Call Me Back!: Attacks on System Server and System Apps in Android through Synchronous Callback
Call Me Back!: Attacks on System Server and System Apps in Android through Synchronous Callback
复制标题
DOI：
10.1145/2976749.2978342
复制
发表时间：
2016-10
期刊：
影响因子：
--
通讯作者：
Kai Wang;Yuqing Zhang;Peng Liu
中科院分区：
文献类型：
--
作者：
Kai Wang;Yuqing Zhang;Peng Liu
Android是目前最常用的移动设备操作系统。Android的核心是系统服务器（System Server， SS），它是一个多线程进程，提供大部分的系统服务。基于对系统服务中回调机制引入的安全风险的新认识，我们发现了一种一般类型的设计缺陷。设计并实现了基于静态污染分析的漏洞检测工具。我们将该工具应用于Android 5.1.0的SS中全部80个系统服务。在它的帮助下，我们发现了六个以前未知的漏洞，并在Android 2.3.7-6.0.1上进一步证实。根据我们的分析，在14亿Android设备中，97.3%存在漏洞。我们的概念验证攻击证明，这些漏洞可以使恶意应用程序冻结关键系统功能或立即软重启系统。这是一种简洁的拒绝服务攻击。我们还证明，攻击可以在关键时刻进行，以实现有意义的目标，如反病毒，反进程杀手，阻碍应用程序更新或系统补丁。b谷歌得到通知后，立即证实了我们的发现。一些关于如何安全地使用回调的建议也被提到了谷歌。
Android is the most commonly used mobile device operation system. The core of Android, the System Server (SS), is a multi-threaded process that provides most of the system services. Based on a new understanding of the security risks introduced by the callback mechanism in system services, we have discovered a general type of design flaw. A vulnerability detection tool has been designed and implemented based on static taint analysis. We applied the tool on all the 80 system services in the SS of Android 5.1.0. With its help, we have discovered six previously unknown vulnerabilities, which are further confirmed on Android 2.3.7-6.0.1. According to our analysis, about 97.3% of the entire 1.4 billion real-world Android devices are vulnerable. Our proof-of-concept attack proves that the vulnerabilities can enable a malicious app to freeze critical system functionalities or soft-reboot the system immediately. It is a neat type of denial-of-service at-tack. We also proved that the attacks can be conducted at mission critical moments to achieve meaningful goals, such as anti anti-virus, anti process-killer, hindering app updates or system patching. After being informed, Google confirmed our findings promptly. Several suggestions on how to use callbacks safely are also proposed to Google.