel and middleware Services. An- 2.3 SELinux droid ships with standard apps completing the im- plementation of the Android API, such as a Contacts Security Enhanced Linux (SELinux) [33] is an instan- () Provider. The user can install additional tiation of the Flask security architecture [50] and apps from, for example, the Google Play store. implements a policy-driven mandatory access control Android apps consist of certain components: Acti- (MAC) framework for the Linux kernel. In SELinux, vities (user interfaces), Services (non user-interactive policy decision making is decoupled from the policy tasks), ContentProviders (SQL-like ), and enforcement logic. Various access control enforce- Broadcast Receivers (mailboxes for broadcast mes- ment points for low-level resources, such as files, IPC, sages). Apps can communicate with each other on or memory protection enforce policy decisions re- multiple layers: 1) Standard Linux Inter- quested from a security in the kernel. This Communication (IPC) using, e.g., domain sockets; security server manages the policy rules and contains 2) Internet sockets; 3) Inter-Component Commu- the access decision logic. To maintain the security nication (ICC) [21], a term abstractly describing a server (e.g., reload the policy), SELinux provides a lightweight IPC mechanism between app components, number of userspace tools. called Binder. Furthermore, predefined actions (e.g., Access Control Model. SELinux supports differ- starting an Activity) can be triggered using an Intent, ent access control models such as Role-Based Access a unicast or broadcast message sent by an application Control and . However, Type En- and delivered using the Android ICC mechanism. forcement is the primary mechanism: each object (e.g., files, IPC) and subject (i.e., processes) is labeled with a security context containing a type attribute 2.2 Security Mechanisms that determines the access rights of the object/sub- ject. By default, all access is denied and must be Sandboxing. Android uses the Linux discretionary explicitly granted through policy rules—allow rules access control (DAC) mechanism for application sand- in SELinux terminology. Using the notation intro- boxing by assigning each app a unique user identifier duced in [26], each rule is of the form (UID) during installation2. Every process belonging to the app is executed in the context of this UID, allow TSub TObj CObj OC which determines access to low level resources (e.g. app-private files). Low-level IPC (e.g. using domain where TSub is a set of subject∶ types, TObj is a set of sockets) is also controlled using Linux DAC. object types, CObj is a set of object classes, and OC Permissions. Access control is applied to ICC us- is a set of operations. The object classes determine ing Permissions [21]: Labels assigned to apps at which kind of objects this rule relates to and the install-time after being presented to and accepted operations contain specific functions supported by by the user. These labels are checked by reference the object classes. If a subject whose type is in TSub monitors at middleware- and application level when wants to perform an operation that is in OC on an security-critical APIs are accessed. In addition to object whose class is in CObj and whose type is in Android’s default permissions, app developers can TObj, this action is allowed. Otherwise, if no such define their own permissions to protect their applica- rule exists, access is denied. tions’ interfaces. However, it should be noted that Dynamic policies. SELinux supports to some ex- the permission model is not mandatory access control tent dynamic policies based on boolean flags which (MAC), since callees must discretely deploy or define affect conditional policy decisions at runtime. These the required permission check and, moreover, permis- booleans and conditions have to be defined prior sions can be freely delegated (e.g., URI permissions). to policy deployment and new booleans/conditions Permissions are also used to restrict access to some can not be added after the policy has been loaded low level resources, such as the world read-/writeable without recompiling and reloading the entire policy. external storage area (e.g. a MicroSD card) or net- The simplest example for such dynamic policies are work access. These permissions are mapped to Linux booleans to switch between “enforcing mode” (i.e., group identifiers (GIDs) assigned to an app’s UID access denials are enforced) and “permissive mode” (i.e., access denials are not enforced). 2Developers may use the same UID (Shared UID, SUID) Userspace Object Managers. A powerful feature for their own apps. These apps will share the same sandbox. of SELinux is that its access control architecture can

USENIX Association 22nd USENIX Security Symposium 133 be extended to security-relevant userspace daemons 3.1.1 Middleware Layer and services, which manage data (objects) indepen- Recently, different attacks operating at Android’s dently from the kernel. Thus, such daemons and middleware layer have been reported: services are referred to as Userspace Object Managers Overprivileged 3rd party apps and libraries (USOMs). They are responsible for assigning security threatening user privacy by adopting questionable contexts to the objects they manage, querying the privacy practices (e.g. WhatsApp [6] or [23]). SELinux security server for access control decisions, Moreover, advertisement libraries, frequently in- and enforcing these decisions. A prominent example cluded in 3rd party apps have been shown to exploit for such USOMs on Linux systems is GConf [13]. the permissions of their host app to collect informa- tion about the user [25]. Malicious 3rd party apps [22] leverage dangerous 2.4 SE Android permissions to cause financial harm to the user (e.g., sending premium SMS) and exfiltrate user-private SE Android [48] prototypes SELinux for Android’s information [57, 40]. Linux kernel and aims to demonstrate the value of Confused deputy attacks concern malicious apps, SELinux in defending against various root exploits which leverage unprotected interfaces of benign sys- and application vulnerabilities. Specifically, it con- tem [20, 41] and 3rd party [16, 56] apps (denoted fines system Services and apps in different kernelspace deputies) to escalate their privileges. security domains even isolating apps from one an- Collusion attacks concern malicious apps that col- other by the use of the Multi-Level Security (MLS) lude using covert or overt channels [8, 34] in order to feature of SELinux. To this end, the SE Android gain a permission set which has not been approved developers started writing an Android-specific policy by the user (e.g. the Soundcomber attack [46]). from scratch. In addition, SE Android provides a Sensory malware leverages the information from few key security extensions tailored for the Android onboard sensors, like accelerometer data, to derive OS. For instance, it labels application processes with privacy sensitive information, like user input [53, 12]. SELinux-specific security contexts which are later used in type enforcement. Moreover, since (in the 3.1.2 Root Exploits majority of cases) it is a priori unknown during policy writing which apps will be installed on the system Besides attacks at Android’s middleware layer, vari- later, SE Android employs a mechanism to derive the ous privilege escalation attacks on lower layers of the security context of an app at install-time. Based on Android software stack have been reported [55, 40] criteria, such as the requested permissions, apps are which grant the attacker root (i.e., administrative) assigned a security type. This mapping from appli- privileges and can be used to bypass the Android per- cation meta-information to security types is defined mission framework. For instance, he can bypass the in the SE Android policy. ContactsProvider permission checks by accessing the contacts database file directly. Moreover, processes Additionally, SE Android provides limited support on Android executing with root privileges inherit all for MAC policy enforcement at the Android middle- available permissions at middleware layer. ware layer (MMAC) and we explain these particular It should be noted that attacks targeting vulner- features in Section 7.2 and provide a comparison to abilities of the Linux kernel are out of scope of this our FlaskDroid architecture. paper, since SE Android is a building block in our architecture (see Section 4) and as part of the kernel it is susceptible to kernel exploits. 3 Requirements Analysis for Android Security Architectures 3.2 Requirements Based on our adversary model we derive the neces- 3.1 Adversary Model sary requirements for an efficient and flexible access control architecture for mobile devices, focusing on We consider a strong adversary with the goal to get the Android OS. access to sensitive data as well as to compromise Access Control on Multiple Layers. Manda- system or third-party apps. Thus, we consider an tory access control solutions at kernel level, such adversary that is able to launch software attacks on as SE Android [48] or Tomoyo [27], help to defend different layers of the Android software stack. against or to constrain privilege escalation attacks on

