Static Analysis for Extracting Permission Checks of a Large Scale - PowerPoint PPT Presentation

Android Framework Static Analysis for Extracting Permission Checks of a Large Scale Framework: The Challenges And Solutions for Analyzing Android Alexandre Bartel University of Luxembourg September 8, 2014 Supervisor: Yves Le Traon Advisors: Jacques Klein & Martin Monperrus Alexandre Bartel Static Analysis of Permission-Based Systems 1 / 22

Android Framework Static Analysis of a Permission-Based Security System Application Alexandre Bartel Static Analysis of Permission-Based Systems 2 / 22

Android Framework Static Analysis of a Permission-Based Security System s The application 2 3 4 declares permissions Application p 1 and p 2 5 Alexandre Bartel Static Analysis of Permission-Based Systems 2 / 22

Android Framework Static Analysis of a Permission-Based Security System s The application 2 3 4 declares permissions Application p 1 and p 2 5 e 1 e 2 e 3 Alexandre Bartel Static Analysis of Permission-Based Systems 2 / 22

Android Framework Static Analysis of a Permission-Based Security System s The application 2 3 4 declares permissions Application p 1 and p 2 5 e 1 e 2 e 3 e 4 Framework Alexandre Bartel Static Analysis of Permission-Based Systems 2 / 22

Android Framework Static Analysis of a Permission-Based Security System s The application 2 3 4 declares permissions Application p 1 and p 2 5 e 1 e 2 e 3 e 4 f 1 f 2 f 3 f 8 Framework f 4 f 5 f 9 f 6 Alexandre Bartel Static Analysis of Permission-Based Systems 2 / 22

Android Framework Static Analysis of a Permission-Based Security System s The application 2 3 4 declares permissions Application p 1 and p 2 5 e 1 e 2 e 3 e 4 f 1 f 2 f 3 f 8 Framework ck 2 f 4 f 5 f 9 f 6 ck 1 Alexandre Bartel Static Analysis of Permission-Based Systems 2 / 22

Android Framework Static Analysis of a Permission-Based Security System s The application 2 3 4 declares permissions Application p 1 and p 2 5 e 1 e 2 e 3 e 4 p 3 f 1 f 2 f 3 f 8 Framework p 2 ck 2 f 4 f 5 f 9 p 1 f 6 ck 1 Alexandre Bartel Static Analysis of Permission-Based Systems 2 / 22

Android Framework Static Analysis of a Permission-Based Security System ( e 1 e 2 e 3 e 4 ) Application 1 1 1 0 e 1 e 2 e 3 e 4 p 3 f 1 f 2 f 3 f 8 Framework p 2 ck 2 f 4 f 5 f 9 p 1 f 6 ck 1 Alexandre Bartel Static Analysis of Permission-Based Systems 2 / 22

Android Framework Static Analysis of a Permission-Based Security System ( e 1 e 2 e 3 e 4 ) Application 1 1 1 0 p 1 p 2 p 3  1 0 0  e 1 e 2 1 0 0 Framework     0 0 0 e 3   e 4 0 1 0 Alexandre Bartel Static Analysis of Permission-Based Systems 2 / 22

Android Framework Methodology to Compute Permission Set (Step 1/3) Step 1: Extract Framework Permission Matrix p 1 p 2 p 3  1 0 0  e 1 1 0 0 e 2   M =   e 3 0 0 0   0 1 0 e 4 This step is only done once (for a given framework). Alexandre Bartel Static Analysis of Permission-Based Systems 3 / 22

Android Framework Methodology to Compute Permission Set (Step 2/3) Step 2: Extract Application Access Vector ( e 1 e 2 e 3 e 4 ) AV app = 1 1 1 0 This step is done for every application . Alexandre Bartel Static Analysis of Permission-Based Systems 4 / 22

Android Framework Methodology to Compute Permission Set (Step 3/3) Step 3: Infer Permission Set of the Application  1 0 0  1 0 0   ( ) IP app = 1 1 1 0 ·   0 0 0   0 1 0 ( ) IP app = 1 0 0 This step is done for every application . Alexandre Bartel Static Analysis of Permission-Based Systems 5 / 22

Android Framework Android Framework Call Graph Construction e 1 e 2 e 3 e 4 p 3 f 1 f 2 f 3 f 8 Framework p 2 f 4 f 5 f 9 ck 2 p 1 ck 1 f 6 Alexandre Bartel Static Analysis of Permission-Based Systems 6 / 22

Android Framework Android Framework Call Graph Construction e 1 e 2 e 3 e 4 p 3 f 1 f 2 f 3 f 8 Framework p 2 f 4 f 5 f 9 ck 2 p 1 ck 1 f 6 Alexandre Bartel Static Analysis of Permission-Based Systems 6 / 22

Android Framework Android Framework Call Graph Construction e 1 e 2 e 3 e 4 p 3 f 1 f 2 f 3 f 8 Framework p 2 f 4 f 5 f 9 ck 2 p 1 ck 1 f 6 Alexandre Bartel Static Analysis of Permission-Based Systems 6 / 22

Android Framework Android Framework Call Graph Construction e 1 e 2 e 3 e 4 p 3 f 1 f 2 f 3 f 8 Framework p 2 f 4 f 5 f 9 ck 2 p 1 ck 1 f 6 Alexandre Bartel Static Analysis of Permission-Based Systems 6 / 22

