A formal approach for detection of security flaws in the android permission system
Name
165_2017_445_ReferencePDF.pdf
Size
659.44 KB
Format
Adobe PDF
Checksum (MD5)
68130297eb13e6d970134a64488f204e
Author(s)
Bagheri, Hamid
Kang, Eunsuk
Malek, Sam
Jackson, Daniel
Date Issued
November 2017
Journal
Formal Aspects of Computing
Publisher
Springer London
Citation
Bagheri, Hamid, et al. “A Formal Approach for Detection of Security Flaws in the Android Permission System.” Formal Aspects of Computing, vol. 30, no. 5, Sept. 2018, pp. 525–44.
Version
Author's final manuscript
Abstract
The ever increasing expansion of mobile applications into nearly every aspect of modern life, from banking to healthcare systems, is making their security more important than ever. Modern smartphone operating systems (OS) rely substantially on the permission-based security model to enforce restrictions on the operations that each application can perform. In this paper, we perform an analysis of the permission protocol implemented in Android, a popular OS for smartphones. We propose a formal model of the Android permission protocol in Alloy, and describe a fully automatic analysis that identifies potential flaws in the protocol. A study of real-world Android applications corroborates our finding that the flaws in the Android permission protocol can have severe security implications, in some cases allowing the attacker to bypass the permission checks entirely. Keywords: Android, Permission protocol, Alloy, Verification
MIT Department
Massachusetts Institute of Technology. Department of Electrical Engineering and Computer Science
Terms of Use
Creative Commons Attribution-Noncommercial-Share Alike
Persistent DSpace Link
DOI of Published Version
https://doi.org/10.1007/s00165-017-0445-z
