DOCSLIB.ORG

Uncovering and Mitigating Unsafe Program Integrations in Android

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
Uncovering and Mitigating Unsafe Program Integrations in Android Syracuse University SURFACE Dissertations - ALL SURFACE May 2016 UNCOVERING AND MITIGATING UNSAFE PROGRAM INTEGRATIONS IN ANDROID Xiao Zhang Syracuse University Follow this and additional works at: https://surface.syr.edu/etd Part of the Engineering Commons Recommended Citation Zhang, Xiao, "UNCOVERING AND MITIGATING UNSAFE PROGRAM INTEGRATIONS IN ANDROID" (2016). Dissertations - ALL. 465. https://surface.syr.edu/etd/465 This Dissertation is brought to you for free and open access by the SURFACE at SURFACE. It has been accepted for inclusion in Dissertations - ALL by an authorized administrator of SURFACE. For more information, please contact [email protected]. ABSTRACT Android’s design philosophy encourages the integration of resources and functionalities from multiple parties, even with different levels of trust. Such program integrations, on one hand, connect every party in the Android ecosystem tightly on one single device. On the other hand, they can also pose severe security problems, if the security design of the underlying integration schemes is not well thought-out. This dissertation systematically evaluates the security design of three integration schemes on Android, including framework module, framework proxy and 3rd-party code embedding. With the security risks identified in each scheme, it concludes that program integrations on Android are unsafe. Furthermore, new frameworks have been designed and implemented to detect and mitigate the threats. The evaluation results on the prototypes have demonstrated their effectiveness. UNCOVERING AND MITIGATING UNSAFE PROGRAM INTEGRATIONS IN ANDROID by Xiao, Zhang B.S., University of Science and Technology of China, 2010 Dissertation Submitted in partial fulfillment of the requirements for the degree of Doctor of Philosophy in Computer & Information Science and Engineering Syracuse University May 2016 © Copyright 2016 Xiao, Zhang All Rights Reserved ACKNOWLEDGMENTS Special thanks go to my advisor, Prof. Wenliang Du, for all the guidance during my PhD study. In the previous six years, he has always been patient with my progress in academic research. From the discussions we had, I have gradually learned how to do critical thinking, and more importantly, how to be constructive when new ideas are proposed. His patience and support helped me overcome many crisis situations and finish this dissertation. I would also like to thank Prof. Pinyuen Chen, Prof. Steve Chapin, Prof. Heng Yin, Prof. Vir V. Phoha and Prof. Edmund S. Yu for agreeing to be on my thesis committee. I am extremely grateful for their time in reading my dissertation and commenting on my views. I am also grateful to my wife, Yue Zhang, who has helped me stay sane through these difficult years. No matter what decisions I made, I know she is always on my side. Her support and care helped me overcome setbacks and stay focused on my graduate study. We have been through several ups and downs in the last few years, and we will surely face new challenges together in the future. None of this would have been possible without the love and support from my family. They are always encouraging me to pursue my own dreams, which has led to this great journey of my PhD study. I am very fortunate to cooperate with several colleagues, including Kailiang Ying, Yousra Aafer, Amit Ahlawat and Zhenshen Qiu. Their efforts have helped to realize the ideas in this dissertation. I would also like to thank Tongbo Luo, Xing Jin, Haichao Zhang and Paul Ratazzi for discussing the initial ideas with me. Last but not least, I thank all my friends for the good time we had together. Our friendship has