application-layer security extensions · 2016-09-15 · 1 application-layer security extensions •...

Application-layer security extensions

• Inlined Reference Monitoring• App Virtualization• Compiler-based instrumentation

GOALS &USE-CASES

§ Deploysecuritysolutionsindependentlyfromthedevice/OSvendororappdevelopers

- Endusershouldempowered

§ Ifpossibleabstainfromescalatedprivileges,i.e.,fromroot

§ Providestrongestpossiblesecurityguarantees

POSSIBLE APPLICATION-LAYER SOLUTIONS

§ Variousapplicationareas,suchas:

- Privacyprotection• E.g.,AppGuard [99],Aurasium [100],I-ARM-Droid[101],RetroSkeleton [102],DroidForce [103]

- Deployingthird-partysecuritypatches• E.g.,AppSealer [104],Capper[105]

- Enforcingenterprisepolicies• E.g.,DeepDroid [106]

- PatchingAndroidvulnerabilities• E.g.,PatchDroid [107]

- Appvirtualization• E.g.,Boxify [108],NJAS[109]

Inlined Reference Monitoring

MOTIVATION

Existingpermissionsystem Understandanappsbehavior Enforceadesiredlevelofprivacy

How to enforce such dynamic permissions?

PROBLEM DESCRIPTION

§ IdeallyperformedatOS/Middlewarelayerà Requiresfirmwaremodification!

UntrustedApp

OperatingSystem

Monitor

PROBLEM DESCRIPTION

§ Androidisolatesappprocesses:“allappsarecreatedequal”à Monitornotprivilegedenough!

Untr.App

OperatingSystem

MonitorApp

PROBLEM DESCRIPTION

§ Androidisolatesappprocesses:“allappsarecreatedequal”à Monitornotprivilegedenough!

§ Solution: Combinemonitorandappinto“self-monitoring”app

OperatingSystem

Monitor

UntrustedApp

INLINE REFERENCE MONITORING

§ DynamicAccessControl

– Preventappsfromaccessingcertainsystemresources– Revocationandre-grantingofpermissions

§ Fine-granularSecurityPolicies

– Comprehensibleforuser– Expressivefordeveloper

§ “Gracefuldegradation”

– Appsshouldnotcrashafteraccesstorestrictedresource

§ NochangetotheOS

– DeploymentasregularAndroidapp(no root)

INLINE REFERENCE MONITORING

§ Goal:Mediatesecurity-relevantoperations

- Monitorprogrambehavioratcriticalpoints

- Instrumentprogramtoredirectcontrolflowtothemonitor

- Takeactionbasedonsecuritypolicy

• Terminateprogram

• Suppressoperation

§ Security-relevantoperations

- Functioncalls:JavaCoreAPI,AndroidAPI

- Controlflowredirectioneitheratcaller-site orcallee-site

§ Typicallybybytecodemodification

7. BWINF Forschungstage

CALLER- VS.CALLEE-SITE REWRITING

Strings;URLu;

s=“http://attacker.com/“;u=newURL(s);u.openConnection();...

UntrustedApp

Application.main()

SystemLibrary

URL.openConnection()

...returnconnection;

2. CyberCrime Kongress 2013

CALLEE-SITE REWRITING

Monitor

Monitor.checkConnection(url)

if(!connectionAllowed(url)){System.exit();

Strings;URLu;

UntrustedApp

Application.main()

SystemLibrary

...returnconnection;Monitor.checkConnection(this);...returnconnection;

CALLER-SITE REWRITING

Strings;URLu;

s=“http://attacker.com/“;u=newURL(s);Monitor.openConnection(u);...

UntrustedApp

Application.main()

SystemLibrary

...returnconnection;

Monitor

Monitor.openConnection(url)

if(connectionAllowed(url)){returnurl.openConnection();

}else{System.exit();

Strings;URLu;

CALLER- VS.CALLEE-SIDE REWRITING

Caller-side

Manyplacestoinstrument

Dynamicallyloadedcode

Reflection

Possibleinpracticeforend-users

Callee-side

Fewplacestoinstrument

Dynamicallyloadedcode

Reflection

Impossibleinpracticeforend-users

APPGUARD:REWRITER

§ Rewriter

- WorksdirectlyonDalvikexecutable(DEX)bytecode

- Generatesruntimemonitorfrompoliciesandmergesitintothetargetapp

- Identifiesinvocationsofsecurity-relevantmethodswithinthetargetapp‘sbytecode

- Rewritestargetapptocallintothemonitorrightbeforeeveryinvocationofasecurity-relevantmethod(caller-siterewriting)

