1. Android and IOS Permissions Why are they here and what do they want from me?

2. Road Map What is a Permission What permissions do Why do they exist Malicious Code Injection Conclusion

3. What is a Permission? A central design point of the Android security architecture. No application, by default, has permission to perform any operations that would adversely impact other applications, the operating system, or the user.

4. What Permissions Actually Do A basic Android application has no permissions associated with it by default, meaning it cannot do anything that would adversely impact the user experience or any data on the device. Sandbox Environment Allows the device to grant access to the protected system specified.

5. What Permissions Actually Do (continued) Permission requests are displayed for you once at install. Allows for fluid app use, without constant interruptions for requests. If Accepted the intended app will download. If denied, no part of the app will be installed.

6. Why do Permissions Exist? They protect the end user. Allows the end user to see what an app accesses. Deem safe or unsafe Particularly useful for Android platform Open source software Malicious code does exist

7. Understanding Permissions Each permission outlines what is being used in a general sense. Permissions are mostly catch all statement. Just because an app “can” use it, doesn’t mean it will.

8. Permission Example

9. Permission Example (cont…) Facebook Messenger Permissions Call. Texts messages. Camera. Microphone. Location. Network. Etc…

10. Permission Example (cont…) Facebook Messenger Permissions Facebook Messenger is operating in a Sandbox Environment Call App can call people in your contacts If you call a number that would cost you normally, then it will cost you in the App. Read phone status and identity So you don’t have to sign into Facebook every time you access the App.

11. Permission Example (cont…) Facebook Messenger Permissions Take Pictures and Videos App can take pictures or videos and send them in a message without ever leaving the App itself. Record Audio Same as taking the picture or video, you can send sound bites to friends within the App.

12. Permission Example (cont…) Facebook Messenger Permissions Catch all statements get a bad rep in certain cases SD access Stores information in a cache, not your physical SD card.

13. Permission Example (cont…) Facebook Messenger Permissions Without these permissions the App would hardly run at all.

14. Permissions Exceptions Malicious code does exist Some third party apps request permissions they don’t need For example Flappy bird.apk Flappy bird removed from google store Only available from third party sites Leading to malicious code injection Odd permission requests Flappy bird doesn’t need to read your emails.

15. Mobile Threats It has been found that 4 of the 10 top malware threats infecting Smartphones are Spyware. Moreover, the top 20 malware threats include “Trojanized” apps that steal data about the phone or send SMS messages.

16. Top Mobile Threats The top mobile threats are: Coogos.A!tr Trojan for android devices It checks if the victim is rooted Silently and automatically downloads a malicious system package into the device Uapush.A Adware Trojan for android Sends SMSs and steals data from the compromised device SMSTracker Android spy phone app Records all incoming and outgoing information

17. Top Mobile Threats The top mobile threats are: iBryte Adware Installs toolbars and displays pop-up advertisements on the infected device. ZeroAccess Peer-to-peer (P2P) bot that uses rootkit technology Hides its presence Downloads additional malware Large scale Ad-click fraud

18. Malicious Code Injection Focus on Spyware. In a sample of 500,000 users 1 in 800 android users were impacted. “SpyPhone” software doesn't take advantage of any exploits or vulnerabilities, and doesn't actually need to compromise the phone in any special way.

19. Malicious Code Injection After the infected app is installed, the user has no idea, what has happened. The Spyware will run even when the app is not open, because it is being executed as an android service. What can this Spyware do? Read all your message archives Use either camera, for pictures or video. (without notification) Send location info Steal credit cards or passwords with screen mirroring and key logging Send messages and make calls remotely from your phone.

20. Malicious Code Injection 99% of these spyware applications exist in 3 rd party app stores. Google Play services wouldn’t allow multiple copies of an app from different authors. Makes it hard for code injection on main channels. What stops developers from making their own app and having spyware attached already, as a sort of Trojan horse? Nothing… Downfall of open source Google services working on better permissions.

21. Conclusion Better understanding of what a Permission is Understanding of what permissions do Understand why they exist Better understanding of Malicious Code Injection

22. Works Cited http://www.androidcentral.com/facebook-messenger-permissions- not-scary-stories-might-have-you-believe http://www.androidcentral.com/facebook-messenger-permissions- not-scary-stories-might-have-you-believe http://www.androidcentral.com/look-application-permissions http://developer.android.com/guide/topics/security/permissions.htm l#top http://developer.android.com/guide/topics/security/permissions.htm l#top