1 / 7

Review of “ Towards Taming Privilege-Escalation Attacks on Android”

Review of “ Towards Taming Privilege-Escalation Attacks on Android”. Sven Bugiel , Lucas Davi , Alexandra Dmitrienko , Thomas Fischer, Ahmad-Reza Sadeghi , Bhargava Shastry In Proceedings of the 19th Annual Network & Distributed System Security Symposium (February 2012). Summary.

tammy
Download Presentation

Review of “ Towards Taming Privilege-Escalation Attacks on Android”

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. Review of “Towards Taming Privilege-Escalation Attacks on Android” Sven Bugiel, Lucas Davi, Alexandra Dmitrienko, Thomas Fischer, Ahmad-Reza Sadeghi, BhargavaShastry In Proceedings of the 19th Annual Network & Distributed System Security Symposium (February 2012)

  2. Summary The authors of this paper has presented the design and implementation of a security framework that protects against both confused deputy attack and collusion attack Also included results for performance evaluation

  3. Android architecture & Security framework architecture

  4. Appreciation • The first security framework that addresses both confused deputy attack and collusion attack • System-centric solution that generally captures all application level privilege attacks: not dependent of applications, not just targeting attack subclasses • Scalable performance over-head (adversary models: weak, basic, advanced and strong)

  5. Criticism • Heuristic evaluation: hard to simulate worst case scenario, sample size of 50 still sounds small given the amount of categories (27) • Adversary model VS performance?? • Separated test of “ICC based communication apps” and “File system and socket based communication” (I.E PDF plug-in for dolphin browser) (all tests were carried out where there’s only two nodes & single path, a mixed case would have more that two nodes and potentially multiple paths)

  6. Sample scenario

  7. Question • Given that this security framework was built on a rather obsolete version of Android (2.2.1), do you think it will still satisfy the need on devices with newer Android versions ? (Android 4 had new features such as Android Beam, Screen Shots and On-device Encryption!)

More Related