134 22nd USENIX Security Symposium USENIX Association Geolocation the lower-levels of the OS [48]. However, kernel level Network state Context Providers … User Policy MAC provides insufficient protection against security Set active App Feedback Rules context flaws in the middleware and application layers, and update App Package Manager User-Space Policy lacks the necessary high-level semantics to enable a App Security Server Hook Update fine-grained filtering at those layers [48, 47]. Access API Services

MAC (Location, Telephony) queries

control solutions at middleware level [28, 15, 39, 9, 8] boolean API access Policy Database Hook

are able to address these shortcomings of kernel level API SysCall ContentProviders

System Apps User

flags MAC, but are, on the other hand, susceptible to (Contacts, SMS,…) low-level privilege escalation attacks. User-space Kernel space Thus, a first requirement is to provide simultaneous API Low-Level MAC queries Hook SE Android MAC defenses at the two layers. Ideally, these two Resource (Filesystem,…) layers can be dynamically synchronized at run-time FlaskDroid component Modified component SE Android module Standard Android over mutual interfaces. At least, the kernel MAC is able to preserve security invariants, i.e., it enforces Figure 1: FlaskDroid Architecture that any access to sensitive resources/functionality is always first mediated by the middleware MAC. Multiple stakeholders policies. Mobile systems involve multiple stakeholders, such as the end-user, 4.1 Overview the device manufacturer, app developers, or other 3rd parties (e.g., the end-user’s employer). These stakeholders also store sensitive data on the device. The high-level idea of FlaskDroid is inspired by the Related work [39, 9] has proposed special purpose Flask security architecture [50], where various Object solutions to address the security requirements and Managers at middleware and kernel-level are respon- specific problems of these parties. Naturally, the sible for assigning security contexts to their objects. assets of different stakeholders are subject to different Objects can be, for instance, kernel resources such as security requirements, which are not always aligned Files or IPC and middleware resources such as Service and might conflict. Thus, one objective for a generic interfaces, Intents, or ContentProvider data. On access MAC framework that requires handling policies of to these objects by subjects (i.e., apps) to perform a multiple stakeholders is to support (basic) policy particular operation, the managers enforce an access reconciliation mechanisms [43, 35]. control decision that they request from a security Context-awareness. The security requirements of server at their respective layer. Thus, our approach different stakeholders may depend on the current implements a userspace security server. Access con- context of the device. Thus, our architecture shall trol in FlaskDroid is implemented, as in SE Android provide support for context-aware security policies. (cf. Section 2), as type enforcement. However, in con- Support for different Use-Cases. Our architec- trast to SE Android we extend our policy language ture shall serve as a basis for different security so- with new features that are tailored to the Android lutions applicable in a variety of use cases. For in- middleware semantics (cf. Section 4.3). Moreover, to stance, by modifying the underlying policy our solu- enable more dynamic policies, the policy checks in tion should be able to support different use cases (as FlaskDroid depend also on the System State, which shown in Section 5), such as the selective and fine- determines the actual security context of the objects grained protection of app interfaces [39] or privacy- and subjects at runtime. enhanced system Services and ContentProviders. Each security server is also responsible for the pol- icy management for multiple stakeholders such as app developers, end-user, or 3rd parties. A particular 4 FlaskDroid Architecture feature is that the policies on the two layers are syn- chronized at runtime, e.g., a change in enforcement In this section, we provide an overview of our in the middleware, must be supported/reflected at FlaskDroid architecture, elaborate in more detail kernel-level. Thus, by decoupling the policy man- on particular design decisions, and present the policy agement and decision making from the enforcement language employed in our system. Due to space con- points and consolidating the both layers, the goal straints, we focus on the most important aspects and of FlaskDroid’s design is to provide fine-grained and refer to our technical report [11] for more detailed highly flexible access control over operations on both information. middleware and kernel-level.

USENIX Association 22nd USENIX Security Symposium 135 4.2 Architecture Components Server (USSS) is implemented as part of the Android system server (com.android.server) and comprises Figure 1 provides an overview of our architecture. In 3741 lines of Java code. It exposes an interface to the following, we will explain the individual compo- the USOMs for requesting access control decisions nents that comprise the FlaskDroid architecture. over ICC (cf. Figure 1).

4.2.1 SE Android Module 4.2.3 Userspace Object Managers At the kernel-level, we employ stock SE Android [48] In FlaskDroid, middleware services and apps act as a building block primarily for the following pur- as Userspace Object Managers (USOMs) for their re- poses: First, it is essential for hardening the Linux spective objects. These services and apps can be kernel [48] thereby preventing malicious apps from distinguished into system components and 3rd party (easily) escalating their privileges by exploiting vul- components. The former, i.e., pre-installed services nerabilities in privileged (system) services. Even and apps, inevitably have to be USOMs to achieve when an attack, usually with the intent of gaining the desired system security and privacy, while the root user privileges, is successful, SE Android can con- latter can use interfaces provided by the Userspace strain the file-system privileges of the app by restrict- Security Server to optionally act as USOMs. ing the privileges of the root account itself. Second, Table 4 in Appendix B provides an overview of it complements the policy enforcement at the mid- exemplary system USOMs in FlaskDroid and shows dleware level by preventing apps from bypassing the some typical operations each controls. middleware enforcement points (in Flask terminology Currently, the USOMs implemented in FlaskDroid defined as Userspace Object Managers (USOMs)), for comprise 136 policy enforcement points. In the fol- example, accessing the contacts database file directly lowing, we explain how we instrumented selected instead of going through the ContactsProvider app. components as Userspace Object Managers. Dynamic policies. Using the dynamic policy sup- PackageManagerService is responsible for port of SELinux (cf. Section 2.3) it is possible to (un)installation of application packages. Further- reconfigure the access control rules at runtime de- more, it is responsible for finding a preferred pending on the current system state. Our Userspace component for doing a task at runtime. For instance, Security Server (cf. Section 4.2.2) is hereby the trusted if an app sends an Intent to display a PDF, the agent that controls the SELinux dynamic PackageManagerService looks for a preferred Activity policies and can map system states and contexts to able to perform the task. SELinux boolean variables (cf. Section 4.3). To this As a Userspace Object Manager, we extend the Pack- end, SE Android provides user space support (in ageManagerService to assign consolidated middleware- particular android.os.SELinux). and kernel-level app types to all apps during instal- lation using criteria defined in the policy (cf. Sec- 4.2.2 Userspace Security Server tion 4.3). This is motivated by the fact that at the time a policy is written, one cannot predict which In our architecture, the Userspace Security Server is rd the central policy decision point for all userspace 3 party apps will be installed in the future. Pre- access control decisions, while the SE Android ker- installed apps are labeled during the phone’s boot nelspace security server is responsible for all ker- cycle based on the same criteria. More explicitly, nelspace policy decisions. This approach provides we assign app types to the (shared) UIDs of apps, a clear separation of security issues between the since (shared) UIDs are the smallest identifiable unit userspace and the kernelspace components. Further- for application sandboxes. In addition, pre-defined UIDs in the system are reserved for particular system more, it enables at middleware level the use of a more 3 dynamic policy schema (different from the more static components and we map these UIDs to pre-defined SELinux policy language) which takes advantage of types (e.g., aid_root_t or aid_audio_t). Further- the rich semantics (e.g., contextual information) at more, we extend the logic for finding a preferred that layer. Access control is implemented as type component to only consider apps which are allowed enforcement based on (1) the subject type (usually by the policy to perform the requested task. the type associated with the calling app), (2) the ActivityManagerService is responsible for man- object type (e.g., contacts_email or the type associ- aging the stack of Activities of different apps, Activity ated with the callee app UID), (3) the object class life-cycle management, as well as providing the Intent (e.g., contacts_data or Intent), and (4) the operation 3These pre-defined UIDs on Android 4.0.4 are found in on the object (e.g. query). The Userspace Security system/core/include/private/android_filesystem_config.h

