ABSTRACT WU, LEI. Vulnerability Detection and Mitigation in Commodity Android Devices
Total Page：16
File Type：pdf, Size：1020Kb
ABSTRACT WU, LEI. Vulnerability Detection and Mitigation in Commodity Android Devices. (Under the direction of Xuxian Jiang.) The smartphone market has grown explosively in recent years, as more and more consumers are attracted to the sensor-studded multipurpose devices. However, with the popularity of Android platform, a large number of vulnerabilities have been observed and exploited in the wild. In this dissertation, we aim to detect and quantify the presence of vulnerabilities in commodity An- droid devices, and propose corresponding mitigation solutions. In particular, we focus on two kinds of vulnerabilities, i.e., app-level vulnerabilities in pre-loaded apps and kernel-level vulnerabilities in device firmware images. To these ends, we first propose a system named SEFA to detect app-level vul- nerabilities and evaluate their impact. Using SEFA, we quantitatively analyze ten representative stock Android images from five popular smartphone vendors (with two models from each vendor). Our eval- uation results are worrisome: all examined devices are vulnerable. Our results also show that vendor customizations are significant on stock Android devices and on the whole responsible for the bulk of the security problems we detected in each device. To make matter worse, the slow update cycle makes the threats more serious, since it provides the attackers with more opportunities to launch the attack. In addition, we design a system named KSEFA to detect kernel-level vulnerabilities, including known and unknown ones, and evaluate their impact. First of all, KSEFA is capable of quantitatively measuring the effectiveness of defense mechanisms by verifying whether the known vulnerabilities can actually be exploited to perform privilege escalation. Our evaluation results show that the known kernel-level vulnerabilities can significantly affect the security of Android devices, and the situation would remain severe even after several months of the disclosed dates. Second, based on the obtained insights, we are able to build KSEFA to discover certain zero-day vulnerabilities by performing a static disassembly-level data-flow analysis. In fact, several zero-day vulnerabilities have been discovered by using KSEFA, and these findings demonstrate the effectiveness and promise of the proposed system. Finally, we evaluate vendors’ response times to release the official patches. The evaluation results show that the responses can hardly be regarded as timely, and leave a wide open time window for exploitations. Our work calls for community attention for effective solutions against the aforementioned threats. In light of this, we propose our approach, i.e., a novel transparent policy-based framework named DVMFA, to protect the vulnerable devices. DVMFA is a context-aware system which is capable of patching app- and kernel-level vulnerabilities dynamically in a fine-grained manner. Specifically, we first design a policy language for kernel-level vulnerabilities as the base set, and then extend it to support app- level vulnerabilities with richer semantic specification and bindings. Our evaluation results show that the vulnerabilities we studied can be effectively prevented by DVMFA with negligible performance overhead. © Copyright 2015 by Lei Wu All Rights Reserved Vulnerability Detection and Mitigation in Commodity Android Devices by Lei Wu A dissertation submitted to the Graduate Faculty of North Carolina State University in partial fulfillment of the requirements for the Degree of Doctor of Philosophy Computer Science Raleigh, North Carolina 2015 APPROVED BY: Vincent W. Freeh Xipeng Shen Huiyang Zhou Xuxian Jiang Chair of Advisory Committee DEDICATION To my parents, wife and daughter. ii BIOGRAPHY Lei Wu is originally from Huai’an, China. He received his Bachelor of Engineering degree in Software Engineering and his Master of Engineering degree in Computer Science from Nanjing University in China in 2005 and 2008, respectively. Since 2011, he spent four years in North Carolina State University (NCSU) to pursue his Doctor of Philosophy degree in Computer Science under the direction of Dr. Xuxian Jiang. His research interests lie primarily in mobile security such as the vulnerability detection and mitigation in commodity Android device (the focus of this dissertation). He is expected to graduate with a Ph.D. degree in Computer Science from NCSU in August 2015, and join Qihoo 360 Technology Co. Ltd. in Fall 2015. iii ACKNOWLEDGEMENTS The pursuit and completion of the Ph.D. degree not only requires one’s passion and persistence, but also asks for encouragement and support from his or her surroundings. I would like to express my gratitude to those who have supported and encouraged