- Additionaltry-catchblockallowsmonitortosuppressthesecurity-relevantmethodcallandreturnamockvalue

APPGUARD:REWRITER

URL url = new URL(loc);try {

url.openConnection();} catch (IOException) {

// handle IOException}

URL url = new URL(loc);try {

Monitor.checkConnection(url);url.openConnection();

} catch (IOException) {// handle IOException

} catch (MonitorException) {// no return value, ignore

TelephonyManager tm =getTelephonyManager();

String deviceId = tm.getDeviceId();

TelephonyManager tm =getTelephonyManager();

String deviceId;try {

Monitor.checkDeviceId(tm);deviceId = tm.getDeviceId();

} catch (MonitorException e) {deviceId = e.mockValue();

Original code After rewriting

DIFFERENT SOLUTIONS TO IRM

APPGUARD – CONCEPTUAL OVERVIEW

Policies

Manage-mentRewriterUntrusted

Monitor

UntrustedApp

logging

config

Implemented as stand-alone app:

à easily deployable

APPGUARD:MANAGEMENT

§ UIforrewritingappsonthephone

Forschungstage Informatik 2014

APPGUARD:MANAGEMENT

§ Policyconfigurationperapp

- Passedtotargetappviaworld-readableconfigfile

- Fine-grainedconfigurationsupported

APPGUARD:MANAGEMENT

§ Logofsecurity-relevantevents

- PushedviaIPCfrominlinedmonitor

CASE STUDIES

§ Providesweatherinformation&forecast

§ Displaysadvertisements

§ Situation

- Retrievesweatherdatafromwetter.com

- RequestsINTERNET permissionforfullInternetaccess

§ Solution

- Selectivelyallowaccesstowetter.com serversonly

- Nomoreadvertisementsdisplayed

Wetter.com

CASE STUDIES

§ Mobileclientforpopularmicro-bloggingservice

§ Situation

- AutomaticallytransferscontactdatatoTwitterserverswithoutuser‘sknowledgeorconsent

- PartofTwitter‘s„findfriends“feature

§ Solution

- Blockaccesstouser‘scontactdata

- Friendscanstillbeaddedmanually

Twitter

CASE STUDIES

§ Tracksyouroutdoorsportactivities(running,cycling,etc...)

§ Createspersonalsportsprofile

§ Situation

- LeaksauthenticationtokenviaHTTP

§ Solution

- InterceptHTTP connectionsandredirecttoencryptedHTTPS

EndomondoSportsTracker

CASE STUDIES

§ Simpletimerapp

§ RequiresINTERNET permissiononly

§ Situation

- Uploadsuser‘spersonalphotostopublicphotosharingsite

- Nopermissionrequiredtoaccessphotosstorage

§ Solution

- Blockaccesstophotostorage

(Evil)TeaTimer

APPGUARD:DISCUSSION

§ Practicalsolutiontoapressingsecurityproblem

- Negligibleruntimeoverhead(<6%)

- Reasonablerewritingtime(5-60seconds)

- Deployed&widelyadopted(~1milliondownloadsover8months)

§ Generalpurposelightweightruntimeinstrumentation

- Onlyminimalstaticrewriting(caller-site)necessary

§ Inlined referencemonitorsharesthesameprocessspaceastheuntrustedmonitoredcode

§ Nostrongsecurityboundarybetweenmonitoringandmonitoredcode!

▶Maliciouscodecanattackanddisable/modifythereferencemonitor!

§ Rewritermustbeabletoidentifythecall-sites

▶MaliciouscodecanincludecustomimplementationsofSDKfunctionswithdifferentfunctionsignatures!

▶Nativecodenotcovered!

DRAWBACKS OF INLINED REFERENCE MONITORING

§ Androidreliesonsame-originmodelforapplicationupdates

- Everyappiscryptographicallysignedbyitsdeveloper

- Digitalsignatureidentifiesorigin

- Appupdatesonlyallowediffromsameorigin(i.e.,havingsamesignatureasoriginalapp)

§ IRMbreakswiththesameoriginmodel,becauseapplicationcodehastobeinstrumentedwithinlined code

▶ Breaksthedigitalsignatureandhenceorigin!