been an important piece in my life. v TABLE OF CONTENTS Page ABSTRACT ::::::::::::::::::::::::::::::::::::::: i LIST OF TABLES :::::::::::::::::::::::::::::::::::: x LIST OF FIGURES ::::::::::::::::::::::::::::::::::: xi 1 Introduction :::::::::::::::::::::::::::::::::::::: 1 1.1 Program Integration Schemes on Android ::::::::::::::::::: 2 1.2 Thesis Statement and Contributions :::::::::::::::::::::: 4 1.3 Dissertation Roadmap ::::::::::::::::::::::::::::: 6 2 Security Risks in Android Program Integrations :::::::::::::::::: 7 2.1 Framework Module ::::::::::::::::::::::::::::::: 8 2.2 Framework Proxy :::::::::::::::::::::::::::::::: 9 2.3 3rd-party Code Embedding :::::::::::::::::::::::::: 11 2.4 Problem Scope ::::::::::::::::::::::::::::::::: 14 3 Related Work ::::::::::::::::::::::::::::::::::::: 16 3.1 Android Security :::::::::::::::::::::::::::::::: 16 3.1.1 Demystification ::::::::::::::::::::::::::::: 16 3.1.2 Vulnerability Exploration ::::::::::::::::::::::: 18 3.1.3 Enhancement :::::::::::::::::::::::::::::: 20 3.2 Isolation ::::::::::::::::::::::::::::::::::::: 22 3.2.1 Language-based Isolation :::::::::::::::::::::::: 23 3.2.2 Sandbox-based Isolation :::::::::::::::::::::::: 24 3.2.3 VM-based Isolation ::::::::::::::::::::::::::: 26 3.2.4 OS Kernel-based Isolation ::::::::::::::::::::::: 27 3.3 Iframe Security ::::::::::::::::::::::::::::::::: 28 4 Data Residue Attacks on Android :::::::::::::::::::::::::: 30 vi Page 4.1 Security Considerations in the Design of Android Extensible Frameworks : 31 4.1.1 Initiator Perspective :::::::::::::::::::::::::: 31 4.1.2 Target Perspective ::::::::::::::::::::::::::: 32 4.1.3 Channel Perspective :::::::::::::::::::::::::: 33 4.2 Problem Formulation :::::::::::::::::::::::::::::: 35 4.2.1 Background ::::::::::::::::::::::::::::::: 35 4.2.2 The Data Residue Problem :::::::::::::::::::::: 38 4.2.3 Two-stage Study on Android Data Residue :::::::::::::: 39 4.3 Methodology :::::::::::::::::::::::::::::::::: 40 4.4 Attacks ::::::::::::::::::::::::::::::::::::: 43 4.4.1 Credential Stealing ::::::::::::::::::::::::::: 44 4.4.2 Capability Intruding :::::::::::::::::::::::::: 50 4.4.3 Settings Impersonating ::::::::::::::::::::::::: 56 4.4.4 History Peeking ::::::::::::::::::::::::::::: 60 4.4.5 Permissions Regaining ::::::::::::::::::::::::: 63 4.5 Evaluation :::::::::::::::::::::::::::::::::::: 64 4.6 Discussion :::::::::::::::::::::::::::::::::::: 69 4.7 Conclusion :::::::::::::::::::::::::::::::::::: 73 5 Detecting Data Residue in Android Images ::::::::::::::::::::: 74 5.1 Background ::::::::::::::::::::::::::::::::::: 76 5.2 Design :::::::::::::::::::::::::::::::::::::: 80 5.2.1 Image Preprocessing :::::::::::::::::::::::::: 82 5.2.2 System Service Collection ::::::::::::::::::::::: 83 5.2.3 Entry Point Identification ::::::::::::::::::::::: 84 5.2.4 Call Graph Construction :::::::::::::::::::::::: 85 5.2.5 Target APIs Harvest :::::::::::::::::::::::::: 87 5.2.6 Risk Evaluation ::::::::::::::::::::::::::::: 88 5.3 Implementation ::::::::::::::::::::::::::::::::: 89 5.3.1 Bridging Broken Links ::::::::::::::::::::::::: 90 vii Page 5.3.2 Building Class Hierarchy and Call Graph ::::::::::::::: 91 5.3.3 Handling Exceptions :::::::::::::::::::::::::: 92 5.3.4 Discussion :::::::::::::::::::::::::::::::: 92 5.3.5 Code Base and Availability ::::::::::::::::::::::: 93 5.4 Evaluation :::::::::::::::::::::::::::::::::::: 94 5.4.1 Panorama of Android Data Residue :::::::::::::::::: 95 5.4.2 ANRED Effectiveness ::::::::::::::::::::::::: 101 5.4.3 Attacks ::::::::::::::::::::::::::::::::: 102 5.4.4 ANRED Performance :::::::::::::::::::::::::: 105 5.5 Conclusion :::::::::::::::::::::::::::::::::::: 109 6 AFrame: Isolating Advertisements from Mobile Applications in Android ::::: 110 6.1 Overview of AFrame :::::::::::::::::::::::::::::: 113 