me with their invaluable help at all stages of my graduate study. First of all, I would like to thank my adviser, Prof. Xuxian Jiang, for his important support and insightful guidance during my graduate study. His high standard of research and great enthusiasm in the work significantly benefits and motivates me. I am also thankful to Prof. Vincent W. Freeh, Prof. Xipeng Shen, and Prof. Huiyang Zhou for their time and efforts serving in my PhD thesis committee and providing valuable advice that helped to improve this dissertation. Second, I am grateful to all my coauthors for their helpful discussions and collaborations, i.e., my colleagues in the Cyber Defense Lab at NCSU: Michael Grace, Yajin Zhou and Chiachih Wu. Third, I would like to give my thanks to my friends for their help during my Ph.D. study: Zhi Wang, Wu Zhou, Kunal Patel, Feifei Wang, Qiang Zhang, Xiaocheng Zou, Yang Liu, Xiaoqing Luo, Pu Yang and Wenbo Shen. In addition to academics, I received help in many other perspectives as well: Xuxian Jiang and Huiyang Zhou from NCSU, Cliff Zou, Ping Wang, Baber Aslam and Yuqing Lin from University of Central Florida, Men Long, Hormuzd M. Khosravi and Prashant Dewan from Intel Research Lab, pro- vided valuable help with constructive feedbacks and advice; Carol Allen, Margery Page, Tom Ryan, Douglas Reeves, George Rouskas, and other staff members from the Department of Computer Science and the Office of International Services also deserve my gratitude for their excellent work. I am also grateful to organizations, i.e., National Science Foundation (NSF) and Army Research Office (ARO), for their generous funding support for my graduate research. As usual, any opinions, findings, and con- clusions or recommendations expressed in this dissertation do not necessarily reflect the views of the NSF and the ARO. Last but certainly not least, I deeply appreciate the everlasting support and encouragement from my family, particularly my wife, Feiye Wang, and our daughter Jinyi. Without their continuous support, none of this would have been possible, not to mention enjoyable. Also, I can never overemphasize the importance of my parents in shaping who I am and giving me the gift of education. iv TABLE OF CONTENTS LIST OF TABLES ......................................... vii LIST OF FIGURES ........................................ viii Chapter 1 Introduction ..................................... 1 1.1 Background and Problem Overview . .... 1 1.2 OurApproach...................................... 2 1.3 Dissertation Contributions . 4 1.4 Terminology........................................ 5 1.5 Dissertation Organization . 6 Chapter 2 Related Work .................................... 7 2.1 Vulnerability Detection . 7 2.2 Vulnerability Mitigation . 8 2.3 Android Security in General . 9 Chapter 3 Detection of App-Level Vulnerabilities ...................... 11 3.1 Introduction........................................ 11 3.2 Design........................................... 13 3.2.1 ProvenanceAnalysis ............................... 14 3.2.2 Permission Usage Analysis . 15 3.2.3 Vulnerability Analysis . 17 3.3 Implementation and Evaluation . 22 3.3.1 ProvenanceAnalysis ............................... 22 3.3.2 Permission Usage Analysis . 24 3.3.3 Vulnerability Analysis . 27 3.4 Discussion......................................... 34 3.5 Summary ......................................... 35 Chapter 4 Detection of Kernel-Level Vulnerabilities ..................... 36 4.1 Introduction........................................ 36 4.2 Design........................................... 38 4.2.1 Preprocessing Firmware Images . 39 4.2.2 Verifying Known Vulnerabilities . 40 4.2.3 Discovering Unknown Vulnerabilities . 44 4.3 Implementation and Evaluation . 46 4.3.1 Evaluation Preparation . 46 4.3.2 Verifying Known Vulnerabilities . 48 4.3.3 Discovering Unknown Vulnerabilities . 53 4.3.4 ResponseTime.................................. 54 4.4 Discussion......................................... 57 4.5 Summary ......................................... 58 v Chapter 5 Mitigation of App- and Kernel-Level Vulnerabilities .............. 59 5.1 Introduction........................................ 59 5.2 Design........................................... 61 5.2.1 PolicyLanguage ................................. 61 5.2.2 APIMonitor ................................... 63 5.2.3 SyscallMonitor.................................. 65 5.3 Implementation and Evaluation . 66 5.3.1 APIMonitorModule............................... 68 5.3.2 Syscall Monitor Module . 70 5.3.3 Performance Evaluation . 72 5.4 Discussion......................................... 74 5.5 Summary ......................................... 75 Chapter 6 Conclusions and Future Work ........................... 76 BIBLIOGRAPHY ......................................... 78 APPENDIX