Privilege Leakage and Information Stealing through the Android Task Mechanism

Yinhao Xiao; Guangdong Bai; Jian Mao; Zhenkai Liang; Wei Cheng

doi:10.1109/PAC.2017.29

Privilege Leakage and Information Stealing through the Android Task Mechanism

Yinhao Xiao
, Guangdong Bai
, Jian Mao
, Zhenkai Liang
, Wei Cheng

网络空间安全学院

George Washington University
Singapore Institute of Technology
National University of Singapore
Virginia Commonwealth University

科研成果: 书/报告/会议事项章节 › 会议稿件 › 同行评审

7 引用（Scopus）

摘要

To facilitate apps to collaborate in finish complex jobs, Android allows isolated apps to communicate through explicit interfaces. However, the communication mechanisms often give additional privilege to apps, which can be exploited by attackers. The Android Task Structure is a widely-used mechanism to facilitate apps' collaboration. Recent research has identified attacks to the mechanism, allowing attackers to spoof UIs in Android. In this paper, we present an analysis on the security of Android task structure. In particular, we analyze the system/app conditions that can cause the task mechanism to leak privilege. Furthermore, we identify new end-to-end attacks that enable attackers to actively interfere with victim apps to steal sensitive information. Based on our findings, we also develop atask interference checking app for exploits to the Android task structure.

源语言	英语
主期刊名	Proceedings - 2017 IEEE Symposium on Privacy-Aware Computing, PAC 2017
出版商	Institute of Electrical and Electronics Engineers Inc.
页	152-163
页数	12
ISBN（电子版）	9781538610275
DOI	https://doi.org/10.1109/PAC.2017.29
出版状态	已出版 - 4 12月 2017
活动	1st IEEE Symposium on Privacy-Aware Computing, PAC 2017 - Washington, 美国期限: 1 8月 2017 → 3 8月 2017

出版系列

姓名	Proceedings - 2017 IEEE Symposium on Privacy-Aware Computing, PAC 2017
卷	2017-January

会议

会议	1st IEEE Symposium on Privacy-Aware Computing, PAC 2017
国家/地区	美国
市	Washington
时期	1/08/17 → 3/08/17

访问文件

10.1109/PAC.2017.29

其它文件与链接

链接到 Scopus 的出版物

引用此

Xiao, Y., Bai, G., Mao, J., Liang, Z., & Cheng, W. (2017). Privilege Leakage and Information Stealing through the Android Task Mechanism. 在 Proceedings - 2017 IEEE Symposium on Privacy-Aware Computing, PAC 2017 (页码 152-163). (Proceedings - 2017 IEEE Symposium on Privacy-Aware Computing, PAC 2017; 卷 2017-January). Institute of Electrical and Electronics Engineers Inc.. https://doi.org/10.1109/PAC.2017.29

@inproceedings{86f03e15086d47ceb6e9444053e1785c,

title = "Privilege Leakage and Information Stealing through the Android Task Mechanism",

abstract = "To facilitate apps to collaborate in finish complex jobs, Android allows isolated apps to communicate through explicit interfaces. However, the communication mechanisms often give additional privilege to apps, which can be exploited by attackers. The Android Task Structure is a widely-used mechanism to facilitate apps' collaboration. Recent research has identified attacks to the mechanism, allowing attackers to spoof UIs in Android. In this paper, we present an analysis on the security of Android task structure. In particular, we analyze the system/app conditions that can cause the task mechanism to leak privilege. Furthermore, we identify new end-to-end attacks that enable attackers to actively interfere with victim apps to steal sensitive information. Based on our findings, we also develop atask interference checking app for exploits to the Android task structure.",

author = "Yinhao Xiao and Guangdong Bai and Jian Mao and Zhenkai Liang and Wei Cheng",

note = "Publisher Copyright: {\textcopyright} 2017 IEEE.; 1st IEEE Symposium on Privacy-Aware Computing, PAC 2017 ; Conference date: 01-08-2017 Through 03-08-2017",

year = "2017",

month = dec,

day = "4",

doi = "10.1109/PAC.2017.29",

language = "英语",

series = "Proceedings - 2017 IEEE Symposium on Privacy-Aware Computing, PAC 2017",

