Abstract
Accompanying the wide spread of Android mobile devices and the openness feature of Android ecosystem, untrusted Android apps are flooding into user’s device and prepared to perform various unwanted operations stealthily. To better manage installed apps and secure mobile devices, Android app behaviour regulating schemes are required. In this paper, we present WrapDroid, a dynamic app behaviour regulating scheme on Android device. Different from other similar approaches, the key components of WrapDroid are implemented based on dynamic memory instrumentation and system call tracing and require no modification to Android system source code. Thus, WrapDroid could be flexibly adopted by Android devices. Moreover, by automatically reconstructing call context of Java or native operations, WrapDroid may provide a full range of control on both java runtime and system call layers of an app. We also develop a WrapDroid prototype and evaluate it on several devices from different mainstream OEMs. Evaluation results show that WrapDroid can effectively regulate the behaviors of Android apps according to given policies with negligible performance overhead.
This is a preview of subscription content, log in via an institution to check access.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
References
Strategy analytics: 85Â % of phones shipped last quarter run android. http://bgr.com/2014/07/31/android-vs-ios-vs-windows-phone-vs-blackberry/
Cisco 2014 annual security report. http://www.cisco.com/web/offer/gist_ty2_asset/Cisco_2014_ASR.pdf
App ops: Android 4.3’s hidden app permission manager, control permissions for individual apps! http://www.androidpolice.com/2013/07/25/app-ops-android-4--3s/hidden-app-permission-manager/-control-permissions-for/-individual-apps/
App ops removed by google in android 4.4.2 update. http://www.phonearena.com/news/App-Ops-removed-by-Google-in-Android-4.4.2-update_id50340/
Nauman, M., Khan, S., Zhang, X.: Apex: extending android permission model and enforcement with user-defined runtime constraints. In: Proceedings of the 5th ACM Symposium on Information, Computer and Communications Security (2010)
Conti, M., Nguyen, V.T.N., Crispo, B.: CRePE: context-related policy enforcement for android. In: Burmester, M., Tsudik, G., Magliveras, S., Ilić, I. (eds.) ISC 2010. LNCS, vol. 6531, pp. 331–345. Springer, Heidelberg (2011)
Zhou, Y., Zhang, X., Jiang, X., Freeh, V.W.: Taming information-stealing smartphone applications (on android). In: McCune, J.M., Balacheff, B., Perrig, A., Sadeghi, A.-R., Sasse, A., Beres, Y. (eds.) Trust 2011. LNCS, vol. 6740, pp. 93–107. Springer, Heidelberg (2011)
Wang, Y., Hariharan, S., Zhao, C., Liu, J., Du, W.: Compac: enforce component-level access control in android. In: Proceedings of the 4th ACM Conference on Data and Application Security and Privacy (2014)
Ongtang, M., McLaughlin, S., Enck, W., McDaniel, P.: Semantically rich application-centric security in android. In: Annual Computer Security Applications Conference (2009)
Bugiel, S., Heuser, S., Sadegh, A.R.: Flexible and fine-grained mandatory access control on android for diverse security and privacy policies. In: 22nd USENIX Security Symposium (USENIX Security 2013) (2013)
Smalley, S., Craig, R.: Security enhanced (SE) android: bringing flexible mac to android. In: NDSS (2013)
Davis, B., Sanders, B., Khodaverdian, A., Chen, H.: I-arm-droid: a rewriting framework for in-app reference monitors for android applications. In: Proceedings of the Mobile Security Technologies 2012, MOST 2012. IEEE (2012)
Davis, B., Chen, H.: RetroSkeleton: retrofitting android apps. In: Proceeding of the 11th Annual International Conference on Mobile Systems, Applications, and Services (2013)
Backes, M., Gerling, S., Hammer, C., Maffei, M., von Styp-Rekowsky, P.: AppGuard – enforcing user requirements on android apps. In: Piterman, N., Smolka, S.A. (eds.) TACAS 2013 (ETAPS 2013). LNCS, vol. 7795, pp. 543–548. Springer, Heidelberg (2013)
Xu, R., Saïdi, H., Anderson, R.: Aurasium: practical policy enforcement for android applications. In: Proceedings of the 21st USENIX Conference on Security Symposium (2012)
Jeon, J., Micinski, K.K., Vaughan, J.A., Fogel, A., Reddy, N., Foster, J.S., Millstein, T.: Dr. Android and Mr. Hide: fine-grained permissions in android applications. In: Proceedings of the Second ACM Workshop on Security and Privacy in Smartphones and Mobile Devices (2012)
Hao, H., Singh, V., Du, W.: On the effectiveness of API-level access control using bytecode rewriting in android. In: Proceedings of the 8th ACM SIGSAC Symposium on Information, Computer and Communications Security (2013)
Hao, S., Li, D., Halfond, W.G., Govindan, R.: SIF: a selective instrumentation framework for mobile applications. In: Proceeding of the 11th Annual International Conference on Mobile Systems, Applications, and Services (2013)
Kernel probes. http://sourceware.org/systemtap/kprobes/
Ftrace. http://elinux.org/Ftrace
Russello, G., Jimenez, A.B., Naderi, H., van der Mark, W.: FireDroid: hardening security in almost-stock android. In: Proceedings of the 29th Annual Computer Security Applications Conference (2013)
Wandoujia. http://www.wandoujia.com/
Hornyack, P., Han, S., Jung, J., Schechter, S., Wetherall, D.: These aren’t the droids you’re looking for: retrofitting android to protect data from imperious applications. In: Proceedings of the 18th ACM Conference on Computer and Communications Security, CCS 2011 (2011)
Acknowledgement
This research was supported by the National Grand Fundamental Research 973 Program of China (Grant No. 2013CB338001 and No. 2014CB340603) and program of Computer Network Information Center of Chinese Academy of Sciences.
Author information
Authors and Affiliations
Corresponding author
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2015 Springer International Publishing Switzerland
About this paper
Cite this paper
Wang, X., Wang, Y., Liu, L., Lei, L., Jing, J. (2015). WrapDroid: Flexible and Fine-Grained Scheme Towards Regulating Behaviors of Android Apps. In: Lee, J., Kim, J. (eds) Information Security and Cryptology - ICISC 2014. ICISC 2014. Lecture Notes in Computer Science(), vol 8949. Springer, Cham. https://doi.org/10.1007/978-3-319-15943-0_16
Download citation
DOI: https://doi.org/10.1007/978-3-319-15943-0_16
Published:
Publisher Name: Springer, Cham
Print ISBN: 978-3-319-15942-3
Online ISBN: 978-3-319-15943-0
eBook Packages: Computer ScienceComputer Science (R0)