6.1.1 From the User Perspective ::::::::::::::::::::::: 114 6.1.2 From the Developer Perspective :::::::::::::::::::: 115 6.1.3 From the System Perspective ::::::::::::::::::::: 118 6.2 Design and Implementation :::::::::::::::::::::::::: 119 6.2.1 Process Isolation :::::::::::::::::::::::::::: 120 6.2.2 Permission Isolation :::::::::::::::::::::::::: 123 6.2.3 Display Isolation :::::::::::::::::::::::::::: 124 6.2.4 Input Isolation ::::::::::::::::::::::::::::: 128 6.2.5 LifeCycle Synchronization ::::::::::::::::::::::: 130 6.2.6 Code Modification ::::::::::::::::::::::::::: 131 6.3 Evaluation and Case Studies :::::::::::::::::::::::::: 132 6.3.1 Isolating Third-Party Advertisements ::::::::::::::::: 132 6.3.2 Performance: System Overhead :::::::::::::::::::: 135 6.3.3 Performance: Application Overhead :::::::::::::::::: 137 6.4 Conclusion :::::::::::::::::::::::::::::::::::: 141 7 Summary ::::::::::::::::::::::::::::::::::::::: 142 A Attacks on Android Clipboard :::::::::::::::::::::::::::: 146 viii Page A.1 Short Tutorial on Android Clipboard ::::::::::::::::::::: 148 A.1.1 Copying Data from Apps to the Clipboard :::::::::::::: 149 A.1.2 Monitoring the Clipboard Data :::::::::::::::::::: 149 A.1.3 Pasting Data from the Clipboard to Apps :::::::::::::: 150 A.2 Threat Models :::::::::::::::::::::::::::::::::: 151 A.3 Injection Attacks - JavaScript ::::::::::::::::::::::::: 153 A.3.1 JavaScript on Mobile Browser’s URL Bar ::::::::::::::: 153 A.3.2 Cross Site Scripting (XSS) Attack ::::::::::::::::::: 158 A.3.3 Cross Origin Invocation Attack :::::::::::::::::::: 158 A.3.4 Dynamic Page Construction :::::::::::::::::::::: 159 A.3.5 SQL-Type Code Injection ::::::::::::::::::::::: 161 A.4 Injection Attacks - Command ::::::::::::::::::::::::: 165 A.5 Injection Attacks - Phishing :::::::::::::::::::::::::: 167 A.6 Data Leakage Attacks ::::::::::::::::::::::::::::: 169 A.7 Discussion :::::::::::::::::::::::::::::::::::: 170 A.7.1 Desktop Clipboard Security :::::::::::::::::::::: 170 A.7.2 Improving Android Clipboard Security :::::::::::::::: 171 A.8 Conclusion :::::::::::::::::::::::::::::::::::: 174 LIST
Load more

Recommended publications
  • Draft SP 800-125A Rev. 1, Security Recommendations for Server
    The attached DRAFT document (provided here for historical purposes), released on April 11, 2018, has been superseded by the following publication: Publication Number: NIST Special Publication (SP) 800-125A Rev. 1 Title: Security Recommendations for Server-based Hypervisor Platforms Publication Date: June 2018 • Final Publication: https://doi.org/10.6028/NIST.SP.800-125Ar1 (which links to https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-125Ar1.pdf). • Related Information on CSRC: Final: https://csrc.nist.gov/publications/detail/sp/800-125a/rev-1/final 1 Draft NIST Special Publication 800-125A 2 Revision 1 3 4 Security Recommendations for 5 Hypervisor Deployment on 6 ServersServer-based Hypervisor 7 Platforms 8 9 10 11 12 Ramaswamy Chandramouli 13 14 15 16 17 18 19 20 21 22 23 C O M P U T E R S E C U R I T Y 24 25 Draft NIST Special Publication 800-125A 26 Revision 1 27 28 29 30 Security Recommendations for 31 Server-based Hypervisor Platforms 32 33 Hypervisor Deployment on Servers 34 35 36 37 Ramaswamy Chandramouli 38 Computer Security Division 39 Information Technology Laboratory 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 April 2018 56 57 58 59 60 61 U.S. Department of Commerce 62 Wilbur L. Ross, Jr., Secretary 63 64 National Institute of Standards and Technology 65 Walter Copan, NIST Director and Under Secretary of Commerce for Standards and Technology 66 67 Authority 68 69 This publication has been developed by NIST in accordance with its statutory responsibilities under the 70 Federal Information Security Modernization Act (FISMA) of 2014, 44 U.S.C.