136 22nd USENIX Security Symposium USENIX Association broadcast system. As a USOM, the ActivityManager- tiate a Service as a Userspace Object Manager, we add Service is responsible for labeling Activity and Intent access control checks when a (remote) component objects and enforcing access control on them. Acti- connects to the Service and on each call to Service vities are labeled according to the apps they belong functions exposed by the Service API. The developer to, i.e., the UID of the application process that cre- of the Service can set the types of the service and its ated the Activity. Subsequently, access control on functions by adding type-tags to their definitions. the Activity objects is enforced in the ActivityStack Service interfaces are exposed as Binder IPC ob- subsystem of the ActivityManagerService. During op- jects that are generated based on an interface spec- erations that manipulate Activities, such as moving ification described in the Android Interface Defini- Activities to the foreground/background or destroying tion Language (AIDL). We extended the lexer and them, the ActivityStack queries the USSS in order to parser of Android’s AIDL tool to recognize (developer- verify that the particular operations are permitted defined) type tags on Service interfaces and function to proceed depending on the subject type (i.e., the declarations. The AIDL code generator was extended calling app) and object type (i.e., the app owning to automatically insert policy checks for these types the Activity being modified). in the auto-generated Service code. Since the AIDL Similar to apps, Intents are labeled based on avail- tool is used during build of the system as well as able meta-information, such as the action and cate- part of the SDK for app development, this solution gory string or the sender app (cf. Section 4.3.1). To applies to both system Services and 3rd party app apply access control to Broadcast Intents, we followed Services in the same way. a design pattern as proposed in [39, 9]. We modi- fied the ActivityManagerService to filter out receivers 4.2.4 Context Providers which are not allowed to receive Intents of the pre- viously assigned type (e.g., to prevent apps of lower A context is an abstract term that represents the from receiving Broadcasts by an current security requirements of the device. It can app of a higher security clearance). be derived from different criteria, such as physical Content Providers are the primary means for apps criteria (e.g., the location of the device) or the state to share data. This data can be accessed over a of apps and the system (e.g., the app being currently well-defined, SQL-like interface. As Userspace Object shown on the screen). To allow for flexible control Managers, ContentProviders are responsible for assign- of contexts and their definitions, our design employs ing labels to the data entries they manage during Context Providers. These providers come in form of insertion/creation of data and for performing access plugins to our Userspace Security Server (see Figure 1) control on update, query, or deletion of entries. Two and can be arbitrarily complex (e.g., use machine approaches for access control are supported: 1) at learning) and leverage available information such as the API level by controlling access to the provider as the network state or geolocation of the device to a whole or 2) integrating it into the storage back-end determine which contexts apply. Context Providers (e.g., SQLite database) for more fine-grained per-data register Listener threads in the system to detect con- access control. text changes similar to the approach taken in [15]. Each Context Provider is responsible for a distinct For approach 2), we implemented a design pattern set of contexts, which it activates/deactivates in the for SQLite-based ContentProviders. Upon insertion USSS. Decoupling the context monitoring and defini- or update of entries, we verify that the subject type tion from our policy provides that context definitions of the calling app is permitted to perform this opera- do not affect our policy language except for very sim- tion on the particular object type. To filter queries ple declarations (as we will show in Section 4.3.1). to the database we create one SQL View for each Moreover, the USSS provides feedback to Context subject type and redirect the query of each calling Providers about the performed access control deci- app to the respective View for its type. Each View sions. This is particularly useful when instantiating implements a filtering of data based on an access con- security models like [8, 15] in which access control trol table managed by the USSS which represents the decisions depend on previous decisions. access control matrix for subject/object types. This approach is well-suited for any SQLite-based Con- tentProvider and scales well to multiple stakeholders 4.3 Policy by using nested Views. 4.3.1 Policy Language and Extensions Service components of an app provide a particular functionality to other (possibly remote) components, We extend SELinux’s policy semantics for type en- which access the Service interface via ICC. To instan- forcement (cf. Section 2.3) with new default classes

USENIX Association 22nd USENIX Security Symposium 137 Listing 1: Assigning types to apps and Intents Listing 2: Linking booleans with contexts

1 defaultAppType untrustedApp_t; 1 bool phoneBooth_b = false; 2 defaultIntentType untrustedIntent_t; 2 kbool allowIPTablesExec_b = true; 3 3 4 appType app_telephony_t { 4 switchBoolean { Package:package_name=com.android.phone; }; 5 context=phoneBooth_con; 5 6 auto_reverse=true; 6 intentType intentLaunchHome_t { 7 phoneBooth_b=true;}; 7 Action:action_string=android.intent.action.MAIN; 8 Categories:category=android.intent.category.HOME;}; SELinux boolean.

and constructs for expressing policies on both mid- dleware and kernel-level. A recapitulation of the 4.3.2 Support for Multiple Stakeholders SELinux policy language is out of scope of this paper A particular requirement for the design of FlaskDroid and we focus here on our extensions. is the protection of interests of different stakeholders. New default classes. Similar to classes at the This requires that policy decisions consider the poli- kernel-level, like file or socket, we introduce new cies of all involved stakeholders. These policies can default classes and their corresponding operations be pre-installed (i.e., system policy), delivered with to represent common objects at middleware level, apps (i.e., app developer policies), or configured by such as Activity, Service, ContentProvider, and Intent. the user (e.g., User Policy App in Figure 1). Operations for these classes are, for example, query In FlaskDroid, 3rd party app developers may op- a ContentProvider or receive an Intent. tionally ship app-specific policies with their applica- Application and Intent Types. A further exten- tion packages and additionally choose to instrument sion is the possibility to define criteria by which ap- their app components as Userspace Object Managers plications and Intents are labeled with a security type for their own data objects. FlaskDroid provides the (cf. Listing 1). The criteria for apps can be, for in- necessary interfaces to query the Userspace Security stance, the application package name, the requested Server for policy decisions as part of the SDK. These permissions or the developer signature. Criteria for decisions are based on the app-specific 3rd party assigning a type to Intent objects can be the Intent policy, which defines custom appType statements to action string, category or receiving component. If no label subjects (e.g., other apps) and declares app- criteria matched, a default type is assigned to apps specific object types. To register app-specific policies, (line 1) and Intents (line 2), respectively. the PackageManagerService is instrumented such that Context definitions and awareness. We extend it extracts policy files during app installation and the policy language with an option to declare con- injects them into the USSS. texts to enable context-aware policies. Each declared A particular challenge when supporting multiple context can be either activated or deactivated by a stakeholders is the reconciliation of the various stake- dedicated Context Provider (cf. Section 4.2). holders’ policies. Different strategies for reconcili- To actually enable context-aware policies, we in- ation are possible [43, 35] and generally supported troduce in our policy language switchBoolean state- by our architecture, based on namespaces and glob- ments which map contexts to booleans, which in al/local type definitions. For instance, as discussed turn provide dynamic policies. Listing 2 presents in [43], all-allow (i.e., all stakeholder policies must the definition of booleans and switchBoolean state- allow access), any-allow (i.e., only one stakeholder ments. For instance, the switchBoolean statement in policy must allow access), priority (i.e., higher ranked lines 4-9 defines that as soon as the context phone- stakeholder policies override lower ranked ones), or Booth_con is active, the boolean phoneBooth_b has consensus (i.e., at least one stakeholder policy allows to be set to true. As soon as the phoneBooth_con and none denies or vice versa). However, choosing context is deactivated, the phoneBooth_b boolean the right strategy strongly depends on the use-case. should be reset to its initial value (line 6). To map For example, on a pure business smartphone without contexts to the kernel-level, we introduce kbool defi- a user-private domain, the system (i.e., company) pol- nitions (line 2), which point to a boolean at kernel icy always has the highest priority, while on a private level instead of adding a new boolean at middleware device a consensus strategy may be preferable. level. Changes to such kernel-mapped boolean values We opted for a consensus approach, in which the by switchBoolean statements trigger a call to the system policy check is mandatory and must always SELinux kernel module to update the corresponding consent for an operation to succeed.

