Upgrading Your Android, Elevating My Malware: Privilege Escalation through Mobile OS Updating

Abstract

Abstract-Android is a fast evolving system, with new updates coming out one after another. These updates often completely overhaul a running system, replacing and adding tens of thousands of files across Android's complex architecture, in the presence of critical user data and applications (apps for short). To avoid accidental damages to such data and existing apps, the upgrade process involves complicated program logic, whose security implications, however, are less known. In this paper, we report the first systematic study on the Android updating mechanism, focusing on its Package Management Service (PMS). Our research brought to light a new type of security-critical vulnerabilities, called Pileup flaws, through which a malicious app can strategically declare a set of privileges and attributes on a low-version operating system (OS) and wait until it is upgraded to escalate its privileges on the new system. Specifically, we found that by exploiting the Pileup vulnerabilities, the app can not only acquire a set of newly added system and signature permissions but also determine their settings (e.g., protection levels), and it can further substitute for new system apps, contaminate their data (e.g., cache, cookies of Android default browser) to steal sensitive user information or change security configurations, and prevent installation of critical system services. We systematically analyzed the source code of PMS using a program verification tool and confirmed the presence of those security flaws on all Android official versions and over 3,000 customized versions. Our research also identified hundreds of exploit opportunities the adversary can leverage over thousands of devices across different device manufacturers, carriers and countries. To mitigate this threat without endangering user data and apps during an upgrade, we also developed a new detection service, called SecUP, which deploys a scanner on the user's device to capture the malicious apps designed to exploit Pileup vulnerabilities, based upon the vulnerability-related information automatically collected from newly released Android OS images.

Android Security: A Survey of Issues, Malware Penetration, and Defenses

“…Over The Air (OTA) new version update significantly changes the existing version by adding and modifying large number of files across Android platform, ensuring integrity of existing user data and apps [43]. New version update is facilitated through a service called Package Management System (PMS).…”

“…New version update is facilitated through a service called Package Management System (PMS). Luyi Xing et al [43] performed a comprehensive study of pileup vulnerabilities that can be exploited by malware apps in case of new version upgrades. For example, an app for older version can declare dangerous permissions in AndroidManifest.xml that have been introduced in next version(s).…”

“…For example, an app for older version can declare dangerous permissions in AndroidManifest.xml that have been introduced in next version(s). During the update process, Android does not ask user to verify newly active permissions in that existing app and grants them automatically [43]. Thus, it compromises security of the device.…”

A New Protection for Android Applications

“…AppSealer [20] combines static-and dynamic-code analysis techniques to patch the applications's bytecode in order to mitigate component hijacking attacks. Xing et al [7] Authors introduce a scanner tool for detecting applications that are vulnerable against the pileup threat.…”

“…With the old system, each update of the application, if developer added a new permission, the Play Store posted it and the user must then accept it. With the new system, developers can add for example the permission ACCESS_SUPERUSER that allow him to take control of all the features of the phone and storage if his application had permissions in the group "another category" [7].…”