DyPolDroid: Protecting Against Permission-Abuse Attacks in Android

Carlos E. Rubio-Medrano, Pradeep Kumar Duraisamy Soundrapandian, Matthew Hill, Luis Claramunt, Jaejong Baek, S. Geetha, Gail Joon Ahn

Research output: Contribution to journalArticlepeer-review

Abstract

Android applications are extremely popular, as they are widely used for banking, social media, e-commerce, etc. Such applications typically leverage a series of Permissions, which serve as a convenient abstraction for mediating access to security-sensitive functionality within the Android Ecosystem, e.g., sending data over the Internet. However, several malicious applications have recently deployed attacks such as data leaks and spurious credit card charges by abusing the Permissions granted initially to them by unaware users in good faith. To alleviate this pressing concern, we present DyPolDroid, a dynamic and semi-automated security framework that builds upon Android Enterprise, a device-management framework for organizations, to allow for users and administrators to design and enforce so-called Counter-Policies, a convenient user-friendly abstraction to restrict the sets of Permissions granted to potential malicious applications, thus effectively protecting against serious attacks without requiring advanced security and technical expertise. Additionally, as a part of our experimental procedures, we introduce Laverna, a fully operational application that uses permissions to provide benign functionality at the same time it also abuses them for malicious purposes. To fully support the reproducibility of our results, and to encourage future work, the source code of both DyPolDroid and Laverna is publicly available as open-source.

Original languageEnglish (US)
JournalInformation Systems Frontiers
DOIs
StateAccepted/In press - 2022
Externally publishedYes

Keywords

  • Access control
  • Android enterprise
  • Permission-abuse attacks

ASJC Scopus subject areas

  • Software
  • Theoretical Computer Science
  • Information Systems
  • Computer Networks and Communications

Fingerprint

Dive into the research topics of 'DyPolDroid: Protecting Against Permission-Abuse Attacks in Android'. Together they form a unique fingerprint.

Cite this