PtmxGuard: An Improved Method for Android Kernel to Prevent Privilege Escalation Attack

Abstract

Abstract-Vulnerabilities in Android kernel give opportunity for attacker to damage the system. Privilege escalation is one of the most dangerous attacks, as it helps attacker to gain root privilege by exploiting kernel vulnerabilities. Mitigation technologies, static detection methods and dynamic defense methods have been suggested to prevent privilege escalation attack, but they still have some disadvantages. In this paper, we propose an improved method named PtmxGuard to enhance Android kernel and defeat privilege escalation attack. We focus on a typical attack pattern that attacker hijacks the control flow of Android kernel to modify process credentials by corrupting critical global function pointers. PtmxGuard enforces Code Pointer Integrity to Android kernel, checks the accuracy and reliability of those pointers when they're triggered by related system calls, and intercepts the system calls when attack activities are detected. Experiment result demonstrates that PtmxGuard can defense privilege escalation attack effectively.

A Review and Case Study on Android Malware: Threat Model, Attacks, Techniques and Tools

“…Attacks Targeting Root Privilege: Attack has been shown in Figure 2 as line 1 [15][16][17]. There are two types of attacks that come under this category one is the Droid kungfu Attack and the other one is the Gooligan attack.…”

From Hardware to Operating System: A Static Measurement Method of Android System Based on TrustZone

“…(3) The encrypted executable image hash digest is decrypted according to the public key stored in the executing domain (4) If it can be decrypted, it means that the image header data source is trusted, and the decrypted result can be obtained: the image hash summary can be executed, if it cannot be decrypted; it means that the image source is illegal and untrusted, and the operation of shutdown can be performed (5) Then, hash the executable image at the end of the image. The hash algorithm is a public hash algorithm and must be consistent with the algorithm adopted in the local image production to get the recalculated executable image hash summary (6) Compare the recalculated executable image hash summary with the result of the previous decryption operation (7) If the two hash values are the same, it means that the image is reliable and complete, and the verification is passed; if the two hash values are different, it means that the image is incomplete, and the shutdown operation is performed 4.4. Implementation of the Measurement Method.…”

“…At present, the Android system is mainly faced with cross script attack, privilege promotion attack, malware attack, privacy stealing attack, replay attack, communication attack, NFC attack, denial of service attack, etc. [4][5][6][7][8][9]. However, for the protection of attacks, most of the current research is in the application layer [10][11][12][13][14][15][16], but these solutions cannot fundamentally solve the security problems encountered by the current mobile terminal, and the terminal may still be threatened by malicious attackers and malware, so we should start from the system layer of the mobile intelligent terminal and build a secure and reliable mobile terminal system from bottom to top to ensure the security of intelligent terminal.…”