Exploiting Android System Services Through Bypassing Service Helpers

Preventing and Detecting State Inference Attacks on Android

“…The first key challenge is to determine the effective attack surface available to a potential attacker. Past works analyzed client-and server-side APIs and they highlighted security-relevant differences [37], [25], [14]. However, we show that there are server-side APIs (available to an attacker) that do not have their associated client-side API.…”

“…The complexity of system services opens to many potential vulnerabilities. One specific aspect that has been explored by previous works relates to inconsistencies in the placement of security checks like permission enforcing or identity control [37], [25], [14]. The common root cause is that the checks were performed only in the Manager and not also in the Service counterpart.…”

“…The two lists are then merged together. Other works used the same approach to enumerate and list the services available in the Android OS [25], [37], [14].…”

NativeX: Native Executioner Freezes Android

“…For example, there are DoS attacks exploiting the lack of input validation [16], the inconsistent security enforcement within the Android framework [29], the design trait in the concurrency control mechanism of the system server [22], the vulnerability in the call back mechanism in system services [31], as well as the lack of access control and memory usage limit in various ION heaps [35]. Also, there are attacks that can force the process abort and trigger the system reboot via IPC flooding [20], JGR (JNI Global Reference) exhaustion [21], and Toasts flooding [24]. The other attack point category is to launch DoS attacks from the native layer.…”

“…Amandroid is another static application analysis tool for determining points-to information for all objects in Android applications and context-sensitive functions across Android applications components [32]. Besides analyzing apps, there are also static analysis tools for system vulnerability analysis based on the Android source code [20][21] [22][29] [35]. SUSI is proposed to leverage a machine-learning guided approach to classify and categorize sources and sinks in the framework layer and pre-installed apps [28].…”