publisher = "Institute of Electrical and Electronics Engineers Inc.",

pages = "152--163",

booktitle = "Proceedings - 2017 IEEE Symposium on Privacy-Aware Computing, PAC 2017",

address = "美国",

}

Xiao, Y, Bai, G, Mao, J, Liang, Z & Cheng, W 2017, Privilege Leakage and Information Stealing through the Android Task Mechanism. 在 Proceedings - 2017 IEEE Symposium on Privacy-Aware Computing, PAC 2017. Proceedings - 2017 IEEE Symposium on Privacy-Aware Computing, PAC 2017, 卷 2017-January, Institute of Electrical and Electronics Engineers Inc., 页码 152-163, 1st IEEE Symposium on Privacy-Aware Computing, PAC 2017, Washington, 美国, 1/08/17. https://doi.org/10.1109/PAC.2017.29

Privilege Leakage and Information Stealing through the Android Task Mechanism. / Xiao, Yinhao; Bai, Guangdong; Mao, Jian 等.
Proceedings - 2017 IEEE Symposium on Privacy-Aware Computing, PAC 2017. Institute of Electrical and Electronics Engineers Inc., 2017. 页码 152-163 (Proceedings - 2017 IEEE Symposium on Privacy-Aware Computing, PAC 2017; 卷 2017-January).

科研成果: 书/报告/会议事项章节 › 会议稿件 › 同行评审

TY - GEN

T1 - Privilege Leakage and Information Stealing through the Android Task Mechanism

AU - Xiao, Yinhao

AU - Bai, Guangdong

AU - Mao, Jian

AU - Liang, Zhenkai

AU - Cheng, Wei

PY - 2017/12/4

Y1 - 2017/12/4

N2 - To facilitate apps to collaborate in finish complex jobs, Android allows isolated apps to communicate through explicit interfaces. However, the communication mechanisms often give additional privilege to apps, which can be exploited by attackers. The Android Task Structure is a widely-used mechanism to facilitate apps' collaboration. Recent research has identified attacks to the mechanism, allowing attackers to spoof UIs in Android. In this paper, we present an analysis on the security of Android task structure. In particular, we analyze the system/app conditions that can cause the task mechanism to leak privilege. Furthermore, we identify new end-to-end attacks that enable attackers to actively interfere with victim apps to steal sensitive information. Based on our findings, we also develop atask interference checking app for exploits to the Android task structure.

AB - To facilitate apps to collaborate in finish complex jobs, Android allows isolated apps to communicate through explicit interfaces. However, the communication mechanisms often give additional privilege to apps, which can be exploited by attackers. The Android Task Structure is a widely-used mechanism to facilitate apps' collaboration. Recent research has identified attacks to the mechanism, allowing attackers to spoof UIs in Android. In this paper, we present an analysis on the security of Android task structure. In particular, we analyze the system/app conditions that can cause the task mechanism to leak privilege. Furthermore, we identify new end-to-end attacks that enable attackers to actively interfere with victim apps to steal sensitive information. Based on our findings, we also develop atask interference checking app for exploits to the Android task structure.

UR - https://www.scopus.com/pages/publications/85046533078

U2 - 10.1109/PAC.2017.29

DO - 10.1109/PAC.2017.29

M3 - 会议稿件

AN - SCOPUS:85046533078

T3 - Proceedings - 2017 IEEE Symposium on Privacy-Aware Computing, PAC 2017

SP - 152

EP - 163

BT - Proceedings - 2017 IEEE Symposium on Privacy-Aware Computing, PAC 2017

PB - Institute of Electrical and Electronics Engineers Inc.

T2 - 1st IEEE Symposium on Privacy-Aware Computing, PAC 2017

Y2 - 1 August 2017 through 3 August 2017

ER -

Xiao Y, Bai G, Mao J, Liang Z, Cheng W. Privilege Leakage and Information Stealing through the Android Task Mechanism. 在 Proceedings - 2017 IEEE Symposium on Privacy-Aware Computing, PAC 2017. Institute of Electrical and Electronics Engineers Inc. 2017. 页码 152-163. (Proceedings - 2017 IEEE Symposium on Privacy-Aware Computing, PAC 2017). doi: 10.1109/PAC.2017.29

Privilege Leakage and Information Stealing through the Android Task Mechanism

摘要

出版系列

会议

访问文件

其它文件与链接

学术指纹

引用此