138 22nd USENIX Security Symposium USENIX Association 5 Use-cases / Instantiations 5.2 App Developer Policies (Saint)

In the following we will show how FlaskDroid can Ongtang et al. present in [39] an access control frame- instantiate certain privacy and security protecting work, called Saint, that allows app developers to ship use-cases. More use-cases and concrete examples are their apps with policies that regulate access to their provided in our technical report [11]. apps’ components. Problem description: The concrete example used to illustrate this mechanism consists of a shopping 5.1 Privacy Enhanced System Ser- app whose developer wants to restrict the interaction vices and Content Providers with other 3rd party apps to only specific payment, password vault, or service apps. For instance, the System Services and ContentProviders are an integral developer specifies that that the password vault app part of the Android application framework. Promi- must be at least version 1.2 or that a personal ledger nent Services are, for instance, the LocationManager app must not hold the Internet permission. or the Audio Services and prominent ContentProviders The policy rules for the runtime enforcement of are the contacts app and SMS/MMS app. By default, Saint on Inter-Component communication (ICC) are Android enforces permission checks on access to the defined as the tuple (Source, Destination, Conditions, interfaces of these Services and Providers. State). Source defines the source app component Problem description: The default permissions are of the ICC and optional parameters for an Intent non-revocable and too coarse-grained and protect object (e.g., action string). Destination describes access only to the entire Service/Provider but not to similarly the destination app component of the ICC. specific functions or data. Thus, the user cannot Conditions are optional conjunctional conditions (e.g., control in a fine-grained fashion which sensitive data permissions or signature key of the destination app) can be accessed how, when and by whom. Apps such and State describes the system state (e.g., geolocation as Facebook and WhatsApp have access to the entire or bluetooth adapter state). contacts database although only a subset of the data Solution: Instantiating Saint’s runtime access con- (i.e., email addresses, phone numbers and names) trol on FlaskDroid is achieved by mapping Saint’s is required for their correct functioning. On the parameters to the type enforcement implemented by other hand, recent attacks demonstrated how even FlaskDroid. Thus, Source, Destination, and Condi- presumably privacy-unrelated and thus unprotected tions are combined into security types for the subject data (e.g. accelerometer readings) can be misused (i.e., source app) and object (i.e., destination app against user’s security and privacy [53, 12]. or Intent object). For instance, a specific type is Solution: Our modified AIDL tool automatically assigned to an app with a particular signature and generates policy checks for each Service interface and permission. If this app is source in the Saint policy, function in the system. We tagged selected query it is used as subject type in FlaskDroid policy rules; functions of the system AudioService, LocationMana- and if it is used as destination, it is used as object ger, and SensorManager with specific security contexts type. The object class and operation are directly de- (e.g., fineGrainedLocation_t as object_type, location- rived from the destination app. The system state can Service_c as object_class, and getLastKnownLocation be directly expressed by booleans and switchBoolean as operation) to achieve fine-grained access control statements in the policy and an according Context on this information. Our policy states that calling Provider. Appendix A provides a concrete policy functions of this object type is prohibited while the example for the instantiation of the above shopping phone is in a security sensitive state. Thus, retrieving app example. accelerometer information or recording audio is not possible when, e.g., the virtual keyboard/PIN pad is in the foreground or a phone call is in progress. 6 Evaluation and Discussion In Section 4.2.3 we explained how ContentProvi- ders (e.g. the ContactsProvider) can act as User- In this section we evaluate and discuss our archi- space Object Managers. As an example, users can tecture in terms of policy design, effectiveness, and refine the system policy to further restrict access to performance overhead. their contacts’ data. A user can, for instance, grant the Facebook app read access to their “friends” and 6.1 Policy “family” contacts’ email addresses and names, while prohibiting it from reading their postal addresses and To evaluate our FlaskDroid architecture, we derived any data of other groups such as “work”. a basic policy that covers the pre-installed system

USENIX Association 22nd USENIX Security Symposium 139 USOMs that we introduced in Section 4.2.3. manually crafted policy containing only the required Policy Assessment. For FlaskDroid we are for now subject/object types, classes and operations for the foremost interested in generating a basic policy to es- USOMs in our architecture, but no allow rules. The timate the access control complexity that is inherent devices were also pre-configured with test accounts to our design, i.e., the number of new types, classes, (e.g., EMail) and test data (e.g., fake contacts). and rules required for the system Userspace Object Managers. This basic policy is intended to lay the Using the logged access control checks from these foundation for the development of a good policy, i.e., trials, we derived 109 access control rules required a policy that covers safety, completeness, and effec- for the correct operation of the system components tiveness properties. However, the development of a (as observed during testing), which we learned to be security policy that fulfills these properties is a highly partially operationally dependent on each other. Our complex process. For instance, on SELinux enabled pre-installed middleware policy contained 111 types systems the policies were incrementally developed and 18 classes for a fine-granular access control to and improved after the SELinux module had been the major system Services and ContentProviders (e.g., introduced, even inducing research on verification of ContactsProvider, LocationManager, PackageManager- these properties [24]. A similar development can be Service, or SensorManager). These rules (together currently observed for the SE Android policies which with the above stated type and object definitions) are written from scratch [48] and we envision induc- constitute our basic policy. Although SELinux poli- ing a similar research on development and verification cies cannot be directly compared to our policy, since of FlaskDroid policies. they target desktop operating systems, the difference Basic Policy Generation. To generate our basic in policy complexity (which is in the order of several policy, we opted for an approach that follows the magnitudes [11]) underlines that the design of mobile 4 concepts of ’ learning phase and operating systems facilitates a clearer mandatory ac- other semi-automatic methods [42]. The underlying cess control architecture (e.g., separation of duties). idea is to derive policy rules directly from observed This profits an easier policy design (as supported by application behavior. To generate a log of system the experiences from [54, 36]). application behavior, we leveraged FlaskDroid’s au- dit mode, where policy checks are logged but not 3rd Party Policies. The derived basic policy can enforced. Under the assumption, that the system rd contained in this auditing phase only trusted apps, act as the basis on top of which additional user, 3 this trace can be used to derive policy rules. party, and use-case specific policies can be deployed (cf. Section 5). In particular, we are currently work- To achieve a high coverage of app functionality ing on extending the basic policy with types, classes and thus log all required access rights, we opted for and allow rules for popular apps, such as Whats- testing with human user trials for the following rea- App or Facebook, which we further evaluated w.r.t. sons: First, automated testing has been shown to user’s privacy protection (cf. Section 6.2). A par- exhibit a potentially very low code coverage [24] and, ticular challenge is to derive policies which on the second, Android’s extremely event-driven and concur- one hand protect the user’s privacy but on the other rent execution model complicates static analysis of hand preserve the intended functionality of the apps. the Android system [56, 24]. However, in the future, Since the user privacy protection strongly depends static analysis based (or aided) generation of access on the subjective security objectives of the user, this control rules is more preferable in order to cover also approach requires further investigation on how the corner-cases of applications’ control-flows. user can be involved in the policy configuration [58]. The users’ task was to thoroughly use the pre- installed system apps by performing various every- day tasks (e.g., maintaining contacts, writing SMS, However, as discussed in Sections 3 and 4.2.2, mul- browsing the Internet, or using location-based ser- tiple policies by different stakeholders with poten- vices). To analyze interaction between apps, a par- tially conflicting security objectives require a recon- ticular focus of the user tasks was to leverage inter- ciliation strategy. Devising a general strategy appli- app functionality like sharing data (e.g., copying cable to all use-cases and satisfying all stakeholders notes from a website into an SMS). For testing, the is very difficult, but use-case specific strategies are users were handed out Galaxy Nexus devices running feasible [44, 29]. In our implementation, we opted for FlaskDroid with a No-allow-rule policy. This is a a consensus approach, which we successfully applied during implementation of our use-cases (cf. Section 5). 4http://tomoyo.sourceforge.jp/2.2/learning.html.en We explained further strategies in Section 4.3.2.