    [Show full text]
  • Designing and Implementing the OP and OP2 Web Browsers
    Designing and Implementing the OP and OP2 Web Browsers CHRIS GRIER, SHUO TANG and SAMUEL T. KING, University of Illinois at Urbana-Champaign Current web browsers are plagued with vulnerabilities, providing hackers with easy access to computer systems via browser-based attacks. Browser security efforts that retrofit existing browsers have had lim- ited success because the design of modern browsers is fundamentally flawed. To enable more secure web browsing, we design and implement a new browser, called the OP web browser, that attempts to improve the state-of-the-art in browser security. We combine operating system design principles with formal methods to design a more secure web browser by drawing on the expertise of both communities. Our design philosophy is to partition the browser into smaller subsystems and make all communication between subsystems sim- ple and explicit. At the core of our design is a small browser kernel that manages the browser subsystems and interposes on all communications between them to enforce our new browser security features. To show the utility of our browser architecture, we design and implement three novel security features. First, we develop flexible security policies that allow us to include browser plugins within our security framework. Second, we use formal methods to prove useful security properties including user interface invariants and browser security policy. Third, we design and implement a browser-level information-flow tracking system to enable post-mortem analysis of browser-based attacks. In addition to presenting the OP browser architecture, we discuss the design and implementation of a second version of OP, OP2, that includes features from other secure web browser designs to improve on the overall security and performance of OP.
    [Show full text]
  • Isolation, Resource Management, and Sharing in Java
    Processes in KaffeOS: Isolation, Resource Management, and Sharing in Java Godmar Back, Wilson C. Hsieh, Jay Lepreau School of Computing University of Utah Abstract many environments for executing untrusted code: for example, applets, servlets, active packets [41], database Single-language runtime systems, in the form of Java queries [15], and kernel extensions [6]. Current systems virtual machines, are widely deployed platforms for ex- (such as Java) provide memory protection through the ecuting untrusted mobile code. These runtimes pro- enforcement of type safety and secure system services vide some of the features that operating systems pro- through a number of mechanisms, including namespace vide: inter-application memory protection and basic sys- and access control. Unfortunately, malicious or buggy tem services. They do not, however, provide the ability applications can deny service to other applications. For to isolate applications from each other, or limit their re- example, a Java applet can generate excessive amounts source consumption. This paper describes KaffeOS, a of garbage and cause a Web browser to spend all of its Java runtime system that provides these features. The time collecting it. KaffeOS architecture takes many lessons from operating To support the execution of untrusted code, type-safe system design, such as the use of a user/kernel bound- language runtimes need to provide a mechanism to iso- ary, and employs garbage collection techniques, such as late and manage the resources of applications, analogous write barriers. to that provided by operating systems. Although other re- The KaffeOS architecture supports the OS abstraction source management abstractions exist [4], the classic OS of a process in a Java virtual machine.
    [Show full text]
  • Software Development Methodologies on Android Application Using Example
