From reactive toproactive mobile security

SOFTWARE ENGINEERING
GROUP
SECURE
From reactive to 
proactive mobile security
Eric Bodden 
with Siegfried Rasthofer, Steven Arzt, 
Marc Miltenberger and Michael Pradel

GROUP
SECURE2
reactive security proactive security
•Find vulnerabilities
•React to disclosures
•Fix vulnerabilities
•Static analysis
•Dynamic analysis
•Bug bounty
•…
•Accept that vulnerabilities 
are a part of life
•Proactively contain 
their effect
•Proactively reason about 
those effects (risk analysis)
•Principle of least privilege
•Distrustful decomposition

GROUP
SECURE
Past work on 
Android analysis
3
Soot
FlowDroid
StubDroidSuSi
Custom Analysis
HarvesterFuzzDroid ICCTA
see invited paper in proceedings!

sources
sinks code analysis
report potential
privacy leaks

sources
sinks code analysis
report potential
privacy leaks
SMS/MMS Location Calendar Contact
SuSi [NDSS’14]

sources
sinks code analysis
report potential
privacy leaks
SMS/MMS Bluetooth NFC Email Internet
SuSi [NDSS’14]
•Found that many previous 
lists missed 90% of sources 
and sinks
•Also found that deﬁnition of 
sources/sinks is not trivial

sources
sinks code analysis
report potential
privacy leaks
FlowDroid[PLDI’14]

sources
sinks code analysis
report potential
privacy leaks
ICCTA[ICSE’15]

sources
sinks code analysis
report potential
privacy leaks
StubDroid[ICSE’16]

sources
sinks code analysis
report potential
privacy leaks
StubDroid[ICSE’16]
StubDroid
data-flow 
summaries
parameters 
and field reads
parameters 
and field writes

12
Harvester
sendTextMessage(num, text)
Class.forName(className)
sendTextMessage(“004242“, “loc_Other“)
sendTextMessage(“008888“, “loc_US“)
Class.forName(“SmsManager“)
Harvester[NDSS’16]

13
if(Build.FINGERPRINT.startsWith("generic"))
nr = "00"
if(simCountryIso().equals("US"))
nr += "4242" nr += "8888"
sendTextMessage(nr, msg)
...
Environment
msg = AES.decrypt("1234","fri$ds&S")
Step 1: 
static 
slicing

14
nr = "00"
nr += "4242" nr += "8888"
...
Environment
xmsg = AES.decrypt("1234","fri$ds&S")
Step 1: 
static 
slicing

x
15
nr = "00"
nr += "4242" nr += "8888"
...
Environment
Step 1: 
static 
slicing

x
16
nr = "00"
nr += "4242" nr += "8888"
...
Environment
if(EXECUTOR_1)
Step 1: 
static 
slicing

17
nr = "00"
nr += "4242" nr += "8888"
Log(nr, msg)
if(EXECUTOR_1)
main() {
Callee1(false);
Callee1(true);
}
Callee1(boolean EXECUTOR_1) {
}
Step 2: 
concrete 
dynamic 
execution 
 
(not symbolic 
nor concolic)

Even works for…
18
public static void gdadbjrj(String paramString1,
String paramString2) throws Exception{
// Get class instance
Class clz = Class.forName(
gdadbjrj.gdadbjrj("VRIf3+In9a.aTA3RYnD1BcVRV]af") );
Object localObject = clz.getMethod(
gdadbjrj.gdadbjrj("]a9maFVM.9")).invoke(null);
// Get method name
String s = gdadbjrj.gdadbjrj(“BaRIta*9caBBV]a");
// Build parameter list
Class c = Class.forName(
gdadbjrj.gdadbjrj("VRIf3+InVTTnSaRI+R]KR9aR9"));
Class[] arr = new Class[] {
nglpsq.cbhgc, nglpsq.cbhgc, nglpsq.cbhgc, c, c };
// Get method and invoke it
clz.getMethod(s, arr).invoke(localObject, paramString1,
null, paramString2, null, null);
}
SmsManager.sendTextMessage(...)

Harvester enables de-obfuscation
19
Class c = Class.forName(gdadbjrj.gdadbjrj(„VRIf3+InVTTnSaRI+R]KR9aR9“));
...
Class c = Class.forName("SmsManager");
...
SmsManager.sendTextMessage(a, b, c, d, e);SmsManager
...