140 22nd USENIX Security Symposium USENIX Association Attack Test gracefully prevented the apps and malware from ac- Root Exploit mempodroid Exploit cessing privacy critical information from sources such App executed by root Synthetic Test App as the ContactsProvider or LocationManager. Over-privileged and Known malware Information-Stealing Synthetic Test App Sensory malware. To mitigate sensory malware Apps WhatsApp v2.8.4313 like TapLogger [53] and TouchLogger [12], we de- Facebook v1.9.1 ployed a context-aware FlaskDroid policy which Sensory Malware Synthetic Test App [53, 12, 46] causes the SensorManager USOM to filter acceler- Confused Deputy Synthetic Test App Collusion Attack Synthetic Test Apps [46] ation sensor information delivered to registered Sen- sorListeners while the on-screen keyboard is active. Table 1: List of attacks considered in our testbed Similarly, a second policy prevents the SoundComber attack [46] by denying any access to the audio record functionality implemented in the MediaRecorderClient 6.2 Effectiveness USOM while a call is in progress. Confused deputy and collusion attacks. At- We decided to evaluate the effectiveness of FlaskDroid tacks targeting confused deputies in system compo- based on empirical testing using the security models nents (e.g. SettingsAppWidgetProvider [41]) are presented in Section 5 as well as a testbed of known addressed by fine-grained access control rules on ICC. malware retrieved from [55, 3] and synthetic attacks Our policy restricts which app types may send (broad- (cf. Table 1). Alternative approaches like static cast) Intents reserved for system apps. analysis [18] would benefit our evaluation but are Collusion attacks are in general more challeng- out of scope of this paper and will be addressed ing to handle, especially when covert channels are separately in future work. used for communication. Similar to the mitigation Root exploits. SE Android successfully mitigates of confused deputies, a FlaskDroid policy was used the effect of the mempodroid attack. While the ex- to prohibit ICC between colluding apps based on ploit still succeeds in elevating its process to root specifically assigned app types. However, to address privileges, the process is still constrained by the un- collusion attacks efficiently, more flexible policies derlying SE Android policy to the limited privileges are required. We already discussed in Section 4.2.4 granted to the root user [48]. a possible approach to instantiate XManDroid [8] Malicious apps executed by root. While SE An- based on our Context Providers and we elaborate in droid constrains the file-system privileges of an app the subsequent Section 6.3 on particular challenges process executed with root UID, this process still for improving the mitigation of collusion attacks. inherits all Permissions at middleware level. In FlaskDroid, the privileges of apps running with this 6.3 Open Challenges and TCB omnipotent UID are restricted to the ones granted by the system policy to root (cf. aid_root_t in Sec- Information flows within apps. Like any other tion 4.2.3). During our user tests, we had to define access control system, e.g., SELinux, exceptions for only one allow rule for the aid_root_t type on the which enforcement falls short concern attacks which middleware layer, which is not surprising, since usu- are licit within the policy rules. Such shortcomings ally Android system or third-party apps are not exe- may lead to unwanted information leakage. A partic- cuted by the root user. Thus, a malicious app gaining ular challenge for addressing this problem and control- root privileges despite SE Android, e.g., using the ling access and separation (non-interference) of secu- mempodroid exploit [48], is in FlaskDroid restricted rity relevant information are information flows within at both kernel and middleware level. apps. Access control frameworks like FlaskDroid Over-privileged and information stealing usually operate at the granularity of application in- apps. We verified the effectiveness of FlaskDroid puts/outputs but do not cover the information flow against over-privileged apps using a) a synthetic test within apps. For Android security, this control can app which uses its permissions to access the Contacts- be crucial when considering attacks such as collusion Provider, the LocationManager and the SensorManager attacks and confused deputy attacks. Specifically for as 3rd party apps would do; b) malware such as An- Android, taint tracking based approaches [19, 28, 45] droid.Loozfon [2] and Android.Enesoluty [1] which and extensions to Android’s IPC mechanism [17] have steal user private information; and c) unmodified been proposed. To which extend these approaches apps from Google Play, including the popular Whats- could augment the coverage and hence effectiveness App messenger and Facebook apps. In all cases, a of FlaskDroid has to be explored in future work. corresponding policy on FlaskDroid successfully and User-centric and scalable policies. While