DRAWBACKS OF INLINED REFERENCE MONITORING (2)

App virtualization

MOTIVATION

Cells[SOSP‘11]

Apex[ASIACCS‘10]

ASM[SEC‘15]

L4Android[SPSM‘11]

AppGuard[TACAS‘13]

TaintDroid[OSDI‘10]

CRePE[ISC‘10] TrustDroid

[SPSM‘11]

I-ARM-Droid[MoST‘12] DroidForce

[ARES‘14]

MOSES[SACMAT‘12]

AirBag[NDSS‘14]

Aurasium[SEC‘12]

FlaskDroid[SEC‘13]

RetroSkeleton[MobiSys‘13]

Dr. Android & Mr. Hide[SPSM‘12]

OS Extensions Application LayerSolutions

ANDROID OSEXTENSIONS

SystemServices

LinuxKernelBinderIPC Syscall API

App App

Kernel Boundary

Process Boundary

ANDROID OSEXTENSIONS

SystemServices

Linux KernelBinderIPC

Syscall API

App App

Monitor

✔ Strongsecurity

✖ Hard to deploy

APPLICATION LAYER SOLUTIONS

SystemServices

LinuxKernelBinderIPC Syscall API

App App

APPLICATION LAYER SOLUTIONS

SystemServices

Linux KernelBinderIPC Syscall API

App AppMonitor

✔ Easyto deploy

✖ No app monitoring possible

INLINED REFERENCE MONITORING

SystemServices

AppAppMonitor

✔ Easyto deploy

✖ Weak security

GOAL OF APP VIRTUALIZATION

✖ Hard to deploy

OS Extensions ApplicationLayer Solutions

✔ Strong security

✔ Easy to deploy

✖ Weak security

GOAL OF APP VIRTUALIZATION

✖ Hard to deploy

✔ Strong security

OS Extensions ApplicationLayer Solutions

✔ Easy to deploy

✖ Weak security

Our Goal

✔ Easy to deploy

✔ Strong security

OBJECTIVES

Monitorand constrain untrusted applications

✔ Easyto deploy- No firmware modification /root- No application modification

✔ Strongsecurity- Protected reference monitor- Fail-safedefaults

APPROACH (1)

Objective: Nofirmwaremodification/root

Solution: Regularuser-spaceapplication

SystemServices

App AppMonitor

APPROACH (2)

SystemServices

AppAppMonitorSystemServices

App AppMonitor

Objective: Noapplicationmodification

APPROACH (2)

Objective: Noapplicationmodification

Solution: Applicationvirtualization

SystemServices

MonitorAppApp

APPROACH (3)

SystemServices

MonitorAppAppSystemServices

Monitor AppShimApp

Objective: Protectedreferencemonitor

Solution: Separateprocess

APPROACH (4)

Objective: Fail-safedefaults

SystemServices

Monitor AppShimApp

APPROACH (4)

SystemServices

Monitor AppShimApp

APPROACH (4)

SystemServices

Monitor AppZeroPerm

APPROACH (4)

Solution: Isolatedprocess

ISOLATED PROCESS

§ Allowsservicecomponents torunisolatedfromtherestoftheapplication

§ Isolatedprocesses

- Havezeropermissions

- Havenoaccesstosystemservices

- Runwithadistinct,transientUID

- Cannotwritetothefilesystem

APP VIRTUALIZATION ARCHITECTURE

Boxify

SystemServices

Monitor App

IsolatedProcessApp

APP VIRTUALIZATION ARCHITECTURE

Boxify

SystemServices

Broker App

TargetApp

TARGET

Broker

TargetApp

IPCShim Syscall ShimSandboxServiceIPCShim Syscall ShimSandboxService

Divert Binder IPC to BrokerDivert Syscalls to BrokerControl channel for loading/terminating apps

LOADING AN APP

Broker Target

Context.bindService()

BinderSandboxService

SandboxService.prepare()

BinderApplicationThread

ApplicationThread.bindApplication()

Isolatedprocessiscreated

Shimsaresetup

Appisstarted

BROKER

APILayer

Target

IPCReceiver SyscallReceiver

CoreLogicLayer

VirtualizationLayer

Srv Stub Srv Stub

ServicePEP

CoreServices

SyscallPEP

ComponentBroker

APILAYER

APILayer

Target

CoreLogicLayer

VirtualizationLayer

Srv Stub Srv Stub

ServicePEP

CoreServices

SyscallPEP

ComponentBroker

Establish compatibility across Android versions

CORE LOGIC LAYER

APILayer

Target

CoreLogicLayer

VirtualizationLayer

Srv Stub Srv Stub

ServicePEP

CoreServices

SyscallPEP

ComponentBroker

Baseline enforcement & virtual system services

ServicePEP

SyscallPEP

CoreServices

VIRTUALIZATION LAYER

APILayer

Target

CoreLogicLayer

VirtualizationLayer

Srv Stub Srv Stub

ServicePEP

CoreServices

SyscallPEP

ComponentBroker

Translate between Boxify and Android system

VIRTUALIZATION LAYER

ActivityA ActivityB ServiceA ServiceB ReceiverA

Boxify

Activity1 ActivityN Service1… … Receiver1ServiceN …

startActivity(ActivityA)

startActivity(Activity1) scheduleLaunchActivity(Activity1)

scheduleLaunchActivity(ActivityA)

