Security to Android Mobile Applications: Camera Based

ISSN 2319-8885 Vol.04,Issue.29, August-2015,

Pages:5534-5539

www.ijsetr.com

Security to Android Mobile Applications: Camera Based Security and Theft Alert Mobile Phones 1 2 3 SANA SULTANA , G.VEERANJANEYULU , SALEHA FARHA 1PG Scholar, Dept of CSE, Shadan Women’s College of Engineering and Technology, Hyderabad, TS, India, E-mail: [email protected]. 2Professor, Dept of CSE, Shadan Women’s College of Engineering and Technology, Hyderabad, TS, India, E-mail: [email protected]. 3HOD, Dept of CSE, Shadan Women’s College of Engineering and Technology, Hyderabad, TS, India, E-mail: [email protected].

Abstract: Now Smartphone’s are simply small computers with added services such as GSM, radio. Thus it is true to say that next generations of operating system will be on these Smartphone and the likes of windows, IOS and android are showing us the glimpse of this future. Android has already gained significant advantages on its counterparts in terms of market share. One of the reason behind this is the most important feature of Android is that it is open-source which makes it free and allows any one person could develop their own applications and publish them freely. This openness of android brings the developers and users a wide range of convenience but simultaneously it increases the security issues. The major threat of Android users is Malware infection via Android Application Market which is targeting some loopholes in the architecture mainly on the end-users part. Attackers can implement spy cameras in malicious apps such that the phone camera is launched automatically without the device owner’s notice, and the captured photos and videos are sent out to these remote attackers. Nowadays, people carry their phones everywhere; hence, their phones see lots of private information. If the phone camera is exploited by a malicious spy camera app, it may cause serious security and privacy problems. Specifically, we discover several new attacks that are based on the use of phone cameras. We implement the attacks on real phones, and demonstrate the feasibility and effectiveness of the attacks. Furthermore, we propose a lightweight defense scheme that can effectively detect these attacks.

Keywords: Camera Based Attacks, Watch Dog, anti-Thief.

I. INTRODUCTION malicious software written by network hackers causing harm Mobile phones are becoming important part of our day to to its privacy. This demands the study of the Security day life specially the smart phones, since they are involved in Mechanisms for Android and on the way make it simple and keeping in touch with friends and family, doing business, user understandable making the user aware of areas where he accessing the internet and other activities. Android is a has to be careful. modern mobile platform that was designed to be truly open. Android applications make use of advanced hardware and It indicates that smart phone sales are continuously on rise software, as well as local and served data, exposed through and more and more people are becoming dependent on these the platform to bring innovation and value to consumers devices. As these smart phones are going to outnumber the Developed by the Open Handset Alliance (visibly led by world’s total population in 2014, securing these devices has Google), based on Linux platform, Android is a widely assumed paramount importance. Owners use their smart anticipated open source operating system for mobile devices phones to perform tasks ranging from everyday that provides a base operating system, an application communication with friends and family to the management middleware layer, a Java software development kit (SDK), of banking accounts and accessing sensitive Work related and a collection of system applications. The widespread data. These factors, combined with limitations in usage of mobile devices and its increasing functionalities has administrative device control through owners and security made both enterprises and consumers to rely on these devices critical applications like the banking transactions, make for their daily life. The most innovative feature of Android Android-based Smart phones a very attractive target for OS is open source because of which anybody can publish hackers, attackers and malware authors with almost any kind their applications freely on the android market. This openness of motivation. In this article we have focus on two crucial brings large number of developers which use this platform, parts such as follows: but here comes the risk that user is may download and use a

SANA SULTANA, G.VEERANJANEYULU, SALEHA FARHA  To implement an android based attacks detection and 2. Application Framework Layer: This layer is developed prevention system from camera based attacks on mobile specifically for allowing developers full access to the core phone. And demonstrate the feasibility and application framework used by the API. It consists of a range effectiveness of the attacks detection and prevention. of services and system structure which include Active  To develop an application such that when a user loses Manager, Windows Manager, View system, Contents his/her phone, the spy camera could be launched via Provider, Package Manager, Resource Manage, and so on. remote control and capture what the thief looks like as well as the surrounding environment. Then the pictures or videos along with location information (GPS coordinates) can be sent back to the device owner so that the owner can pinpoint the thief and get the phone back.

This paper is organized as, first overview of android OS, its architecture and describes the multi layer structure which starts with a Linux core, structure of android security & its vulnerabilities’ and study the malware threats present for the android OS. Limitation of security model, then in the end future of android security.