    View metadata, citation and similar papers at core.ac.uk brought to you by CORE provided by VUS Repository POLYTECHNIC OF ŠIBENIK DEPARTMENT OF MANAGEMENT SPECIALIST STUDY OF MANAGEMENT Ivan Bumbak SOFTWARE DEVELOPMENT METHODOLOGIES ON ANDROID APPLICATION USING EXAMPLE Graduate thesis Šibenik, 2018. POLYTECHNIC OF ŠIBENIK DEPARTMENT OF MANAGEMENT SPECIALIST STUDY OF MANAGEMENT SOFTWARE DEVELOPMENT METHODOLOGIES ON ANDROID APPLICATION USING EXAMPLE Graduate thesis Course: Software engineering Mentor: PhD Frane Urem, college professor Student: Ivan Bumbak Student ID number: 0023096262 Šibenik, September 2018. TEMELJNA DOKUMENTACIJSKA KARTICA Veleučilište u Šibeniku Diplomski rad Odjel Menadžmenta Diplomski specijalistički stručni studij Menadžment Razvojne metode programa na Android platformi koristeći primjer Ivan Bumbak [email protected] Postoji mnogo razvojnih metoda programskih rješenja koje se mogu koristiti za razvoj istih na bilo kojoj platformi. Koja metoda će se koristiti ovisi o zahtjevnosti samog projekta, koliko ljudi radi na projektu, te u kojem vremenskom roku projekt mora biti isporučen. U svrhu ovog diplomskog rada razvijena je Android aplikacija putem tradicionalne metode, iako su danas sve više i više popularne takozvane agile metode. Agile, ili agilan, znači biti brz i sposoban reagirati na vrijeme te prilagoditi se svim promjenama u bilo kojem trenutku razvoja projekta. U radu su objašnjenje najpopularnije agile metode te su prikazane prednosti korištenja agile metoda u odnosu na tradicionalnu metodu. (37 stranica
    [Show full text]
  • Securing Android Devices
    Securing Android Devices Sun City Computer Club Seminar Series May 2021 Revision 1 To view or download a MP4 file of this seminar With audio • Audio Recording of this seminar • Use the link above to access MP4 audio recording Where are Android Devices? • Smart Phones • Smart Tablets • Smart TVs • E-Book Readers • Game consoles • Music players • Home phone machines • Video streamers – Fire, Chromecast, Why Android devices? • Cutting edge technology – Google • User Friendly • User modifications Android Software Development Kit (SDK) Open Source • Huge volume of applications • Google, Samsung, LG, Sony, Huawei, Motorola, Acer, Xiaomi, … • 2003 • CUSTOMIZABLE My Choices • Convenience vs Privacy • Helpful <-> Harmful • Smart devices know more about us than we do Android “flavors” flavours • Android versions and their names • Android 1.5: Android Cupcake • Android 1.6: Android Donut • Android 2.0: Android Eclair • Android 2.2: Android Froyo • Android 2.3: Android Gingerbread • Android 3.0: Android Honeycomb • Android 4.0: Android Ice Cream Sandwich • Android 4.1 to 4.3.1: Android Jelly Bean • Android 4.4 to 4.4.4: Android KitKat • Android 5.0 to 5.1.1: Android Lollipop • Android 6.0 to 6.0.1: Android Marshmallow • Android 7.0 to 7.1: Android Nougat • Android 8.0 to Android 8.1: Android Oreo • Android 9.0: Android Pie • Android 10 Many potential combinations • Each manufacturer “tunes” the Android release to suit #1 Keep up with updates Android Operating System Android firmware (Very vendor specific) Android Applications (Apps) Android settings
    [Show full text]
  • Cali: Compiler-Assisted Library Isolation
    Cali: Compiler-Assisted Library Isolation Markus Bauer Christian Rossow CISPA Helmholtz Center for Information Security CISPA Helmholtz Center for Information Security Saarbrücken, Saarland, Germany Saarbrücken, Saarland, Germany [email protected] [email protected] ABSTRACT the full program’s privileges and address space. This lack of privi- Software libraries can freely access the program’s entire address lege separation and memory isolation has led to numerous critical space, and also inherit its system-level privileges. This lack of sepa- security incidents. ration regularly leads to security-critical incidents once libraries We can significantly reduce this threat surface by isolating the contain vulnerabilities or turn rogue. We present Cali, a compiler- library from the main program. In most cases, a library (i) neither assisted library isolation system that fully automatically shields a requires access to the entire program’s address space, (ii) nor needs program from a given library. Cali is fully compatible with main- the full program’s privileges to function properly. In fact, even line Linux and does not require supervisor privileges to execute. We complex libraries such as parsers require only limited interaction compartmentalize libraries into their own process with well-defined with the program and/or system. Conceptually, there is thus little security policies. To preserve the functionality of the interactions need to grant an untrusted library access to the program or to between program and library, Cali uses a Program Dependence critical system privileges. Basic compartmentalization principles Graph to track data flow between the program and the library dur- thus help to secure a program from misuse by untrusted code.
