Paper: Capability leaks in Android phones

[Posted December 5, 2011 by corbet]

Michael Grace, Yajin Zhou, Zhi Wang, and Xuxian Jiang have published a paper [PDF] describing research they have done into the Android security model as implemented on actual handsets. "In this paper, we analyze eight popular Android smartphones and discover that the stock phone images do not properly enforce the permission model. Several privileged permissions are unsafely exposed to other applications which do not need to request them for the actual use. To identify these leaked permissions or capabilities, we have developed a tool called Woodpecker. Our results with eight phone images show that among 13 privileged permissions examined so far, 11 were leaked, with individual phones leaking up to eight permissions. By exploiting them, an untrusted application can manage to wipe out the user data, send out SMS messages, or record user conversation on the affected phones - all without asking for any permission." The Google "Nexus" phones were the happy exception, with almost no leaks. (Seen on The H).

Paper: Capability leaks in Android phones

Posted Dec 5, 2011 15:30 UTC (Mon) by tialaramex (subscriber, #21167) [Link] (1 responses)

So, it seems like the Android Open Source builds were largely unaffected, hopefully this means Cyanogen is also unaffected.

[In passing, does anyone know how applications are able to detect that an Android phone has been "rooted" ? Do they just check for the existence of the Su package? So far nothing has refused to run, but some apps do warn me that using them on a rooted phone may compromise their security]

Paper: Capability leaks in Android phones

Posted Dec 5, 2011 22:45 UTC (Mon) by yokem_55 (subscriber, #10498) [Link]

Well at one point, the check Google Movies used to determine if a device was rooted, was to merely check for the presence of a binary named 'su'. Renaming the binary allowed downloading and playing of DRM'd movies. I'm not sure if the check has gotten more sophisticated since then, that was the setup a few months ago....

Paper: Capability leaks in Android phones

Posted Dec 6, 2011 16:32 UTC (Tue) by brouhaha (subscriber, #1698) [Link]

It seems entirely unsurprising to me that while Google actually puts significant effort into having a decent security model, the firmware modifications that the carriers demand of the ODMs are done in a shoddy manner that breaks that security. The ODMs don't have a public reputation to protect; if they screw up, the blame will fall on the carrier or on Google.