You are here
Harvesting Inconsistent Security Configurations in Custom Android ROMs via Differential Analysis
Yousra Aafer, Xiao Zhang, and Wenliang Du, Syracuse University
Android customization offers substantially different experiences and rich functionalities to users. Every party in the customization chain, such as vendors and carriers, modify the OS and the pre-installed apps to tailor their devices for a variety of models, regions, and custom services. However, these modifications do not come at no cost. Several existing studies demonstrate that modifying security configurations during the customization brings in critical security vulnerabilities. Albeit these serious consequences, little has been done to systematically study how Android customization can lead to security problems, and how severe the situation is. In this work, we systematically identified security features that, if altered during the customization, can introduce potential risks. We conducted a large scale differential analysis on 591 custom images to detect inconsistent security features. Our results show that these discrepancies are indeed prevalent among our collected images. We have further identified several risky patterns that warrant further investigation. We have designed attacks on real devices and confirmed that these inconsistencies can indeed lead to actual security breaches.
Open Access Media
USENIX is committed to Open Access to the research presented at our events. Papers and proceedings are freely available to everyone once the event begins. Any video, audio, and/or slides that are posted after the event are also free and open to everyone. Support USENIX and our commitment to Open Access.
author = {Yousra Aafer and Xiao Zhang and Wenliang Du},
title = {Harvesting Inconsistent Security Configurations in Custom Android {ROMs} via Differential Analysis},
booktitle = {25th USENIX Security Symposium (USENIX Security 16)},
year = {2016},
isbn = {978-1-931971-32-4},
address = {Austin, TX},
pages = {1153--1168},
url = {https://www.usenix.org/conference/usenixsecurity16/technical-sessions/presentation/aafer},
publisher = {USENIX Association},
month = aug
}
connect with us