Memory Forensics of Insecure Android Inter-App Communications
Total Page:16
File Type:pdf, Size:1020Kb
Memory Forensics of Insecure Android Inter-app Communications Mark Vella and Rachel Cilia Department of Computer Science, University of Malta, Msida, Malta mark.vella, rachel.cilia.13 @um.edu.mt { } Keywords: Mobile Systems Security, Android Memory Forensics, Capability Leaks. Abstract: Android is designed in a way to promote the implementation of user task flows among multiple applications inside mobile devices. Consequently, app permissions may be leaked to malicious apps without users noticing any compromise to their devices’ security. In this work we explore the possibility of detecting insecure inter- app communications inside memory dumps, with forensic analysis results indicating the possibility of doing so across the various layers of Android’s architecture. Yet, for the detailed evidence reconstruction that could be required during digital investigation, current capabilities have to be complemented with evidence collected through live forensics. We propose that this process should still be based on carving forensic artifacts directly from memory. 1 INTRODUCTION live forensics approach would be necessary. There- fore we conclude this work (section 6) with a propo- sition that relies on collecting evidence directly from Android, the most popular mobile device operating live memory on-demand, using runtime patching. system, is designed in a way to both isolate poten- tially security-critical apps from each other as well as to have apps seamlessly delegate their functional- ity to third-parties (Elenkov, 2014). Clearly these two 2 ANDROID INTER-APP design objectives are at odds, leading to various in- COMMUNICATION secure inter-app communication links such as when vulnerable apps leak their legitimately granted privi- Android apps are composed of classes that extend leges to malicious ones, known as capability leaks. In framework components, namely: activities (app win- this work we begin to explore how to expose inter-app dows), services (long running, mostly background, links directly from physical memory; which is a tech- code), broadcast receivers (handlers of device-wide nique that does not have to rely on possibly tampered events) and content providers (shared data reposito- code, and which successfully executing malware can- ries); eventually fleshed out with application logic not evade. The value proposition is that of increased that makes use of Android system services, e.g. mes- systems security of Android-powered mobile devices. saging, telephony, Internet-access, location services Android’s Binder is the inter-process communica- and so on (Gargenta, 2012). The first three of these tion mechanism through which all inter-app links are components are activated through intents whilst the established (section 2). Code comprehension is uti- latter through content resolvers. lized to predict the relevant forensic artifacts across Intents are application framework constructs rep- Android’s architectural layers (section 3). Our pri- resenting the ‘intent’ion of an application component mary contribution lies in proposing a memory dump to provide some functionality. Intent-servicing com- parsing algorithm for each layer (section 4) and sub- ponents can even be exported for use by external ap- sequently used to verify artifact suitability through plications, thereby constituting a primary IPC con- forensic analysis (section 5). Results show that by struct. Explicit intents identify specifically the target combining artifacts identified within different sec- apps hosting the activities/services to be activated in tions of memory, all types of inter-app links can be correspondence to the specified intent action (listing disclosed from memory dumps despite varying de- 1). On the other hand, implicit intents only identify grees of reliability. However for the level of detail the action and possibly some other attributes (listing that may be required during digital investigation, a 2). In this case Android takes care of routing them to 481 Vella, M. and Cilia, R. Memory Forensics of Insecure Android Inter-app Communications. DOI: 10.5220/0006215504810486 In Proceedings of the 3rd International Conference on Information Systems Security and Privacy (ICISSP 2017), pages 481-486 ISBN: 978-989-758-209-7 Copyright c 2017 by SCITEPRESS – Science and Technology Publications, Lda. All rights reserved ICISSP 2017 - 3rd International Conference on Information Systems Security and Privacy those apps that would have declared interest in servic- missions, also have the sufficient privilege level ing them during install time, also possibly asking the to access the device’s contacts (e.g. by calling user to choose between multiple such candidate apps. Context.checkCallingPermission()). Otherwise