Android Security Permissions - Can We Trust Them?
Android Security Permissions - Can We Trust Them?
复制标题
DOI：
10.1007/978-3-642-30244-2_4
复制
发表时间：
2011-05
期刊：
影响因子：
--
通讯作者：
Clemens Orthacker;Peter Teufl;Stefan Kraxberger;G. Lackner;Michael Gissing;Alexander Marsalek;Johannes Leibetseder;Oliver Prevenhueber
中科院分区：
文献类型：
--
作者：
Clemens Orthacker;Peter Teufl;Stefan Kraxberger;G. Lackner;Michael Gissing;Alexander Marsalek;Johannes Leibetseder;Oliver Prevenhueber
Android系统的普及和宽松的市场审批流程可能会吸引恶意应用程序（app）注入市场。Android有一个权限系统，允许用户审查应用程序请求的权限，并在安装之前授予或拒绝访问资源。这个系统传达了一定程度的信任，因为一个应用程序只能访问由指定权限授予的资源。因此，不仅单个权限的含义，尤其是它们的组合对于理解可能的含义起着重要的作用。在本文中，我们提出了一种绕过权限系统的方法，通过在两个或多个通过任意通信通道相互通信的应用程序上传播权限。我们讨论了Android系统的相关细节，描述了权限的传播过程，可能的影响和对策。此外，我们提出了三个应用程序来演示问题和可能的检测方法。
The popularity of the Android System in combination with the lax market approval process may attract the injection of malicious applications (apps) into the market. Android features a permission system allowing a user to review the permissions an app requests and grant or deny access to resources prior to installation. This system conveys a level of trust due to the fact that an app only has access to resources granted by the stated permissions. Thereby, not only the meaning of single permissions, but especially their combination plays an important role for understanding the possible implications. In this paper we present a method that circumvents the permission system by spreading permissions over two or more apps that communicate with each other via arbitrary communication channels. We discuss relevant details of the Android system, describe the permission spreading process, possible implications and countermeasures. Furthermore, we present three apps that demonstrate the problem and a possible detection method.