GROUP
SECURE20
FuzzDroid
Code 
target
send premium
SMS msg.
Environment that 
provably reaches target
• DeviceID: 12345
• Incoming SMS: 
“startAttack”
FuzzDroid [ICSE 2017]
Slides on FuzzDroid courtesy of Michael Pradel

GROUP
SECURE
FuzzDroid - Algorithm
Repeat until code target reached
• Static pre-analysis
• Execute in controlled environment
Intercept and modify environment values
Record trace
• Reﬁne environment
21
• DeviceID: 00000
1st environment:
Miss most code

GROUP
SECURE
Record trace
22
• DeviceID: 12345
• SMS: “”
2nd environment:
Miss code targetReach reading of SMS

GROUP
SECURE
Record trace
23
• DeviceID: 12345
• SMS: “startAttack”
3rd environment:
Reach code target

GROUP
SECURE
Extensible set of 
value providers
24
t inference
Application + Target Locations + Fuzzed APIs
Fuzzing Framework
Constant Value Provider
Symbolic Value Provider
File Value Provider
...
Environment to reach
target location
Figure 12: Overview of the FuzzDroid approach
p checks whether the user’s network operator is part of a pre-deﬁned list of
(lines 13 to 28). This kind of technique is usually used in cases of targeted
where only speciﬁc users are attacked, e.g., only users located in a certain
DeviceID: 12345
SMS: “startAttack”

GROUP
SECURE
Example Malware: 
Commerzbank Phishing App
25
FuzzDroid
circumvents
integrity check and
makes malware
believe that
Commerzbank
Banking App was
started

GROUP
SECURE26
SuSi
FuzzDroid
FlowDroid
ICCTA
Harvester StubDroid
Sources/Sinks
Sources/Sinks
Sources/Sinks
Flows
Summaries
Flows
Flows
ValuesValues
Static Analysis
Hybrid Analysis

GROUP
SECURE
Further Reading
27
+ Ph.D. theses by Siegfried Rasthofer & Steven Arzt
all available at: http://bodden.de/pubs
Our paper in the proceedings

GROUP
SECURE28
reactive security proactive security
•Find vulnerabilities
•React to disclosures
•Fix vulnerabilities
•Static analysis
•Dynamic analysis
•Bug bounty
•…
•Accept that vulnerabilities 
are a part of life
•Proactively contain 
their effect
•Proactively reason about 
those effects (risk analysis)
•Principle of least privilege
•Distrustful decomposition

GROUP
SECURE
StagefrightVulnerability
• Buffer overﬂow in video transcoding function that
produces a preview thumbnail on Android text
messages
• Send a crafted video to a phone arbitrary code
execution
29
• Process listening to text messages requires root
privileges
• Process for producing thumbnails also ran as root
• Ergo:Arbitrary code execution as root!

GROUP
SECURE30
what if vulnerable?
what if malicious?
Problem grows large very quickly!

GROUP
SECURE
Other problem: 
data protection
• German law prohibits any usage of personal data
without explicit (!) consent
• Purpose of usage must be clear, and must be clearly
related to the customer’s business
• Hence: current data-sharing practices used by most
ad frameworks are illegal in Germany
• Will become illegal EU-wide on May 25th, 2018
31

GROUP
SECURE32
Problem:
Currently single 
protection domain
Solution 1: Solution 2:
In-process 
solution
Multi-process 
solution

GROUP
SECURE
In-process solution
• Advantage: still one process per
app, no need for IPC with libs
• Drawback: weak isolation
• Could allow for permission
assignment to individual libraries
• Possible implementation: 
piggyback on Java security manager 
if it only were available (it’s not)
33

GROUP
SECURE
Multi-process solution
• Advantages:
strong process isolation
Permission assignment to individual
libraries could probably be done
through standard Android means
• Drawback: libraries must
communicate with app via IPC
• Tool support could alleviate this
problem
34

GROUP
SECURE
What will this take?
• Changes to the Android OS
• Developer support: must be able to master
permission assignment to libraries
• Usability research: Do we want to show
library permissions to users? Do we want to
allow them to even change them?
• App-store support: Can one use additional
permission info during triaging?
35

GROUP
SECURE36

Prof. Dr. Eric Bodden
Chair for Software Engineering
Heinz Nixdorf Institut 
Zukunftsmeile 1 
33102 Paderborn
Telefon: +49 5251 60-3313 
eric.bodden@uni-paderborn.de
https://www.hni.uni-paderborn.de/swt/
https://blogs.uni-paderborn.de/sse/
GROUP
SECURE37

From reactive toproactive mobile security

More Related Content

What's hot (20)

Similar to From reactive toproactive mobile security (20)

More from MobileSoft (20)

Recently uploaded (20)

From reactive toproactive mobile security