PolyScope: Multi-Policy Access Control Analysis to Triage Android Systems
PolyScope: Multi-Policy Access Control Analysis to Triage Android Systems
复制标题
PolyScope：对 Android 系统进行分类的多策略访问控制分析
DOI：
--
复制
发表时间：
2020
期刊：
影响因子：
--
通讯作者：
T. Jaeger
中科院分区：
文献类型：
--
作者：
Yu;W. Enck;Haining Chen;H. Vijayakumar;Ninghui Li;Daimeng Wang;Zhiyun Qian;Giuseppe Petracca;T. Jaeger
Android文件系统访问控制为Android系统完整性提供了基础。 Android利用强制性（例如Seandroid）和Distagionary（例如UNIX权限）访问控制的组合，都可以保护Android平台免受Android/OEM服务的保护，并保护Android/OEM服务免受第三方应用程序的侵害。但是，OEM在引入市场分化的功能时通常会产生漏洞，因为它们在重新配置这种复杂的Android政策组合时会出现错误。在本文中，我们提出了PolyScope工具，以将Android文件系统访问控制策略与漏洞的兽医发行进行分类。多系统方法利用了两个主要见解：（1）对手可以利用强制性政策的粗糙粒度以及可支配政策的灵活性来增加可用的许可攻击的权限，我们称之为许可扩展，并且（2）系统配置可能会限制系统配置对手可以使用其权限发动攻击，激发攻击操作的计算。我们将Polyscope应用于三个Google和五个OEM Android发行版，以准确计算攻击操作以审查这些发行的脆弱性，发现允许扩展会增加可用于发射攻击的权限，有时超过10倍，但其中很大一部分这些权限（这些权限很大一部分）（约15-20％）无法转换为攻击操作。使用polyscope，我们发现了两个以前未知的漏洞，显示了Polyscope如何帮助OEM分类的访问控制策略的复杂组合，以攻击值得测试的攻击操作。
Android filesystem access control provides a foundation for Android system integrity. Android utilizes a combination of mandatory (e.g., SEAndroid) and discretionary (e.g., UNIX permissions) access control, both to protect the Android platform from Android/OEM services and to protect Android/OEM services from third-party apps. However, OEMs often create vulnerabilities when they introduce market-differentiating features because they err when re-configuring this complex combination of Android policies. In this paper, we propose the PolyScope tool to triage the combination of Android filesystem access control policies to vet releases for vulnerabilities. The PolyScope approach leverages two main insights: (1) adversaries may exploit the coarse granularity of mandatory policies and the flexibility of discretionary policies to increase the permissions available to launch attacks, which we call permission expansion, and (2) system configurations may limit the ways adversaries may use their permissions to launch attacks, motivating computation of attack operations. We apply PolyScope to three Google and five OEM Android releases to compute the attack operations accurately to vet these releases for vulnerabilities, finding that permission expansion increases the permissions available to launch attacks, sometimes by more than 10X, but a significant fraction of these permissions (about 15-20%) are not convertible into attack operations. Using PolyScope, we find two previously unknown vulnerabilities, showing how PolyScope helps OEMs triage the complex combination of access control policies down to attack operations worthy of testing.