II. EXISTING AND PROPOSED SYSTEMS A. Existing System The Android permission system gives users an opportunity to check the permission request of an application (app) before installation, few users have knowledge of what all these permission requests stand for; as a result, they fails to warn users of security risks. Meanwhile, an increasing number of apps specified to enhance security and protect user privacy have appeared in Android app markets. In addition, there are data protection apps that provide users the capability to encrypt, decrypt, sign, and verify signatures for private texts, emails, and files. Fig.1. Android Architecture (from Top to Bottom are Application, Application Framework, Libraries & B. Proposed System Android Runtime and Linux Kernel). We design a further checking mechanism for third party camera-based apps. Analyzing activity pattern is an effective 3. Libraries and Android Run-time Layer: This layer is approach in malware detection. For each type of spy camera mainly associated with the process running. The core library attack, we are able to extract a specific feature from its provides most of the features of Java programming language. activity pattern. The activity pattern of spy camera apps is Additionally, each program of Android has a separate totally different from legitimate camera apps. The defense Dalvik’s Java virtual machine environment. app is able to decide the dynamic launch pattern of camera related apps by polling the task list. If a camera app calls a 4. The fourth layer - Linux kernel: Kernel of Android is camera in one of the above situations, the defense app gives Linux 2.6 core which, Similar to a desktop computer running warnings to the phone user. This process is detected by the Linux, the Android kernel will take care of power and defense app, and a warning message with its name is memory management, device drivers, process management, displayed before the user enters his/her credentials. networking, and security. The Android kernel is available at http://android.git.kernel.oro III. STRUCTURE OF ANDROID A. Architecture B. Security Mechanism in Android With the steady improvement in the android the basic As we can see the multi layer architecture of android each Android System Architecture and Application frameworks layer have to deal with its own problem and there prevention remains the same as follows: mechanism such as Android provides following security features to achieve these objectives by robust security at the 1. Application Layer: The application component of the operating system level through the Linux kernel, a Android operating system is the closest to the end user. This compulsory application sandbox for all applications, a Secure is where the Contacts, Phone, Messaging, and Angry Birds interposes communication, Application permission apps live. As a developer, your finished product will execute mechanism, and Application signing. Techniques of Linux in this space by using the API libraries and the Dalvik VM security, Dalvik JVM and application specific security this includes a core application package, such as Email mechanisms are tabulated as follows, But these prevention Client, Web Browser etc measures can be broadly classified into 3 types

International Journal of Scientific Engineering and Technology Research Volume.04, IssueNo.29, August-2015, Pages: 5534-5539 Security to Android Mobile Applications: Camera Based Security and Theft Alert Mobile Phones  Privilege Separation (Sandboxing) Mechanism execute. Any certification authority to sign the certificate is  Application Permission Mechanism not required, and Android will happily run any application  Signature Mechanism that has been signed with a self-signed certificate. But Like permissions checks, the certificate check is done only during installation of the application. Therefore, if your developer certificate expires after your application is installed on the device, then the application will continue to execute.

C. Vulnerabilities in Android Security The major threats to the android users are the malware present in the open market. They deify the internal security measure and use the loop hole in the security architecture of android, To attack the most insecure part of any system in this case the common user, the simple way of attack is the malware by posing as any other android application getting Fig.2. Android System Security Mechanism installed by user permission and then harming the user. But what causes this, is it the Openness of code or the free market 1. Privilege Separation (sandboxing): The Android or device makers policies are some of the reasons for platform takes advantage of the Linux user-based protection malware attack. The source code of android is freely as a means of identifying and isolating application resources. available to everyone making more susceptible OS to attack The kernel implements a privilege separation model i.e. than other os as IOS or Windows that hold their source code sandbox when it comes to executing applications. This means (or significant portions of it) closely guarded. The open that, like on a UNIX system, the Android operating system market comes with question that what should be trusted and requires every application to run with its own user identifier what it’s not android apps are available everywhere making it (uid) and group identifier (gid). Parts of the system challenge to monitor them. A app can be translated to local architecture themselves are separated in this fashion. This language to make it more likable to user by adding malicious ensures that applications or processes have no permissions to component to attack user. Maker’s policies also plays role in access other applications or processes. Because the kernel android with the questions like where to download patches implements privilege separation, it is one of the core design and update the OS as the policy defers maker to maker. The features of Android. The philosophy behind this design is to various approaches used by the hackers to attack android ensure that no application can read or write to code or data of device are as follows: other applications, the device user, or the operating system itself. This prevents other application from accessing the 1. Repackaging is one of the most common techniques private information of the application. Unauthorized access malware authors use to piggyback malicious payloads into to hardware features like GPS, camera or network popular applications (or simply apps). In essence, malware communication can be prevented using this sandboxing authors may locate and download popular apps, disassemble mechanism. As two processes have run in their own them, enclose malicious payloads, and then re-assemble and sandboxes, the only way they have to communicate with each submit the new apps to official and/or alternative Android other is to explicitly request permission to access data thus Markets. Users could be vulnerable by being enticed to reinsuring privilege separation. download and install these infected apps.