USENIX Association 22nd USENIX Security Symposium 141 FlaskDroid is a sophisticated access control frame- µ (in µs) σ (in µs) memory (in MB) work for enforcing security policies and is already now valuable in specific scenarios with fixed policies like FlaskDroid No-allow-rule 329.505 780.563 15.673 business phones or locked-down devices [11], a partic- Basic policy 452.916 4887.24 16.184 ular challenge of the forthcoming policy engineering Vanilla Android 4.0.4 are user-centric and scalable policies for off-the-shelf Permission check 330.800 8291.805 15.985 end-user devices. Although expert-knowledge can be used to engineer policies for the static components Table 2: Runtime and memory overhead of the system, similar to common SELinux-enabled distributions like Fedora, an orthogonal, open re- µ (in ms) σ (in ms) search problem is how to efficiently determine the FlaskDroid (Basic policy) 0.452 4.887 individual end-users’ security and privacy require- XManDroid [8] (Amortized) 0.532 2.150 TrustDroid [9] 0.170 1.910 ments and how to map these requirements scalable to FlaskDroid policy rules w.r.t. the plethora of differ- Table 3: Performance comparison to related works ent apps available. To this end, we started exploring approaches to provide the end-user with tools that abstract the underlying policies [10]. Furthermore, Figure 2 presents the cumulative frequency distribu- the policy-based classification of apps at install-time tion for our policy checks. The shaded area represents applied in FlaskDroid could in the future be aug- the 99.33% confidence interval for our basic policy mented by different or novel techniques from related with a maximum overhead of 2ms. fields, e.g., role-mining for RBAC systems [51], to In comparison to closest related work [8, 9] (cf. Sec- assist the end-user in his decision processes. tion 7), FlaskDroid achieves a very similar perfor- Base. Moreover, while mance. Table 3 provides an overview of the aver- SE Android as part of the kernel is susceptible to age performance overhead of the different solutions. kernel-exploits, our middleware extensions might be TrustDroid [9] profits from the very static policies compromised by attacks against the process in which it enforces, while FlaskDroid slightly outperforms they execute. Currently our SecurityServer executes XManDroid [8]. However, it is hard to provide a within the scope of the rather large Android system completely fair comparison, since both TrustDroid server process. Separating the SecurityServer as a and XManDroid are based on Android 2.2 and thus distinct system process with a smaller attack sur- have a different baseline measurement. Both [8, 9] face (smaller TCB) can be efficiently accomplished, report a baseline of approximately 0.18ms for the de- since there is no strong functional inter-dependency fault permission check, which differs from the 0.33ms between the system server and FlaskDroid’s Security- we observed in Android 4.0.4 (cf. Table 2). Server. Kernel layer. The impact of SE Android on An- droid system performance has been evaluated previ- 6.4 Performance Overhead ously by its developers [48]. Since we only minimally add/modify the default SE Android policy to cater Middleware layer. We evaluated the performance for our use-cases (e.g., new booleans), the negligible overhead of our architecture based on the No-allow- performance overhead presented in [48] still applies rule policy and the basic policy presented in Sec- to our current implementation. tion 6.1 using a Samsung Galaxy Nexus device run- ning FlaskDroid. Table 2 presents the mean execu- 7 Related Work tion time µ and standard deviation σ for performing a policy check at the middleware layer in both pol- 7.1 Mandatory Access Control icy configurations (measured in µs) as well as the average memory consumption (measured in MB) of The most prominent MAC solution is SELinux [33] the process in which our Userspace Security Server and we elaborated on it in detail in our Background executes (i.e., the system server). Mean execution and Requirements Sections 2 and 3. Specifically for time and standard deviation are the amortized values mobile platforms, related work [54, 36] has investi- for both cached and non-cached policy decisions. gated the placement of SELinux enforcement hooks In comparison to permission checks on a vanilla in the operating system and user-space services on Android 4.0.4 both the imposed runtime and memory OpenMoko [36] and the LiMo (Linux Mobile) plat- overhead are acceptable. The high standard devia- form [54]. Our approach follows along these ideas tion is explained by varying system loads, however, but for the Android middleware.

142 22nd USENIX Security Symposium USENIX Association responses [58, 15, 28, 8, 9]. Intent MAC protects with a white-listing enforce- ment the delivery of Intents to Activities, Broadcast Receivers, and Services. Technically, this approach is similar to prior work like [58, 8, 9]. The white- listing is based on attributes of the Intent objects (e.g., the value of the action string) and the security type assigned to the Intent sender and receiver apps. In FlaskDroid, we apply a very similar mechanism by assigning Intent objects a security type, which we use for type enforcement on Intents. While we ac- Figure 2: CDF of the performance overhead. Shaded knowledge, that access control on Intents is important area represents the 99.33 confidence interval for for the overall coverage of the access control, Intent checks with Basic policy. MAC alone is insufficient for policy enforcement on inter-app communications. A complete system has Also TOMOYO Linux [27], a path-based MAC to consider also other middleware communications framework, has been leveraged in Android security channels, such as Remote Procedure Calls (RPC) extensions [8][9]. Although TOMOYO supports more to Service components and to ContentProviders. By easily policy updates at runtime and does not require instrumenting these components as USOMs and by extended file system attributes, SELinux is more extending the AIDL compiler (cf. Section 4.2) to sophisticated, supports richer policies, and covers insert policy enforcement points, we address these more object classes [5]. channels in FlaskDroid and provide a non-trivial However, as we state in Section 3, low-level MAC complementary access control to Intent MAC. alone is insufficient. In this paper we show how to Install-time MAC performs, similar to Kirin [20], extend the SE Android security architecture into the an install-time check of new apps and denies installa- Android middleware layer for policy enforcement. tion when an app requests a defined combination of permissions. The adverse permission combinations are defined in the SE Android policy. 7.2 SE Android MMAC While FlaskDroid does not provide an install-time The SE Android project was recently extended by MAC, we consider this mechanism orthogonal to different mechanisms for mandatory access control at the access control that FlaskDroid already provides Android’s middleware layer [47], denoted as MMAC: and further argue that it could be easily integrated Permission revocation is a simple mechanism to into existing mechanisms of FlaskDroid (e.g., by ex- dynamically revoke permissions by augmenting the tending the install-time labeling of new apps with a default Android permission check with a policy driven blacklist-based rejection of prohibited app types). check. When necessary, this additional check over- rules and negates the result of the default check. 7.3 Android Security Extensions However, this permission revocation is in almost all cases unexpected for app developers, which rely In the recent years, a number of security extensions on the fact that if their app has been installed, it to the Android OS have been proposed. has been granted all requested permissions. Thus, Different approaches [38, 37, 15, 39] add manda- developers very often omit error handling code for tory access control mechanisms to Android, tailored permission denials and hence unexpectedly revoking for specific problem sets such as providing a DRM permissions easily leads to application crashes. mechanism (Porscha [38]), providing the user with In FlaskDroid, policy enforcement also effectively the means to selectively choose the permissions and revokes permissions. However, we use USOMs which runtime constraints each app has (APEX [37] and integrate the policy enforcement into the compo- CRePE [15]), or fine-grained, context-aware access nents which manage the security and privacy sensitive control to enable developers to install policies to pro- data. Thus, our USOMs apply enforcement mecha- tect the interfaces of their apps (Saint [39]). Essen- nisms that are graceful, i.e., they do not cause unex- tially all these solutions extend Android with MAC pected behavior that can cause application crashes. at the middleware layer. The explicit design goal of Related work (cf. Section 7.3) introduced some of our architecture was to provide an ecosystem that these graceful enforcement mechanisms, e.g., filter- is flexible enough to instantiate those related works ing table rows and columns from ContentProvider based on policies (as demonstrated in Section 5 at

