Entrust: Regulating Sensor Access by Cooperating Programs Via Delegation Graphs
Total Page：16
File Type：pdf, Size：1020Kb
EnTrust: Regulating Sensor Access by Cooperating Programs via Delegation Graphs Giuseppe Petracca Yuqiong Sun Ahmad-Atamli Reineh Penn State University, US Symantec Research Labs, US Alan Turing Institute, London, UK [email protected] [email protected] [email protected] Jens Grossklags Patrick McDaniel Trent Jaeger Technical University of Munich, DE Penn State University, US Penn State University, US [email protected] [email protected] [email protected] Abstract For instance, modern operating systems now ship with Modern operating systems support a cooperating pro- voice-controlled personal assistants that may enlist apps gram abstraction that, instead of placing all function- and other system services to fulfill user requests, reach- ality into a single program, allows diverse programs to ing for a new horizon in human-computer interaction. cooperate to complete tasks requested by users. How- Unfortunately, system services are valuable targets ever, untrusted programs may exploit such interactions for adversaries because they often have more permis- to spy on users through device sensors by causing priv- sions than normal apps. In particular, system services ileged system services to misuse their permissions, or are automatically granted access to device sensors, such to forward user requests to malicious programs inadver- as the camera, microphone, and GPS. In one recent case tently. Researchers have previously explored methods reported by Gizmodo [1], a ride-sharing app took ad- to restrict access to device sensors based on the state of vantage of Apple iOS system services to track riders. the user interface that elicited the user input or based In this incident, whenever users asked their voice assis- on the set of cooperating programs, but the former ap- tant “Siri, I need a ride”, the assistant enlisted the ride- proach does not consider cooperating programs and the sharing app to process the request, which then leveraged latter approach has been found to be too restrictive for other system services to record the users’ device screens, many cases. In this paper, we propose EnTrust, an even while running in the background. Other online authorization system that tracks the processing of in- magazines have reported cases of real-world evidence put events across programs for eliciting approvals from that apps are maliciously colluding with one another to users for sensor operations. EnTrust constructs dele- collect and share users’ personal data [2, 3, 4]. gation graphs by linking input events to cooperation Such attacks are caused by system services being events among programs that lead to sensor operation tricked into using their permissions on behalf of mali- requests, then uses such delegation graphs for eliciting cious apps (confused deputy attacks [5, 6]), or malicious authorization decisions from users. To demonstrate this apps exploiting their own privileges to steal data, and approach, we implement the EnTrust authorization sys- a combination of the two. Researchers have previously tem for Android OS. In a laboratory study, we show that shown that such system services are prone to exploits attacks can be prevented at a much higher rate (47-67% that leverage permissions only available to system ser- improvement) compared to the first-use approach. Our vices [7]. Likewise, prior work has demonstrated that field study reveals that EnTrust only requires a user system services inadvertently or purposely (for function- effort comparable to the first-use approach while incur- ality reasons) depend on untrusted and possibly mali- ring negligible performance (<1% slowdown) and mem- cious apps to help them complete tasks [8]. ory overheads (5.5 KB per program). Such attacks are especially hard to prevent due to two information asymmetries. System services are being ex- 1 Introduction ploited when performing tasks on behalf of users, where: Modern operating systems, such as Android OS, Ap- (1) users do not know what processing will result from ple iOS, Windows Phone OS, and Chrome OS, support their requests and (2) services do not know what pro- a programming abstraction that enables programs to cessing users intended when making the request. Cur- cooperate to perform user commands via input event rent systems employ methods to ask users to authorize delegations. Indeed, an emergent property of modern program access to sensors, but to reduce users’ autho- operating systems is that system services are relatively rization effort they only ask on a program’s first useof simple, provide a specific functionality, and often rely on that permission. However, once authorized, a program the cooperation with other programs to perform tasks. can utilize that permission at will, enabling programs to spy on users as described above. To prevent such cooperating system services to obtain unauthorized ac- attacks, researchers have explored methods that bind cess to device sensors. At a high-level, our insight is to input events, including facets of the user interface used combine techniques that regulate IPC communications to elicit those inputs, to permissions to perform sen- of programs of different privilege levels with techniques sor operations [9, 10, 12]. Such methods ask users to that enable users to be aware of the permissions asso- authorize permissions for those events and reuse those ciated with an input event and decide whether to grant permissions when the same event is performed to re- such permissions for the identified flow context. The for- duce the user burden. Recent research extends the col- mer techniques identify how a task is “delegated” among lection of program execution context (e.g., data flows cooperating programs to restrict the permissions of the and/or GUI flows between windows) more comprehen- delegatee.1 The latter techniques expose more contex- sively to elicit user authorizations for sensitive opera- tual information to a user, which may be useful to make tions [16, 11]. However, none of these methods addresses effective authorization decisions. the challenge where an input event is delivered to one However, combining these two research threads re- program and then a sensor operation, in response to sults in several challenges. First, we must be able to that event, is requested by another program in a series associate input events with their resulting sensor oper- of inter-process communications, a common occurrence ations in other programs to authorize such operations in modern operating systems supporting the cooperat- relative to the input events and sequence of cooperating ing program abstraction. programs. Prior work does not track how processing re- Researchers have also explored methods to prevent sulting from input events is delegated across programs unauthorized access by regulating inter-process commu- [9, 10, 11, 12], but failing to do so results in attack nications (IPCs) and by reducing the permissions of pro- vectors exploitable by an adversary. In EnTrust, we grams that perform operations on behalf of other pro- construct delegation graphs that associate input events grams. First, prior work developed methods for block- with their resulting sensor operations across IPCs to ing IPC communications that violate policies specified authorize operations in other programs. by app developers [8, 18, 19, 21, 22]. However, such Second, multiple, concurrent input events and IPCs methods may prevent programs from cooperating as ex- may create ambiguity in tracking delegations across pro- pected. Decentralized information flow control [23, 24] cesses that must be resolved to ensure correct enforce- methods overcome this problem by allowing programs ment. Prior work either makes assumptions that are with the authority to make security decisions and make often too restrictive or require manual program annota- IPCs that may otherwise be blocked. Second, DIFC tions to express such security decisions. EnTrust lever- methods, like capability-based systems in general [34], ages the insights that input events are relatively infre- enable reduction of a program’s permissions (i.e., callee) quent, processed much more quickly than users can gen- when performing operations on behalf of other pro- erate distinct events, and are higher priority than other grams (i.e., callers). Initial proposals for reducing per- processing. It uses these insights to ensure that an un- missions simply intersected the parties’ permissions [7], ambiguous delegation path can be found connecting each which however was too restrictive because parties would input event and sensor operation, if one exists, with lit- have their permissions pruned after the interaction with tle impact on processing overhead. less privileged parties. DIFC methods, instead, provide Third, we must develop a method to determine the more flexibility [20], albeit with the added complex- permissions to be associated with an input event for ity of requiring programs to make non-trivial security other programs that may perform sensor operations. decisions. Our insight to simplify the problem is that Past methods, including machine learning techniques while DIFC methods govern information flows compre- [14, 15], depend on user decision making to select the hensively to prevent the leakage of sensitive data avail- permissions associated with input events, but we wonder able to programs, users instead want to prevent pro- whether the information asymmetries arising from dele- grams from abusing sensor access to obtain sensitive gation of requests