TY - GEN
T1 - Uncovering Cross-Context Inconsistent Access Control Enforcement in Android
AU - Zhou, Hao
AU - Wang, Haoyu
AU - Luo, Xiapu
AU - Chen, Ting
AU - Zhou, Yajin
AU - Wang, Ting
N1 - Publisher Copyright:
© 2022 29th Annual Network and Distributed System Security Symposium, NDSS 2022. All Rights Reserved.
PY - 2022/2/27
Y1 - 2022/2/27
N2 - Due to the complexity resulted from the huge code base and the multi-context nature of Android, inconsistent access control enforcement exists in Android, which can be exploited by malware to bypass the access control and perform unauthorized security-sensitive operations. Unfortunately, existing studies only focus on the inconsistent access control enforcement in the Java context of Android. In this paper, we conduct the first systematic investigation on the inconsistent access control enforcement across the Java context and native context of Android. In particular, to automatically discover cross-context inconsistencies, we design and implement IAceFinder, a new tool that extracts and contrasts the access control enforced in the Java context and native context of Android. Applying IAceFinder to 14 open-source Android ROMs, we find that it can effectively uncover their cross-context inconsistent access control enforcement. Specifically, IAceFinder discovers 23 inconsistencies that can be abused by attackers to compromise the device and violate user privacy.
AB - Due to the complexity resulted from the huge code base and the multi-context nature of Android, inconsistent access control enforcement exists in Android, which can be exploited by malware to bypass the access control and perform unauthorized security-sensitive operations. Unfortunately, existing studies only focus on the inconsistent access control enforcement in the Java context of Android. In this paper, we conduct the first systematic investigation on the inconsistent access control enforcement across the Java context and native context of Android. In particular, to automatically discover cross-context inconsistencies, we design and implement IAceFinder, a new tool that extracts and contrasts the access control enforced in the Java context and native context of Android. Applying IAceFinder to 14 open-source Android ROMs, we find that it can effectively uncover their cross-context inconsistent access control enforcement. Specifically, IAceFinder discovers 23 inconsistencies that can be abused by attackers to compromise the device and violate user privacy.
UR - https://www.scopus.com/pages/publications/85144294073
U2 - 10.14722/ndss.2022.23166
DO - 10.14722/ndss.2022.23166
M3 - Conference article published in proceeding or book
AN - SCOPUS:85144294073
T3 - 29th Annual Network and Distributed System Security Symposium, NDSS 2022
SP - 1
EP - 18
BT - 29th Annual Network and Distributed System Security Symposium, NDSS 2022
PB - The Internet Society
T2 - 29th Annual Network and Distributed System Security Symposium, NDSS 2022
Y2 - 24 April 2022 through 28 April 2022
ER -