2. Application Permission Mechanism: When installing 2. Update Attack The first technique typically piggybacks new application, Android prompts the user with the declared the entire malicious payloads into host apps, which could permissions required by the application. The user must grant potentially expose their presence. The second technique all the requested permissions, in order to install the makes it difficult for detection. Specifically, it may still application. The only possibility for not granting the repackage popular apps. But instead of enclosing the payload permissions is not to install the application. Once the as a whole, it only includes an update component that will permissions are granted and the application is installed it fetch or download the malicious payloads at runtime cannot request for further permissions and the user cannot change these permissions, except by uninstalling the 3. Drive-by Download The third technique applies the application from the device. As a result of granting traditional drive-by download attacks to mobile space. permission to an application, the application can unrestricted Though they are not directly exploiting mobile browser access the respective resources. In the current security model, vulnerabilities, they are essentially enticing users to it is not possible to provide any check on the usage of a download ―interesting‖ or ―feature-rich‖ apps. for example resource. This is a major limitation of current security model. when a user clicks a special advertisement link, it will redirect the user to a malicious website, which claims to be 3. Application Code Signing: Any application that is to run analyzing the battery usage of user’s phone and will redirect on the Android operating system must be signed. Android the user to one fake Android Market to download an app uses the certificate of individual developers in order to claimed to improve battery efficiency. Unfortunately, the identify them and establish trust relationships among the downloaded app is not one that focuses on improving the various applications running in the operating system. The operating system will not allow an unsigned application to International Journal of Scientific Engineering and Technology Research Volume.04, IssueNo.29, August-2015, Pages: 5534-5539

SANA SULTANA, G.VEERANJANEYULU, SALEHA FARHA efficiency of battery, but a malware that will subscribe to a made concrete as per the new trends. It is seen the premium-rate service without user’s knowledge. refinements that need to be done in current security models. Hence next work could be to build a security mechanism that D. Limitations in Android Security Model could take care of issues that we’ve discussed that would Smartphone is security is somewhat sensitive topic than our refine the permission mechanism to avoid monitor normal PC protection because the simple fact that the data on unnecessary access to the resources. Many new frameworks our phone is more important to use and contain more like MADAM a multi-level anomaly detector for android important data to the, hence the User need to be more aware malware which concurrently monitors Android at the kernel about the limitation of the current security model. The level and user-level to detect real malware infections help in android sandbox is app specific it inform user about the making android secure .It is clear that user involvement is permission they need user can accept or reject but the greater & important in android security than other mobile rejection means not installation. The major disadvantage to phone platform hence user should be made aware of the basic signature mechanism is that a developer can publish possible threats at the beginning of his android experience. application to the Android market after a self-signing. As Further various frameworks like KIRIN, Scan Droid, Saint, absence of central of authority this does not require any and Apex also purposed. certifying authority i.e., developer can use self-created certificates to sign their applications. Since there is no central IV. IMPLEMENTATION AND EVALUATION Certification Authorities in Android, it is very difficult to We have implemented the remote-controlled real-time scrutinize and/or block applications coming from unreliable monitoring and pass code inference attacks on real phones sources. This process can be exploited to trick an average including the Nexus S 4G (Android 4.1), Galaxy Nexus user to avoid the warning messages at time of installation the (Android 4.2), and Nexus 4 (Android 4.3 with Security permission model discussed previously core mechanism for Enhanced support). For pass code inference attacks, a securing access to various resources in Android. Although computer vision technique for eye tracking is used to process the permissions are categorized to different protection level the captured video. The evaluation of the feasibility and such as Normal, Dangerous, Signature and Signature or effectiveness of the attacks is based on the experimental System but the assignment of these protection levels are left results. to the developers will and own understanding. This leads to a number of vulnerabilities in the permission model. Some of Table1. Pass code inference results for four-digit pass the vulnerabilities in the existing permission model arise codes from the concept of shared user-ID mechanism.

