Skip to main content
SpringerLink
Log in

System-level attacks against android by exploiting asynchronous programming

  • Published:
Software Quality Journal Aims and scope Submit manuscript

Abstract

To avoid unresponsiveness, Android developers utilize asynchronous programming to schedule long-running tasks in the background. In this work, we conduct a systematic study on IntentService, one of the async constructs provided by Android using static program analysis, and find that in Android 6, 974 intents can be sent by third-party applications without protection. Based on this observation, we develop a tool, ATUIN, to demonstrate the feasibility of attacking a CPU automatically by exploiting the intents that can be handled by an Android system. Furthermore, by investigating the unprotected intents, we discover tens of critical vulnerabilities that have not been reported before, including Wi-Fi DoS, telephone signal blocking, SIM card removal, homescreen hiding, and NFC state cheating. Our study sheds light on research into protecting asynchronous programming from being exploited by hackers.

This is a preview of subscription content, log in via an institution to check access.

Access this article

Log in via an institution

Price excludes VAT (USA)
Tax calculation will be finalised during checkout.

Instant access to the full article PDF.

Institutional subscriptions

Fig. 1
Fig. 2
Fig. 3
Fig. 4
Fig. 5
Fig. 6
Fig. 7
Fig. 8
Fig. 9
Fig. 10
Fig. 11
Fig. 12
Fig. 13
Fig. 14
Fig. 15
Fig. 16
Fig. 17
Fig. 18
Fig. 19
Fig. 20
Fig. 21
Fig. 22
Fig. 23
Fig. 24
Fig. 25
Fig. 26
Fig. 27
Fig. 28

Similar content being viewed by others

References

  • Alam, F., Panda, P.R., Tripathi, N., Sharma, N., & Narayan, S. (2014). Energy optimization in Android applications through wakelock placement, Proceedings of DATE (pp. 1–4).

    Google Scholar 

  • Armando, A., Merlo, A., Migliardi, M., & Verderame, L. (2012). Would you mind forking this process? A denial of service attack on Android (and some countermeasures), Proceedings of IFIP SEC (pp. 13–24).

    Google Scholar 

  • Bandla. Android Version Share: Lollipop still leads with 34%, Nougat at 0.4%. http://www.gadgetdetail.com/android-version-market-share-distribution/.

  • Bauer, M., Coatsworth, M., & Moeller, J. (2015). NANSA: A no-attribution nosleep battery exhaustion attack for portable computing devices.

  • Chen, T., Tang, H., Zhou, K., Zhang, X., & Lin, X. (2016). Silent Battery Draining Attack Against Android Systems by Subverting Doze Mode, Proceedings of the GlobeCom.

    Google Scholar 

  • Eian, M., & Mjolsnes, S. (2012). A formal analysis of IEEE 802.11w deadlock vulnerabilities, Proceedings of INFOCOM.

    Google Scholar 

  • Fiore, U., Palmieri, F., Castiglione, A., Loia, V., & De Santis, A. (2014). Multimedia-based battery drain attacks for android devices, Proceedings of CCNC (pp. 145–150).

    Google Scholar 

  • Gordon, M.S., Hong, D.K., Chen, P.M., Flinn, J., Mahlke, S., & Mao, Z.M. (2015). Accelerating mobile applications through flip-flop replication, Proceedings of MobiSys (pp. 137–150).

    Chapter  Google Scholar 

  • Guo, C., Zhang, J., Yan, J., Zhang, Z., & Zhang, Y. (2013). Characterizing and detecting resource leaks in android applications, Proceedings of ASE (pp. 389–398).

    Google Scholar 

  • Huang, H., Zhu, S., Chen, K., & Liu, P. (2015). From system services freezing to system server shutdown in android All you need is a loop in an app, Proceedings of CCS (pp. 1236–1247).

    Chapter  Google Scholar 

  • Jindal, A., Pathak, A., Hu, Y.C., & Midkiff, S. (2013a). Hypnos: understanding and treating sleep conflicts in smartphones, Proceedings of EuroSys (pp. 253–266).

    Google Scholar 

  • Jindal, A., Pathak, A., Hu, Y.C., & Midkiff, S. (2013b). On death, taxes, and sleep disorder bugs in smartphones, Proceedings of HotPower (pp. 1–5).

    Google Scholar 

  • Kang, Y., Zhou, Y., Xu, H., & Lyu, M.R. (2016). DiagDroid: Android performance diagnosis via anatomizing asynchronous executions, Proceedings of the FSE (pp. 410–421).

    Google Scholar 

  • Lee, K., Chu, D., Cuervo, E., Kopf, J., Degtyarev, Y., Grizan, S., Wolman, A., & Flinn, J. (2015). Outatime: Using speculation to enable low-latency continuous interaction for mobile cloud gaming, Proceedings of MobiSys (pp. 151–165).

