2014 IEEE Symposium on Security and Privacy Upgrading Your Android, Elevating My Malware: Privilege Escalation Through Mobile OS Updating Luyi Xing∗, Xiaorui Pan∗, Rui Wang†, Kan Yuan∗ and XiaoFeng Wang∗ ∗Indiana University Bloomington Email: {luyixing, xiaopan, kanyuan, xw7}@indiana.edu †Microsoft Research Email:
[email protected] Abstract—Android is a fast evolving system, with new updates arise about their security implications, which have never been coming out one after another. These updates often completely studied before. overhaul a running system, replacing and adding tens of thou- sands of files across Android’s complex architecture, in the New challenges in mobile updating. Security hazards that presence of critical user data and applications (apps for short). come with software updates have been investigated on desktop To avoid accidental damages to such data and existing apps, OSes [45], [37]. Prior research focuses on either compromises the upgrade process involves complicated program logic, whose of patches before they are installed on a target system [26] security implications, however, are less known. In this paper, or reverse-engineering of their code to identify vulnerabilities we report the first systematic study on the Android updating mechanism, focusing on its Package Management Service (PMS). for attacking unpatched systems [40]. The reliability of patch Our research brought to light a new type of security-critical installation process has never been called into question. For a vulnerabilities, called Pileup flaws, through which a malicious mobile system, this update process tends to be more complex, app can strategically declare a set of privileges and attributes on due to its unique security model that confines individual apps a low-version operating system (OS) and wait until it is upgraded within their sandboxes and the presence of a large amount to escalate its privileges on the new system.