    [Show full text]
  • Introduction to Operating Systems Learning Outcomes What Is An
    Learning Outcomes • High-level understand what is an operating Introduction to Operating system and the role it plays Systems • A high-level understanding of the structure of operating systems, applications, and the relationship between them. Chapter 1 – 1.3 • Some knowledge of the services provided by Chapter 1.5 – 1.9 operating systems. • Exposure to some details of major OS concepts. 2 What is an Operating System? 3 4 Block Diagram of Haswell Platform Architecture http://www.pcquest.com Role 1: The Operating System is Disk Users an Abstract Machine • Extends the basic hardware with added Memory functionality • Provides high-level abstractions – More programmer friendly CPU – Common core for all applications Network • E.g. Filesystem instead of just registers on a disk controller Bandwidth • It hides the details of the hardware – Makes application code portable 5 6 1 Structural (Implementation) View: the Role 2: The Operating System Operating System is the Privileged is a Resource Manager Component • Responsible for allocating resources to users and processes Applications Applications Applications • Must ensure User Mode Requests (System Calls) – No Starvation Privileged Mode – Progress – Allocation is according to some desired policy Operating System • First-come, first-served; Fair share; Weighted fair share; limits (quotas), etc… – Overall, that the system is efficiently used Hardware 7 8 The Operating System is Operating System Kernel Privileged • Portion of the operating system that is • Applications should not be able to interfere
    [Show full text]
  • Sealing OS Processes to Improve Dependability and Security
    Sealing OS Processes to Improve Dependability and Safety Galen Hunt, Mark Aiken, Manuel Fähndrich, Chris Hawblitzel, Orion Hodson, James Larus, Steven Levi, Bjarne Steensgaard, David Tarditi, and Ted Wobber Microsoft Research One Microsoft Way Redmond, WA 98052 USA [email protected] ABSTRACT General Terms In most modern operating systems, a process is a Design, Reliability, Experimentation. hardware-protected abstraction for isolating code and data. This protection, however, is selective. Many common Keywords mechanisms—dynamic code loading, run-time code Open process architecture, sealed process architecture, sealed generation, shared memory, and intrusive system APIs— kernel, software isolated process (SIP). make the barrier between processes very permeable. This paper argues that this traditional open process architecture 1. INTRODUCTION exacerbates the dependability and security weaknesses of Processes debuted, circa 1965, as a recognized operating modern systems. system abstraction in Multics [48]. Multics pioneered As a remedy, this paper proposes a sealed process many attributes of modern processes: OS-supported architecture, which prohibits dynamic code loading, self- dynamic code loading, run-time code generation, cross- modifying code, shared memory, and limits the scope of process shared memory, and an intrusive kernel API that the process API. This paper describes the implementation permitted one process to modify directly the state of of the sealed process architecture in the Singularity another process. operating system,
    [Show full text]
  • Security Analysis of Browser Extension Concepts
    Saarland University Faculty of Natural Sciences and Technology I Department of Computer Science Bachelor's thesis Security Analysis of Browser Extension Concepts A comparison of Internet Explorer 9, Safari 5, Firefox 8, and Chrome 14 submitted by Karsten Knuth submitted January 14, 2012 Supervisor Prof. Dr. Michael Backes Advisors Raphael Reischuk Sebastian Gerling Reviewers Prof. Dr. Michael Backes Dr. Matteo Maffei Statement in Lieu of an Oath I hereby confirm that I have written this thesis on my own and that I have not used any other media or materials than the ones referred to in this thesis. Saarbr¨ucken, January 14, 2012 Karsten Knuth Declaration of Consent I agree to make both versions of my thesis (with a passing grade) accessible to the public by having them added to the library of the Computer Science Department. Saarbr¨ucken, January 14, 2012 Karsten Knuth Acknowledgments First of all, I thank Professor Dr. Michael Backes for giving me the chance to write my bachelor's thesis at the Information Security & Cryptography chair. During the making of this thesis I have gotten a deeper look in a topic which I hope to be given the chance to follow up in my upcoming academic career. Furthermore, I thank my advisors Raphael Reischuk, Sebastian Gerling, and Philipp von Styp-Rekowsky for supporting me with words and deeds during the making of this thesis. In particular, I thank the first two for bearing with me since the release of my topic. My thanks also go to Lara Schneider and Michael Zeidler for offering me helpful advice.