    Chapter  Google Scholar 

  • Lin, Y., Radoi, C., & Dig, D. (2014). Retrofitting concurrency for android applications through refactoring, Proceedings of the FSE, 2014 (pp. 341–352).

    Google Scholar 

  • Lin, Y., Radoi, C., & Dig, D. (2015). Study and refactoring of android asynchronous programming, Proceedings of the ASE. 2015 (pp. 224–235).

    Google Scholar 

  • Linares-Vásquez, M., Vendome, C., Luo, Q., & Poshyvanyk, D. (2015). How developers detect and fix performance bottlenecks in android apps, Proceedings of ICSME (pp. 352–361).

    Google Scholar 

  • Liu, Y., Xu, C., & Cheung, S.-C. (2014). Characterizing and detecting performance bugs for smartphone applications, Proceedings of ICSE (pp. 1013–1024).

    Google Scholar 

  • Nguyen, D.T., Zhou, G., Xing, G., Qi, X., Hao, Z., Peng, G., & Yang, Q. (2015). Reducing smartphone application delay through read/write isolation, Proceedings of Mobisys (pp. 287–300).

    Chapter  Google Scholar 

  • Pathak, A., Jindal, A., Hu, Y.C., & Midkiff, S.P. (2012). What is keeping my phone awake?: characterizing and detecting no-sleep energy bugs in smartphone apps, Proceedings of MobiSys (pp. 267–280).

    Chapter  Google Scholar 

  • Schartner, P., & Bürger, S. (2012). Attacking Android’s Intent Processing and First Steps towards Protecting it. Technical Report TR-syssec-12-01, Universität Klagenfurt.

  • Terada, T. (2014). Attacking Android browsers via intent scheme. http://www.mbsd.jp/Whitepaper/IntentScheme.pdf http://www.mbsd.jp/Whitepaper/IntentScheme.pdf.

  • Wang, K., Zhang, Y., & Liu, P. (2016). Call me Back!: attacks on system server and system apps in android through synchronous callback, Proceedings of CCS (pp. 92–103).

    Google Scholar 

  • Xu, G., Mitchell, N., Arnold, M., Rountev, A., Schonberg, E., & Sevitsky, G. (2012). Finding low-utility data structures, Proceedings of PLDI (pp. 174–186).

    Google Scholar 

  • Yang, S., Yan, D., & Rountev, A. (2013). Testing for poor responsiveness in Android applications, Proceedings of the MOBS (pp. 1–6).

    Google Scholar 

  • Yang, K., Zhuge, J., Wang, Y., Zhou, L., & Duan, H. (2014). Intentfuzzer: detecting capability leaks of android applications, Proceedings of ASIACCS (pp. 531–536).

    Google Scholar 

  • Zhang, L., Gordon, M.S., Dick, R.P., Mao, Z., Dinda, P.A., & Yang, L. (2012). ADEL: An automated detector of energy leaks for smartphone applications, Proceedings of CODES+ISSS (pp. 363–372).

    Chapter  Google Scholar 

Download references

Acknowledgements

This work is supported in part by the Hong Kong GRF (PolyU 152279/16E), the HKPolyU Research Grants (G-YBJX), Shenzhen City Science and Technology R&D Fund (No. JCYJ20150630115257892), the National Natural Science Foundation of China (Nos. 61402080, 61572115, 61502086, and 61572109), and China Postdoctoral Science Foundation founded project (No. 2014M562307). We specially thank Dr. Yajuan Tang from College of Engineering, Shantou University for her assist in improving our paper.

Author information

Authors and Affiliations

  1. Cybersecurity Research Center, University of Electronic Science and Technology of China, Chengdu, China

    Ting Chen & Xiaosong Zhang

  2. Department of Computing, The Hong Kong Polytechnic University, Kowloon, Hong Kong

    Xiaoqi Li & Xiapu Luo

Authors
  1. Ting Chen
    View author publications

    You can also search for this author in PubMed Google Scholar

  2. Xiaoqi Li
    View author publications

    You can also search for this author in PubMed Google Scholar

  3. Xiapu Luo
    View author publications

    You can also search for this author in PubMed Google Scholar

  4. Xiaosong Zhang
    View author publications

    You can also search for this author in PubMed Google Scholar

Corresponding author

Correspondence to Ting Chen.

Rights and permissions

Reprints and permissions

About this article

Check for updates. Verify currency and authenticity via CrossMark

Cite this article

Chen, T., Li, X., Luo, X. et al. System-level attacks against android by exploiting asynchronous programming. Software Qual J 26, 1037–1062 (2018). https://doi.org/10.1007/s11219-017-9374-6

Download citation

  • Published:

  • Issue Date:

  • DOI: https://doi.org/10.1007/s11219-017-9374-6

Keywords

Search

Navigation