The shared user-ID feature allows one application to leverage the granted permissions to another application sharing the same user-ID. In other words when an application with a shared user-ID is installed on the mobile device, all of its granted permissions is attributed to the user-ID. This way, a combined set of permissions will be granted to the applications sharing the same user-ID. Since both applications are installed with a same shared user-ID, each one can enjoy access to both the resources. The applications are capable of reading user’s credentials and sending it via the Internet to any host without the knowledge of the user. However, many applications available in the Android market have declared both the permissions regardless of their need of these permissions that can lead to possible misuse of the respective resources. Some of the vulnerabilities like battery draining, Denial of Service attacks (DoS) and Distributed Denial of Service attacks (DDoS) i.e., denying placing phone calls to nonemergency numbers, application termination, and the misuse of billable services such as MMS / SMS messages and phone calls, etc., are examples of some of the prominent attacks on smart phones for a detail study about these attacks and their possible solution.

E. Recent Trends in Android To avoid the malware attack Google itself provide cloud services such as Google Play which is collection of services that allow user to discover ,install or buy application on their android device in addition it provide community review application license verification , application security scanning and other security services, Security Mechanisms need to be

International Journal of Scientific Engineering and Technology Research Volume.04, IssueNo.29, August-2015, Pages: 5534-5539 Security to Android Mobile Applications: Camera Based Security and Theft Alert Mobile Phones A. Implementation digit PIN for screen unlocking. Hence, in our experiments we Both camera-based attacks are successfully implemented choose a four-digit pattern/PIN for testing. on Android phones equipped with a front-face camera. The spy camera apps are completely translucent to phone users C. Performance Evaluation and work without causing any abnormal experiences. When We process videos containing user eye movement with the Wi-Fi access is enabled, the captured data is transmitted to aforementioned computer vision technique [11]. Due to the the attacker via a local HTTP server or email. To test the tight configuration of the virtual keyboard and limitation of stealthiest of the attacks, we install two popular antivirus visible spectrum imaging, the performance of inferring a apps: AVG antivirus and Norton Mobile Security. Neither of conventional password is poor and unstable. However, the the two antivirus apps has reported warning during the entire possibility of compromising patterns and PINs is shown to be video capturing and transmission process. This demonstrates much higher. In our evaluation, 18 groups of 4-digit pass their resistance to mobile antivirus tools. codes were tested, and the results are listed in Table 1. In Table 1, each group consists of three components: real pass B. Feature Analysis of the Pass code Inference Attack code (Real Psscd), eye movement, and possible pass codes An important feature that enhances the effectiveness of a (possible Psscds). Since the shape of the 9-dot pattern keypad pass code inference attack is that it can be launched and 10-digit PIN keypad is similar to a square, the results of repeatedly, which allows certain pass codes to be ―attacked‖ eye movement are drawn in a square. Therefore, position many times. In this way, an attacker could get a set of projection can be used to infer input keystrokes. We find that possible pass codes and keep launching attacks until the in some cases, the correct pass code can be inferred correct one is found. The pass code inference attack depends accurately, while in other cases, it is in a small group of on the victim’s eye movement instead of analyzing videos possible pass codes. For example, from the first row in Table containing the screen [5] or its reflection [6], which makes it 1, pass code 1459 can be directly inferred, while 1687 and harder to achieve high and stable one-time success rates. In 1450 both have three candidates. The attacker could further addition, there are complex factors that may influence its narrow down the possible pass code set by launching more performance, such as the distance between face and phone, attacks and finding out the intersection. Furthermore, when lighting conditions, velocity of eye movements, pause time the owner is not using the phone, the attacker may try on each key, and head/device shaking when typing. Among different possible pass codes and see which one works. these experimental conditions, only the lighting condition can be kept constant during our experiments. V. CONCLUSION Now days more than 1 million Android device activated Android has very few restrictions for developer, increases the security risk for end users. In this paper we have reviewed security issues in the Android based Smartphone. The integration of technologies into an application certification process requires overcoming logistical and technical challenges. Android provides more security than other mobile phone platforms. We discover several advanced spy camera attacks, including the remote-controlled real-time monitoring attack and two types of pass-code inference attacks. We propose an effective defense scheme to secure a smart phone from all these spy camera attacks. As well as we have found some of the security issues related to the lost of mobile device or theft of mobile device, so we are going to develop the secure scheme for that also using GPS location tracking and capturing video recordings remotely. This paper analyzes the security mechanism the most widely used open source smart phone platform Android. Discussed security mechanisms and there limitation. Malware are the major Fig.3. Defense against spy camera attack threat to the android user, the best way to their installation phase. To test the effectiveness of the pass code inference attacks with different types of pass codes, we use the conventional VI. REFERENCES password, pattern, and PIN in our experiments. By [1] Longfei Wu and Xiaojiang Du, Xinwen Fu, ―Security comparing the rules of pattern and PIN, we find that pattern Threats to Mobile Multimedia Applications: Camera-Based combination is actually a subset of PIN. In addition, the Attacks on Mobile Phones‖, IEEE 2014. outlines of the two pass codes are similar (both are squares). [2] Y. Zhou and X. Jiang, ―Dissecting Android Malware: Hence, we present their results and discuss their performance Characterization and Evolution,‖ IEEE Symp. Security and together. Another consideration for experiments is the length Privacy 2012, 2012, pp. 95–109. of pattern and PIN. In fact, people rarely use long PINs and [3] R. Schlegel et al., ―Sound comber: A Stealthy and complex patterns since they are hard to memorize and Context-Aware Sound Trojan for Smart phones,‖ NDSS, impractical for frequent authentications such as screen 2011, pp. 17–33. unlocking. This can be best illustrated by Apple iOS’s four- International Journal of Scientific Engineering and Technology Research Volume.04, IssueNo.29, August-2015, Pages: 5534-5539