On the other hand, content resolvers provide access to a capability leak is said to occur whenever an unpriv- external content providers. ileged app obtains contacts through it (Zhang et al., 2016). In this work we focus specifically on Intent- Listing 1: Explicit intents are used to launch activities or derived leaks, given that content resolvers should nor- services inside external applications. mally be used to directly access system/external data //Starting an external activity: repositories only, rather than potentially permission- PackageManager pm = t h i s .getPackageManager() ; leaking code. t r y { Listing 3: Vulnerable app’s AndroidMainfest.xml. Intent it = pm.getLaunchIntentForPackage(” com.example.mvella. eiserver”); 1 i f ( n u l l != i t ) t h i s .startActivity(it); .. 2 <package name=”com.example. mvella .vulnapp” SNIP . codePath =”...SNIP... 3 <uses permission android:name=”android. − //Starting an external service: permission .READ CONTACTS”/> 4 <uses permission android:name=”android. Intent intent = new Intent (”com.example.mvella. − e i s e r v e r . ACTION START” ) ; permission .WRITE CONTACTS”/> intent .setComponent( new ComponentName(”com. 5 ...SNIP... example.mvella. eiserver”, ”com.example. 6 <service android:name=”com.example. mvella. eiserver .DiffAppStartService”)); mvella.vulnapp. updateContacts”> 7 <i n t e n t f i l t e r > startService(intent); − 8 <action android:name=”. Listing 2: Implicit intents only specify actions along with ACTION START”/> 9 </ i n t e n t f i l t e r > various possible qualifiers. − 10 startActivity( Intent ( Intent .ACTION VIEW , Uri . new 11 </ s e r v i c e > parse(”http ://www.google.com”))); 12 . SNIP . 2.1 Capability Leaks 2.2 Related Work Intents and content resolvers are core Android appli- While preventable both from secure coding and per- cation development constructs encouraging inter-app mission enforcement hardening stances (Zhang et al., functionality and data sharing, providing the required 2016), capability leaks are still bound to happen in support for user task flow implementation across mul- existing devices due to the difficulty concerned with tiple apps. A number of system intents are in fact complete eradication of vulnerabilities. We focus made available by the Android framework itself and on the provision of graceful recovery using memory are expected to be serviced by pre-installed/default forensics. Robust memory acquisition from Android apps e.g. picture viewers, instant messaging, and tele- devices has been explored extensively (Sylve et al., phony. The transition from one app to another can 2012). This body of knowledge underpins the LiME be so seamless that it may not be even noticed by acquisition tool utilized in this work. Memory ac- the device user. Since Android makes sure to iso- quisition differs from disk image acquisition since late Android apps from each other as well as from the address bus space in typical microprocessor ar- sensitive device services (e.g. telephony and net- chitectures is not exclusive to physical RAM, but is working), a permissions system is used to relax the rather shared with all memory-mapped hardware de- level of isolation in a controlled manner (Elenkov, vices. Erroneously reading from non-RAM addresses 2014). System permission requests are declared in- compromises system integrity. This same issue could side manifest files (app package meta-data) through however be leveraged by malware to evade memory the uses-permission tag. acquisition (Stuttgen¨ and Cohen, 2013). Mobile de- Listing 3 (lines 3-4), for example, requests vice forensics is challenging even at secondary stor- read/write access to the device’s contacts. Yet, it age level due to the variety of available custom hard- is the responsibility of the app developer to check ware (Kong, 2015). However, the wide-spread adop- that external apps activating the updateContacts tion of Android creates an opportunity for a common service (line 6) through the ACTION START in- source of in-memory forensic evidence. In this work tent (line 8) and that makes use of these per- we focus specifically on Android Binder and which 482 Memory Forensics of Insecure Android Inter-app Communications security-criticality has already been targeted by offen- (core/java/android/os/IMessenger.aidl). sive security studies (Artenstein and Revivo, 2014). Specifically, using the Android Runtime (ART)’s (libart.so) Java-Native Interface (JNI) media- tion, the proxy creates a serialized represen- tation of aMsg inside the middleware layer 3 ANDROID BINDER (libs/binder/Parcel.cpp), across a Java- native link registered by libandroid runtime.so All IPC constructs available to Android app devel- (core/jni/android util Binder.cpp). Sub- opers (Gargenta, 2012) are implemented as Remote sequently it is passed onto