1. Suwen Zhu, Long Lu, Kapil Singh
CASE: Comprehensive Application Security Enforcement on COTS Mobile Devices
Suwen Zhu, Long Lu, Kapil Singh
ACM MobiSys 2016

2. Emerging Module-level Attacks
11/23/2018
CASE: Comprehensive Application Security Enforcement on COTS Mobile Devices
Emerging Module-level Attacks
External Modules in mobile apps
Usages: ads, analytics, social networks, utilities, etc.
Granularities: from libraries to classes
Some reported attacks
Advertising libs aggressively collecting user demographic info
In-app payment libs (18,000 Android apps) covertly upload SMS messages
“Module-level attacks”
Module-to-module
Module-to-system

3. Attack Driving Factors
11/23/2018
CASE: Comprehensive Application Security Enforcement on COTS Mobile Devices
Attack Driving Factors
Increasing decency on external modules
Strong incentives for attackers
Easy-to-launch and hard-to-prevent

4. Defense Challenges & Requirements
11/23/2018
CASE: Comprehensive Application Security Enforcement on COTS Mobile Devices
Defense Challenges & Requirements
Conventional app security
sandbox, permissions, etc.
operating at app level
Previous research
fine-grained objects
but not subjects
Fine-grained Modules
Complete module-level mediation
Robustness

5. 11/23/2018
CASE: Comprehensive Application Security Enforcement on COTS Mobile Devices
Introducing CASE
Goal: comprehensive security enforcement on individual app modules
Approach
Offline rewriting + runtime monitoring
Policy-driven enforcement
No OS/middleware changes
Operating purely in user-spacing
Example use cases
Limiting ad libs’ data/network/sensor access
Enabling least privilege at the module level

6. CASE Threat Model Untrusted Apps / modules Middleware / app runtime
11/23/2018
CASE: Comprehensive Application Security Enforcement on COTS Mobile Devices
CASE Threat Model
Untrusted
Apps / modules
Middleware / app runtime
Trusted OS
Hardware

7. Challenges Modules of various sizes Implicit module crossings
11/23/2018
CASE: Comprehensive Application Security Enforcement on COTS Mobile Devices
Challenges
Modules of various sizes
Implicit module crossings
Completeness
Bypassing interception
Tampering with enforcement
Robustness
Two properties: interception integrity and interception invisibility

8. Core Techniques Dual-layer Interception Native-safe Pages
11/23/2018
CASE: Comprehensive Application Security Enforcement on COTS Mobile Devices
Core Techniques
Dual-layer Interception
Fine-grained modules
Capturing module-to-module and module-to-system activities
Native-safe Pages
Preventing Implicit crossing and other bypass
Concealed Handler
Preventing tampering

9. Dual-layer Interception
11/23/2018
CASE: Comprehensive Application Security Enforcement on COTS Mobile Devices
Dual-layer Interception
Two Interception layers VM
Syscall wrappers
Hooking Techniques
GOT hooks
Dynamic binary patching

10. Dual-layer Interception
11/23/2018
CASE: Comprehensive Application Security Enforcement on COTS Mobile Devices
Dual-layer Interception
MinSet: Set of interception points
3 executables: libc, linker, libdvm (libart)
30 native functions
Purposes
class management
reflection interception
process management
self-protection
file/socket/IPC interception

11. 11/23/2018
CASE: Comprehensive Application Security Enforcement on COTS Mobile Devices
Native-safe Pages
Preventing native code from abusing syscall interfaces and VM data
For syscall wrappers
Locking original wrappers
No per-access unlock
Using hidden duplicates
Rewriter disallows use of swi in JNI

12. Native-safe Pages For VM internal data Generic for other uses
11/23/2018
CASE: Comprehensive Application Security Enforcement on COTS Mobile Devices
Native-safe Pages
For VM internal data
Locking VM data pages during JNI
Signal-based thread scheduler
Generic for other uses
Enabling exclusive call gates
Protecting sensitive memory data

13. 11/23/2018
CASE: Comprehensive Application Security Enforcement on COTS Mobile Devices
Concealed Handler
Enabling blind invocation and atomic execution of (sensitive) functions
Leveraging POSIX signals
Preventing partial or shortcut execution of security checks
Example: system call check

14. Evaluation: App Sets 420 popular apps 20 apps randomly drawn from S1
11/23/2018
CASE: Comprehensive Application Security Enforcement on COTS Mobile Devices
Evaluation: App Sets
420 popular apps
20 apps randomly drawn from S1
Android’s unit tests S1 S2 S3

15. Evaluation: Results Rewriting Cost and Compatibility Tests (using S1)
11/23/2018
CASE: Comprehensive Application Security Enforcement on COTS Mobile Devices
Evaluation: Results
Rewriting Cost and Compatibility Tests (using S1)
Avg. app patch time: 6.34 sec
Avg. executable size increases: 4.22%
Failed or crashed apps: 0
Runtime Overhead (overall tests, using S1)
Avg. app startup delay: seconds
Battery overhead (exhaustion): 6.43%
Runtime Overhead (unit tests, using S2 and S3)
Avg. per-operation overhead: 3.91%
Avg. end-to-end overhead: 4.93%

16. 11/23/2018
CASE: Comprehensive Application Security Enforcement on COTS Mobile Devices
Conclusion
CASE enables fine-grained module-level security in Android apps
Approach requires no change to OS or middleware
Design is robust against malicious Java and native code
Evaluation on 420 real apps shows acceptable overhead

17. Thank you! Long Lu long@cs.stonybrook.edu www.longlu.org
11/23/2018
CASE: Comprehensive Application Security Enforcement on COTS Mobile Devices
Thank you!
Long Lu