Android Framework Android Framework Call Graph Construction e 1 e 2 e 3 e 4 p 3 f 1 f 2 f 3 f 8 Framework p 2 f 4 f 5 f 9 ck 2 p 1 ck 1 f 6 Alexandre Bartel Static Analysis of Permission-Based Systems 6 / 22

Android Framework Call Graph Construction Techniques for Java ▶ Not precise: CHA (based on class hierarchy) ▶ CHA essential (1/4) ▶ CHA intelligent (2/4) ▶ Field sensitive: Spark ▶ Spark naive (3/4) ▶ Spark intelligent (4/4) Alexandre Bartel Static Analysis of Permission-Based Systems 7 / 22

Android Framework CHA Essential (1/4) Alexandre Bartel Static Analysis of Permission-Based Systems 8 / 22

Android Framework CHA Essential (1/4) ▶ Uses CHA algorithm for call graph Alexandre Bartel Static Analysis of Permission-Based Systems 8 / 22

Android Framework CHA Essential (1/4) ▶ Uses CHA algorithm for call graph ▶ Locates check methods in the call graph Alexandre Bartel Static Analysis of Permission-Based Systems 8 / 22

Android Framework CHA Essential (1/4) ▶ Uses CHA algorithm for call graph ▶ Locates check methods in the call graph ▶ Extracts names of checked permissions Alexandre Bartel Static Analysis of Permission-Based Systems 8 / 22

Android Framework CHA Essential (1/4) ▶ Uses CHA algorithm for call graph ▶ Locates check methods in the call graph ▶ Extracts names of checked permissions Permission Set # entry points with 0 permissions 31,791 (64%) with 1 permissions 1 ( < 0.01%) with 105 permissions 18,237 (36%) 50,029 (100%) Alexandre Bartel Static Analysis of Permission-Based Systems 8 / 22

Android Framework CHA Essential (1/4) ▶ Uses CHA algorithm for call graph ▶ Locates check methods in the call graph ▶ Extracts names of checked permissions Permission Set # entry points with 0 permissions 31,791 (64%) with 1 permissions 1 ( < 0.01%) with 105 permissions 18,237 (36%) 50,029 (100%) ▶ Why explosion of permission set size? Alexandre Bartel Static Analysis of Permission-Based Systems 8 / 22

Android Framework CHA Essential (1/4) ▶ Uses CHA algorithm for call graph ▶ Locates check methods in the call graph ▶ Extracts names of checked permissions Permission Set # entry points with 0 permissions 31,791 (64%) with 1 permissions 1 ( < 0.01%) with 105 permissions 18,237 (36%) 50,029 (100%) ▶ Why explosion of permission set size? ▶ Call graph goes through binder code Alexandre Bartel Static Analysis of Permission-Based Systems 8 / 22

Android Framework CHA Essential (1/4): The Real World System with Multiple Software Layers (source: Gargenta, 2012) Alexandre Bartel Static Analysis of Permission-Based Systems 9 / 22

Android Framework CHA Essential (1/4): The Reason of the Explosion S 1 m 1 p 0 S 1 m 2 p 0 S 1 m 3 p 1 S 1 m 4 − S 1 m 5 p 2 S 1 m 6 p 0 S 1 S 2 m 1 p 3 . . . Api S 1 . 1 S 3 m 1 p 6 . . S g . S h S i . . . . . . Binder Services Services API target transact onTransact methods method methods methods Alexandre Bartel Static Analysis of Permission-Based Systems 10 / 22

Android Framework CHA Intelligent (2/4) Alexandre Bartel Static Analysis of Permission-Based Systems 11 / 22

Android Framework CHA Intelligent (2/4) ▶ Uses CHA algorithm for call graph Alexandre Bartel Static Analysis of Permission-Based Systems 11 / 22

Android Framework CHA Intelligent (2/4) ▶ Uses CHA algorithm for call graph ▶ Finds check methods in the call graph Alexandre Bartel Static Analysis of Permission-Based Systems 11 / 22

Android Framework CHA Intelligent (2/4) ▶ Uses CHA algorithm for call graph ▶ Finds check methods in the call graph ▶ Extracts names of checked permissions Alexandre Bartel Static Analysis of Permission-Based Systems 11 / 22

Android Framework CHA Intelligent (2/4) ▶ Uses CHA algorithm for call graph ▶ Finds check methods in the call graph ▶ Extracts names of checked permissions ▶ Handles system service communication through the ”Binder” Alexandre Bartel Static Analysis of Permission-Based Systems 11 / 22

Android Framework CHA Intelligent (2/4): Handling Binder Account System Service Application Code getPassword() { Service Call checkPermission(); r = getSystemService() return password; } p = r.getPassword() Binder (Linux module) Alexandre Bartel Static Analysis of Permission-Based Systems 12 / 22

Android Framework CHA Intelligent (2/4): Handling Binder Account System Service Application Code getPassword() { Service Call checkPermission(); r = getSystemService() return password; 1 } p = r.getPassword() Binder (Linux module) Alexandre Bartel Static Analysis of Permission-Based Systems 12 / 22