AirBag: Boosting Smartphone Resistance to Malware Infection

Wu, Chiachih; Zhou, Yajin; Patel, Kunal; Liang, Zhenkai; Jiang, Xuxian

doi:10.14722/ndss.2014.23164

Cited by 53 publications

(15 citation statements)

References 25 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Some existing works can be adapted to facilitate such countermeasures. For example, AirBag [26] supports a decoupled and isolated runtime environment based on OS-level virtualization. ASM [13] provides programmable interfaces that interpose Android APIs and return dummy values to applications.…”

Section: Countermeasuresmentioning

confidence: 99%

Morpheus

Jing

Zhao

Ahn

et al. 2014

Proceedings of the 30th Annual Computer Security Applications Conference

View full text Add to dashboard Cite

Emulator-based dynamic analysis has been widely deployed in Android application stores. While it has been proven effective in vetting applications on a large scale, it can be detected and evaded by recent Android malware strains that carry detection heuristics. Using such heuristics, an application can check the presence or contents of certain artifacts and infer the presence of emulators. However, there exists little work that systematically discovers those heuristics that would be eventually helpful to prevent malicious applications from bypassing emulator-based analysis. To cope with this challenge, we propose a framework called Morpheus that automatically generates such heuristics. Morpheus leverages our insight that an effective detection heuristic must exploit discrepancies observable by an application. To this end, Morpheus analyzes the application sandbox and retrieves observable artifacts from both Android emulators and real devices. Afterwards, Morpheus further analyzes the retrieved artifacts to extract and rank detection heuristics. The evaluation of our proof-of-concept implementation of Morpheus reveals more than 10,000 novel detection heuristics that can be utilized to detect existing emulator-based malware analysis tools. We also discuss the discrepancies in Android emulators and potential countermeasures.

show abstract

Section: Countermeasuresmentioning

confidence: 99%

Morpheus

Jing

Zhao

Ahn

et al. 2014

Proceedings of the 30th Annual Computer Security Applications Conference

View full text Add to dashboard Cite

show abstract

“…A physical phone can have several VPs and users can easily switch among them. AirBag [15], a light-weight OS-level virtualization, isolates and prevents malware from infecting the system or stealthily leaking private information. It builds a restricted execution environment for untrusted apps and also virtualizes various device drivers, such as file system, framebuffer/GPU and input devices.…”

Section: B Virtual Environmentmentioning

confidence: 99%

“…Although recent work [10]- [12] proposes solutions to detect and prevent ICC vulnerability, they are not general for confining resource-abusing apps without ICC channels involved. A stronger security guarantee is provided by virtualization-based solutions -Cells [13], L4Android [14], and AirBag [15] propose system virtualization and isolated execution environment by virtualizing hardware devices. However, they also require heavy environment initialization and extra storage to achieve strong isolation.…”

Section: Introductionmentioning

confidence: 99%

A Light-Weight Software Environment for Confining Android Malware

Bai

Thian

et al. 2014

2014 IEEE Eighth International Conference on Software Security and Reliability-Companion

Self Cite

View full text Add to dashboard Cite

Mobile devices are becoming increasingly generalpurpose, and therefore the physical boundary used to separate important resources disappears. As a result, malicious applications (apps) get chances to abuse resources that are available on the mobile platform. In this paper, we propose resource virtualization as a security mechanism for the Android system to strengthen the physical barrier between many types of resources and confine resource-abusing Android apps. The physical resources on a mobile device are virtualized to a different virtual view for selected Android apps. Resource virtualization simulates a partial but consistent virtual view of the Android resources. Therefore, it can not only confine the resource-abusing apps effectively, but also ensure the usability of these apps. We implement a system prototype, RVL, and evaluate it with real-world apps of various types. Our results demonstrate its effectiveness on malicious Android apps and its compatibility and usability on benign Android apps.

show abstract

“…They roughly fall into two categories: the first category consists of solutions that extend the Android framework (and even the kernel) to allow fine-tuning of the apps' permissions [5, [14][15][16]27,33,37,45,55]. For example, AppFence [27] and TISSA [55] can be configured to return a mock location, instead of the real one, to the apps.…”

Section: Introductionmentioning

confidence: 99%

Hybrid User-level Sandboxing of Third-party Android Apps

Zhou

Patel

et al. 2015

Proceedings of the 10th ACM Symposium on Information, Computer and Communications Security

Self Cite

View full text Add to dashboard Cite

Users of Android phones increasingly entrust personal information to third-party apps. However, recent studies reveal that many apps, even benign ones, could leak sensitive information without user awareness or consent. Previous solutions either require to modify the Android framework thus significantly impairing their practical deployment, or could be easily defeated by malicious apps using a native library.In this paper, we propose AppCage, a system that thoroughly confines the run-time behavior of third-party Android apps without requiring framework modifications or root privilege. AppCage leverages two complimentary user-level sandboxes to interpose and regulate an app's access to sensitive APIs. Specifically, dex sandbox hooks into the app's Dalvik virtual machine instance and redirects each sensitive framework API to a proxy which strictly enforces the user-defined policies, and native sandbox leverages software fault isolation to prevent the app's native libraries from directly accessing the protected APIs or subverting the dex sandbox. We have implemented a prototype of AppCage. Our evaluation shows that AppCage can successfully detect and block attempts to leak private information by third-party apps, and the performance overhead caused by AppCage is negligible for apps without native libraries and minor for apps with them.

show abstract

AirBag: Boosting Smartphone Resistance to Malware Infection

Cited by 53 publications

References 25 publications

Morpheus

Morpheus

A Light-Weight Software Environment for Confining Android Malware

Hybrid User-level Sandboxing of Third-party Android Apps

Contact Info

Product

Resources

About