USENIX Association 22nd USENIX Security Symposium 143 the example of Saint) and additionally providing the evaluation shows that the clear API-oriented design benefit of a consolidated kernel-level MAC. of Android benefits the effective and efficient im- The pioneering framework TaintDroid [19] in- plementation of a generic mandatory access control troduced the tracking of tainted data from sensi- framework like FlaskDroid. ble sources on Android and successfully detected unauthorized information leakage. The subsequent AppFence architecture [28] extended TaintDroid with Availability checks that not only detect but also prevent such The source code for FlaskDroid is available online at unauthorized leakage. However, both TaintDroid http://www.flaskdroid.org. and AppFence do not provide a generic access con- trol framework. Nevertheless, future work could in- vestigate their applicability in our architecture, e.g., References propagating the security context of data objects. The [1] Android.Enesoluty | Symantec. http://www.symantec. general feasibility of such “context propagation” has com/security_response/writeup.jsp?docid=2012- been shown in the MOSES [45] architecture. 082005-5451-99. Inlined Reference Monitors (IRM) [52, 7, 30] place [2] Android.Loozfon | Symantec. http://www.symantec. policy enforcement code for access control directly in com/security_response/writeup.jsp?docid=2012- 3rd party apps instead of relying on a system centric 082005-5451-99. solution. An unsolved problem of inlined monitoring [3] Contagio Mobile. http://contagiominidump.blogspot. in contrast to a system-centric solution is that the de/. reference monitor and the potentially malicious code [4] Gartner Says Worldwide Mobile Phone Sales Declined 1.7 Percent in 2012. http://www.gartner.com/newsroom/ share the same sandbox and that the monitor is not id/2335616. more privileged than the malicious code and thus [5] TOMOYO Linux Wiki: How is TOMOYO Linux dif- prone to compromise. ferent from SELinux and AppArmor? http://tomoyo. The closest related work to FlaskDroid with respect sourceforge.jp/wiki-e/?WhatIs#comparison. to a two layer access control are the XManDroid [8] [6] WhatsApp reads contacts and is breaking and TrustDroid [9] architectures. Both leverage TO- privacy laws. http://www.digitaltrends.com/mobile/ MOYO Linux as kernel-level MAC to establish a sep- whatsapp-breaks-privacy-laws/. arate security domain for business apps [9], or to mit- [7] Backes, M., Gerling, S., Hammer, C., and von Styp- igate collusion attacks via kernel-level resources [8]. Rekowsky, P. Appguard - enforcing user requirements Although they cover MAC enforcement at both mid- on android apps. In 19th International Conference on Tools and Algorithms for the Construction and Analysis dleware and kernel level, both systems support only of Systems (TACAS) (2013), Springer-Verlag. a very static policy tailored to their specific purposes [8] Bugiel, S., Davi, L., Dmitrienko, A., Fischer, T., and do not support the instantiation of different use- Sadeghi, A.-R., and Shastry, B. Towards taming cases. In contrast, FlaskDroid can instantiate the privilege-escalation attacks on android. In NDSS (2012), XManDroid and TrustDroid security models by ad- The Internet Society. justing policies. For instance, different security types [9] Bugiel, S., Davi, L., Dmitrienko, A., Heuser, S., for business and private apps could be assigned at Sadeghi, A.-R., and Shastry, B. Practical and lightweight domain isolation on android. In 1st ACM installation time, and boolean flags can be used to CCS Workshop on Security and Privacy in Mobile De- dynamically prevent two apps from communicating vices (SPSM) (2011), ACM. if this would form a collusion attack. [10] Bugiel, S., Heuser, S., and Sadeghi, A.-R. myTunes: Semantically Linked and User-Centric Fine-Grained Pri- vacy Control on Android. Tech. Rep. TUD-CS-2012-0226, 8 Conclusion Center for Advanced Security Research Darmstadt, Nov. 2012. In this paper, we present the design and implementa- [11] Bugiel, S., Heuser, S., and Sadeghi, A.-R. Towards a tion of FlaskDroid, a policy-driven generic two-layer Framework for Android Security Modules: Extending SE MAC framework on Android-based platforms. We Android Type Enforcement to Android Middleware. Tech. introduce our efficient policy language that is tai- Rep. TUD-CS-2012-0231, Center for Advanced Security Research Darmstadt, December 2012. lored for Android’s middleware semantics. We show the flexibility of our architecture by policy-driven [12] Cai, L., and Chen, H. Touchlogger: inferring keystrokes on touch screen from smartphone motion. In 6th USENIX instantiations of selected security models, including conference on Hot topics in security (HotSec) (2011), related work (Saint) and privacy-enhanced system USENIX Association. components. We demonstrate the applicability of [13] Carter, J. Using gconf as an example of how to create our design by prototyping it on Android 4.0.4. Our an userspace object manager, 2007.

144 22nd USENIX Security Symposium USENIX Association [14] Chin, E., Felt, A. P., Greenwood, K., and Wag- [31] Kostiainen, K., Reshetova, E., Ekberg, J.-E., and ner, D. Analyzing inter-application communication in Asokan, N. Old, new, borrowed, blue – a perspective on Android. In MobiSys (2011), ACM. the evolution of mobile platform security architectures. [15] Conti, M., Nguyen, V. T. N., and Crispo, B. CRePE: In CODASPY (2011), ACM. Context-related policy enforcement for Android. In 13th [32] Lineberry, A., Richardson, D. L., and Wyatt, T. Information Security Conference (ISC) (2010), Springer- These aren’t the permissions you’re looking for. BlackHat Verlag. USA 2010. http://dtors.files.wordpress.com/2010/ 08/blackhat-2010-slides.pdf, 2010. [16] Davi, L., Dmitrienko, A., Sadeghi, A.-R., and Winandy, M. Privilege escalation attacks on Android. [33] Loscocco, P., and Smalley, S. Integrating flexible In 13th Information Security Conference (ISC) (2010), support for security policies into the Linux operating Springer-Verlag. system. In FREENIX Track: USENIX Annual Technical Conference (2001), USENIX Association. [17] Dietz, M., Shekhar, S., Pisetsky, Y., Shu, A., and Wallach, D. S. Quire: Lightweight provenance for [34] Marforio, C., Ritzdorf, H., Francillon, A., and smartphone operating systems. In USENIX Security Capkun, S. Analysis of the communication between col- (2011), USENIX Association. luding applications on modern smartphones. In ACSAC (2012), ACM. [18] Edwards, A., Jaeger, T., and Zhang, X. Runtime verification of authorization hook placement for the Linux [35] McDaniel, P., and Prakash, A. Methods and limita- security modules framework. In CCS (2002), ACM. tions of security policy reconciliation. In S&P (2002), IEEE Computer Society. [19] Enck, W., Gilbert, P., Chun, B.-G., Cox, L. P., Jung, J., McDaniel, P., and Sheth, A. N. TaintDroid: An [36] Muthukumaran, D., Schiffman, J., Hassan, M., information-flow tracking system for realtime privacy Sawani, A., Rao, V., and Jaeger, T. Protecting the monitoring on smartphones. In OSDI (2010), USENIX integrity of trusted applications in mobile phone systems. Association. Security and Communication Networks 4, 6 (2011), 633– 650. [20] Enck, W., Ongtang, M., and McDaniel, P. On lightweight mobile phone application certification. In [37] Nauman, M., Khan, S., and Zhang, X. Apex: Ex- CCS (2009), ACM. tending Android permission model and enforcement with user-defined runtime constraints. In ASIA CCS (2010), [21] Enck, W., Ongtang, M., and McDaniel, P. Under- ACM. standing Android security. IEEE Security and Privacy [38] Ongtang, M., Butler, K., and McDaniel, P. Porscha: Magazine 7 (2009), 50–57. Policy oriented secure content handling in Android. In [22] F-Secure Labs. Mobile Threat Report: Q3 2012, 2012. ACSAC (2010), ACM. [23] Federal Trade Commission. Path social networking [39] Ongtang, M., McLaughlin, S., Enck, W., and Mc- app settles FTC charges it deceived consumers and im- Daniel, P. Semantically rich application-centric security properly collected personal information from users’ mobile in Android. In ACSAC (2009), IEEE Computer Society. address books. http://www.ftc.gov/opa/2013/02/path. [40] Porter Felt, A., Finifter, M., Chin, E., Hanna, S., , Jan. 2013. shtm and Wagner, D. A survey of mobile malware in the [24] Gilbert, P., Chun, B.-G., Cox, L. P., and Jung, J. wild. In 1st ACM workshop on Security and privacy in Vision: automated security validation of mobile apps at smartphones and mobile devices (SPSM) (2011), ACM. app markets. In 2nd international workshop on Mobile [41] Porter Felt, A., Wang, H., Moshchuk, A., Hanna, cloud computing and services (MCS) (2011), ACM. S., and Chin, E. Permission re-delegation: Attacks [25] Grace, M. C., Zhou, W., Jiang, X., and Sadeghi, A.-R. and defenses. In USENIX Security (2011), USENIX Unsafe exposure analysis of mobile in-app advertisements. Association. In WiSec (2012), ACM. [42] Provos, N. Improving host security with [26] Guttman, J. D., Herzog, A. L., Ramsdell, J. D., and policies. In USENIX Security (2003), USENIX Associa- Skorupka, C. W. Verifying information flow goals in tion. security-enhanced linux. Journal on [43] Rao, V., and Jaeger, T. Dynamic mandatory access 13, 1 (Jan. 2005), 115–134. control for multiple stakeholders. In SACMAT (2009), [27] Harada, T., Horie, T., and Tanaka, K. Task Oriented ACM. Management Obviates Your Onus on Linux. In Linux [44] Reeder, R. W., Bauer, L., Cranor, L. F., Reiter, Conference (2004). M. K., and Vaniea, K. More than skin deep: measuring [28] Hornyack, P., Han, S., Jung, J., Schechter, S., and effects of the underlying model on access-control system Wetherall, D. These aren’t the droids you’re looking usability. In International Conference on Human Factors for: retrofitting android to protect data from imperious in Computing Systems (CHI) (2011), ACM. applications. In CCS (2011), ACM. [45] Russello, G., Conti, M., Crispo, B., and Fernandes, [29] Hu, H., Ahn, G.-J., and Kulkarni, K. Detecting and E. MOSES: supporting operation modes on smartphones. resolving firewall policy anomalies. IEEE Transactions on In SACMAT (2012), ACM. Dependable and Secure Computing 9, 3 (2012), 318–331. [46] Schlegel, R., Zhang, K., Zhou, X., Intwala, M., [30] Jeon, J., Micinski, K. K., Vaughan, J. A., Fogel, Kapadia, A., and Wang, X. Soundcomber: A stealthy A., Reddy, N., Foster, J. S., and Millstein, T. Dr. and context-aware sound trojan for smartphones. In Android and Mr. Hide: Fine-grained security policies on NDSS (2011), The Internet Society. unmodified Android. In 2nd ACM CCS Workshop on [47] Smalley, S. Middleware MAC for android. http:// Security and Privacy in Mobile Devices (SPSM) (2012), kernsec.org/files/LSS2012-MiddlewareMAC.pdf, Aug. ACM. 2012.