    [Show full text]
  • A Research on Android Technology with New Version Naugat(7.0,7.1)
    IOSR Journal of Computer Engineering (IOSR-JCE) e-ISSN: 2278-0661,p-ISSN: 2278-8727, Volume 19, Issue 2, Ver. I (Mar.-Apr. 2017), PP 65-77 www.iosrjournals.org A Research On Android Technology With New Version Naugat(7.0,7.1) Nikhil M. Dongre , Tejas S. Agrawal, Ass.prof. Sagar D. Pande (Dept. CSE, Student of PRPCOE, SantGadge baba Amravati University, [email protected] contact no: 8408895842) (Dept. CSE, Student of PRMCEAM, SantGadge baba Amravati University, [email protected] contact no: 9146951658) (Dept. CSE, Assistant professor of PRPCOE, SantGadge baba Amravati University, [email protected], contact no:9405352824) Abstract: Android “Naugat” (codenamed Android N in development) is the seventh major version of Android Operating System called Android 7.0. It was first released as a Android Beta Program build on March 9 , 2016 with factory images for current Nexus devices, which allows supported devices to be upgraded directly to the Android Nougat beta via over-the-air update. Nougat is introduced as notable changes to the operating system and its development platform also it includes the ability to display multiple apps on-screen at once in a split- screen view with the support for inline replies to notifications, as well as an OpenJDK-based Java environment and support for the Vulkan graphics rendering API, and "seamless" system updates on supported devices. Keywords: jellybean, kitkat, lollipop, marshmallow, naugat I. Introduction This research has been done to give you the best details toward the exciting new frontier of open source mobile development. Android is the newest mobile device operating system, and this is one of the first research to help the average programmer become a fearless Android developer.
    [Show full text]
  • Web Browsers As Operating Systems: Supporting Robust and Secure Web Programs Charles Reis Final Exam - May 27, 2009
    Web Browsers as Operating Systems: Supporting Robust and Secure Web Programs Charles Reis Final Exam - May 27, 2009 1 Web is Evolving Pages Programs More complex, active content Browser now in role of OS, but faces challenges Browsers aren’t built for programs Web content not designed to express programs 2 Concrete Problems Problems Contributions Program Interference Multi-Process Browsers [EuroSys ’09] In-Flight Page Changes Web Tripwires [NSDI ’08] XSS Script Whitelists Browser Exploits BrowserShield [OSDI ’06] 3 Consider OS Landscape Performance isolation Resource accounting Failure isolation Clear program abstraction 4 Browsers Fall Short Unresponsiveness Jumbled accounting Browser crashes Unclear what a program is! 5 Preserve Web’s Strengths Improve program support, but keep it: Easy to publish content Easy to compose content Generally safe to explore 6 Thesis: Adapt lessons from the OS to improve robustness and security of web browsers and web content Support four architectural principles: 1. Identify program boundaries 2. Isolate programs from each other 3. Authorize program code 4. Enforce policies on program behavior [HotNets ’07] 7 Outline Browser Architecture: Chromium Identify program boundaries Isolate programs from each other Web Tripwires Additional Contributions Future Directions 8 Programs in the Browser Mail Doc List Doc Consider an example Doc browsing session Blog Several independent programs Mail News Article 9 Monolithic Browsers Most browsers put all pages in one process Mail Doc List Doc Poor performance isolation Blog Poor failure isolation Mail Poor security News Article Should re-architect the browser 10 Process per Window? Mail Doc List Doc Breaks pages that directly communicate Shared access to Blog data structures, etc.
    [Show full text]
  • Memento: Learning Secrets from Process Footprints
    Memento: Learning Secrets from Process Footprints Suman Jana and Vitaly Shmatikov The University of Texas at Austin Abstract—We describe a new side-channel attack. By track- Our contributions. In the 2000 movie “Memento,” the main ing changes in the application’s memory footprint, a concurrent character, suffering from anterograde amnesia, writes out his process belonging to a different user can learn its secrets. Using memories in small increments using snapshots and tattoos. Web browsers as the target, we show how an unprivileged, local attack process—for example, a malicious Android app—can When put together, these snippets reveal the answer to a infer which page the user is browsing, as well as finer-grained murder mystery. In this paper, we show that the dynamics information: whether she is a paid customer, her interests, etc. of memory footprints—sequences of snapshots of the pro- This attack is an instance of a broader problem. Many gram’s data resident size (DRS)—are correlated with the isolation mechanisms in modern systems reveal accounting in- program’s secrets and allow accurate adversarial inference. formation about program execution, such as memory usage and This robust side channel can be exploited in any multi-user CPU scheduling statistics. If temporal changes in this public information are correlated with the program’s secrets, they environment: for example, by a malicious app on an Android can lead to a privacy breach. To illustrate the pervasiveness of smartphone or a nosy user on a shared workstation. this problem, we show how to exploit scheduling statistics for We focus on Web browsers as an example of a sophis- keystroke sniffing in Linux and Android, and how to combine ticated application that keeps important secrets (browsing scheduling statistics with the dynamics of memory usage for behavior).
    [Show full text]