SANA SULTANA, G.VEERANJANEYULU, SALEHA FARHA [4] N. Xu et al., ―Stealthy Video Capture: A New Video- Based Spyware in 3g Smart phones,‖ Proc. 2nd ACM Conf. Wireless Network Security, 2009, pp. 69–78. [5] F. Maggi, et al., ―A Fast Eavesdropping Attack against Touch screens,‖ 7th Int’l. Conf.Info. Assurance and Security, 2011, pp. 320–25. [6] R. Raguram et al., ―ispy: Automatic Reconstruction of Typed Input from Compromising Reflections,‖ Proc. 18th ACM Conf. Computer and Commun. Security, 2011, pp. 527–36. [7]―Android-eye,‖ https://github.com/Teaonly/ android-eye, 2012. [8]―Nanohttpd,‖ https://github.com/NanoHttpd/ nanohttpd. [9] A. P. Felt and D. Wagner, ―Phishing on Mobile Devices,‖ Proc. WEB 2.0 Security and Privacy, 2011. [10] D. Li, D. Winfield, and D. Parkhurst, ―Starburst: A Hybrid Algorithm for Video-Based Eye Tracking Combining Feature-Based and Model-Based Approaches,‖ IEEE Computer Soc. Conf. Computer Vision and Pattern Recognition — Workshops, 2005, p. 79. [11] P. Aldrian, ―Fast Eye tracking,‖ http://www.mathworks. Com/matlabcentral /file exchange/25056-fast-eyetracking, 2009.

Author’s Profile: Ms. Sana Sultana has completed her B.Tech in Information Engineering from Shadan Womens College of Engineering and Technology, JNTU, Hyderabad. Presently, she is pursuing her Masters in Computer Science Engineering from Shadan Women’s College of Engineering and Technology, Hyderabad, T.S, India. Her research interests include Secure Wireless Mobile Computing.

Dr G.Veeranjaneyulu has completed M.Sc (Computer Science) from S.V.U, M.Tech (Computer Science) from JNRV University, Udaipur, Rajasthan and Ph.D (ComputerScience Engineering) from A.N University, Guntur, AP. He is having 16 years of experience in teaching field. Currently, he is working as an Professor of CSE Department in Shadan Women’s College of Engineering and Technology, Hyderabad, T.S, India.

Ms Saleha Farha has completed her B.Tech (Computer Science Engineering) from JNTU and M.Tech (Computer Science Engineering) from JNTU, Hyderabad. She has 5 years working experience in teaching field. Currently working as HOD of CSE department in Shadan Women’s College of Engineering and Technology, Hyderabad, T.S, India.

International Journal of Scientific Engineering and Technology Research Volume.04, IssueNo.29, August-2015, Pages: 5534-5539