USENIX Association 22nd USENIX Security Symposium 145 [48] Smalley, S., and Craig, R. Security Enhanced (SE) Listing 3: Policy deployed by the shopping app, show- Android: Bringing Flexible MAC to Android. In NDSS ing an instantiation of the Saint [39] runtime policy (2013), The Internet Society. example. [49] Smith, C. Privacy flaw in android app 1 type app_trustedPayApp_t; exposed. http://www.t3.com/news/privacy-flaw-in- 2 type app_trustedPWVault_t; skype-android-app-exposed/. 3 type app_noInternetPerm_t; [50] Spencer, R., Smalley, S., Loscocco, P., Hibler, M., 4 Andersen, D., and Lepreau, J. The Flask security 5 type intent_actionPay_t; architecture: System support for diverse security policies. 6 type intent_recordExpense_t; In USENIX Security (1999), USENIX Association. 7 [51] Vaidya, J., Atluri, V., and Warner, J. RoleMiner: 8 appType app_trustedPayApp_t { mining roles using subset enumeration. In CCS (2006), 9 Developer:signature=308201...; }; ACM. 10 11 app_trustedPWVault_t { [52] Xu, R., Saïdi, H., and Anderson, R. Aurasium: Prac- appType 12 Package:package_name=com.secure.passwordvault; tical policy enforcement for android applications. In 13 Package:min_version=1.2; }; USENIX Security (2012), USENIX Association. 14 [53] Xu, Z., Bai, K., and Zhu, S. Taplogger: inferring 15 appType app_noInternetPerm_t { user inputs on smartphone touchscreens using on-board 16 Package:permission=~android.permission.INTERNET; }; motion sensors. In WiSec (2012), ACM. 17 [54] Zhang, X., Seifert, J.-P., and Acıiçmez, O. SEIP: 18 intentType intent_actionPay_t { simple and efficient integrity protection for open mobile 19 Action:action_string=ACTION_PAY; platforms. In International conference on Information 20 Components:receiver_type=app_trustedPayApp_t; }; and communications security (ICICS) (2010), Springer- 21 Verlag. 22 intentType intent_recordExpense_t { [55] Zhou, Y., and Jiang, X. Dissecting android malware: 23 Action:action_string=RECORD_EXPENSE; Characterization and evolution. In S&P (2012), IEEE 24 Components:receiver_type=app_noInternetPerm_t; }; Computer Society. 25 26 allow self_t intent_actionPay_t: intent_c { send }; [56] Zhou, Y., and Jiang, X. Detecting passive content leaks 27 allow self_t app_trustedPWVault_t: any { any }; and pollution in android applications. In NDSS (2013), 28 allow self_t intent_recordExpense_t: intent_c { send }; The Internet Society. [57] Zhou, Y., Wang, Z., Zhou, W., and Jiang, X. Hey, You, Get Off of My Market: Detecting Malicious Apps B Userspace Object Managers in Official and Alternative Android Markets. In NDSS (2012), The Internet Society. [58] Zhou, Y., Zhang, X., Jiang, X., and Freeh, V. W. USOM Example operations Taming information-stealing smartphone applications (on Service USOMs android). In TRUST (2011), Springer-Verlag. PackageManagerService getPackageInfo findPre- ferredActivity getInstalledAp- A Concrete Instantiation of Saint plications installPackage ActivityManagerService startActivity moveTask gran- policies with FlaskDroid tURIPermission sendBroadcast registerBroadcastReceiver Listing 3 shows an instantiation of the developer pol- AudioService setStreamVolume setVibrate- icy in [39] on FlaskDroid. This policy is deployed by Setting PowerManagerService acquireWakeLock isScreenOn the shopping app and thus self_t refers to the shop- reboot preventScreenOn ping app. We define types app_trustedPayApp_t, SensorManager getSensorList getDefaultSensor app_trustedPayApp_t, app_noInternetPerm_t LocationManagerService requestLocationUpdates (lines 1-3 and lines 8-16) for the specific apps addProximityAlert getLast- KnownLocation the shopping app is allowed to interact with SMSManager copyMessageToIcc deleteMes- and describe some of the allowed interactions by sageFromIcc sendTextMessage means of Intent types intent_actionPay_t and TelephonyManager getCellLocation getDeviceId intent_recordExpense_t (lines 5-6 and lines getCellLocation 18-24). Afterwards, we declare access control rules ContentProvider USOMs that reflect the policy described in [39] (lines 26-28). ContactsProvider2 query insert update delete writeAccess readAccess For instance, the rule in line 26 defines that the MMSSMSProvider query insert update delete shopping app is allowed to send an Intent with TelephonyProvider query insert update delete action string ACTION_PAY only to an app with type SettingsProvider query insert update delete app_trustedPayApp_t (line 20), which in turn is only assigned to apps with the developer signature Table 4: Exemplary System USOMs 308201... (line 9).

146 22nd USENIX Security Symposium USENIX Association