TY  - GEN
A1  - Chakraborty, Dhiman
A1  - Hammer, Christian
A1  - Bugiel, Sven
T1  - Secure Multi-Execution in Android
T2  - Proceedings of the 34th ACM/SIGAPP Symposium on Applied Computing
N2  - Mobile operating systems, such as Google's Android, have become a fixed part of our daily lives and are entrusted with a plethora of private information. Congruously, their data protection mechanisms have been improved steadily over the last decade and, in particular, for Android, the research community has explored various enhancements and extensions to the access control model. However, the vast majority of those solutions has been concerned with controlling the access to data, but equally important is the question of how to control the flow of data once released. Ignoring control over the dissemination of data between applications or between components of the same app, opens the door for attacks, such as permission re-delegation or privacy-violating third-party libraries. Controlling information flows is a long-standing problem, and one of the most recent and practical-oriented approaches to information flow control is secure multi-execution.

In this paper, we present Ariel, the design and implementation of an IFC architecture for Android based on the secure multi-execution of apps. Ariel demonstrably extends Android's system with support for executing multiple instances of apps, and it is equipped with a policy lattice derived from the protection levels of Android's permissions as well as an I/O scheduler to achieve control over data flows between application instances. We demonstrate how secure multi-execution with Ariel can help to mitigate two prominent attacks on Android, permission re-delegations and malicious advertisement libraries.
KW  - Android
KW  - Information flow control
KW  - secure multi-execution
Y1  - 2019
SN  - 978-1-4503-5933-7
U6  - https://doi.org/10.1145/3297280.3297469
SP  - 1934
EP  - 1943
PB  - Association for Computing Machinery
CY  - New York
ER  - 
TY  - GEN
A1  - Gross, Sascha
A1  - Tiwari, Abhishek
A1  - Hammer, Christian
T1  - PlAnalyzer
BT  - a precise approach for pendingIntent vulnerability analysis
T2  - Computer Security(ESORICS 2018), PT II
N2  - In this work we propose PIAnalyzer, a novel approach to analyze PendingIntent related vulnerabilities. We empirically evaluate PIAnalyzer on a set of 1000 randomly selected applications from the Google Play Store and find 1358 insecure usages of Pendinglntents, including 70 severe vulnerabilities. We manually inspected ten reported vulnerabilities out of which nine correctly reported vulnerabilities, indicating a high precision. The evaluation shows that PIAnalyzer is efficient with an average execution time of 13 seconds per application.
KW  - Android
KW  - Intent analysis
KW  - Information flow control
KW  - Static analysis
Y1  - 2018
SN  - 978-3-319-98989-1
SN  - 978-3-319-98988-4
U6  - https://doi.org/10.1007/978-3-319-98989-1_3
SN  - 0302-9743
SN  - 1611-3349
VL  - 11099
SP  - 41
EP  - 59
PB  - Springer
CY  - Cham
ER  -