ActivityA

Activity1

SYSTEM INTEGRATION

§ Launchingapps

- DedicatedActivity

- ShortcutsonHomeScreen

- VirtualizedLauncher

§ Installing/Updatingapps

- DirectlyviaAppStores

DISCUSSION &LIMITATIONS

§ Cancels Android‘s own access control checks

§ Violates Principle of LeastPrivilege

§ Full kernel attack surface available

§ Presenceof Boxify detectable

USE-CASES

§ InstantiateOSextensionsatapplicationlayer

- Fine-grainedaccesscontrol- Informationflowcontrol

- Dual-persona,BYOD

- Dynamicanalysis

- Automatedtesting

- Xposed- …

Application-layer Security

Compiler-based instrumentation

MOTIVATION AND RESEARCH QUESTIONS

§ AndroidRuntime(ART)supersedesDalvik VirtualMachine(DVM)- Movefrominterpretationtoahead-of-timeon-devicecompilation- BreakscompatibilitywithDVM-basedpriorwork(e.g.TaintDroid)

§ ARTyetuncharted- Onlyfewworksonthetopic- Securityimplicationsunclear- Potentiallyinterestingtargetforsecurityresearch

§ Thiswork:Understandingandutilizingthenovelruntime

- Researchingthenewon-devicecompiler

- Creatinganapp-instrumentationframework

- Provingitsapplicabilitybyimplementinguse-cases

DVMVS ART

Dalvik VirtualMachine- DefaultruntimeuptoAndroid

- Pre-optimizationofbytecode

- Dalvik executablebytecodeformat(.dex)

- Interpretationandjust-in-timecompilation

- Repeatedfetch-executecycles

AndroidRuntime- DefaultruntimesinceAndroid5.0

- Compilationofbytecodetobinarycode

- ARTELFbinary(.oat)

- NativeexecutionintheAndroidRuntime

- Improvedperformanceandbatterylife

THE ANDROID RUNTIME

§ Twomaincomponents:compilersuiteandruntime

§ Dex2oatCompiler:transformdex filesintooatfiles

- OatfollowstheELFformat

- Completedex codeisstoredalongwiththebinarycode

- Multiplecompilationbackends andcodegenerators

- Backends handleoptimizations

§ Runtime:loadandexecutecompiledapps

- Compensateformissingvirtualmachine

- Preloadframeworkcode

- Garbagecollection

- Debugginghooks

DEX2OAT:OVERVIEW

DEX2OAT:OPTIMIZING IR

§ Singleintermediaterepresentation

§ EnrichedmethodCFGs

§ SingleStaticAssignmentform

§ Def-usepairs

§ Nodescomparabletodex instructions

§ Inlined Javasemanticchecks

INSTRUMENTATION POINTS

• Minimalinterferencewithdex2oat• Leavestransformationfromdex andcodegeneratorsintact• Supportforvisitorpattern• Lightweightstaticanalysispossible

ARTIST:THE ARTINSTRUMENTATION AND SECURITY TOOLKIT

§ Injectionofwholelibraries- Supporttomergeadditionaldex files

- Implementedasapreprocessingstep

- Invocationsofthoseaddedmethodscanbeinjected

§ SimpleAPIforcodeinjection- Injectsmethodcalls

- Policy-driven:(target,method,parameters)

- UsedtoimplementsimpleIRMuse-case

§ SupportforModules- Implementedascustomoptimizationpassesoverthecode

- IntegratesneatlywithoptimizationsandotherModules

- FullaccesstomethodCFG:remove,addandreplacenodes

ARTIST:DEPLOYMENT

§ Replacesystemdex2oat

§ Shipthecompilerasabinary

- RegularAndroidapp

- UItopickappforinstrumentation

- Recompilationgeneratesalternativeoatfile(oat’)

§ Trickandroidintoloadingoat’insteadofoat

- root:replaceoatwithoat’

- Noroot:usevirtualizationtechnique(Boxify,NJAS)

§ ApplicationLayer-onlysolution

- Leavessystembinaryuntouched

- Norootrequired

POSSIBLE USE CASES

§ TaintTracking

- Trackingofprohibitedflowsfromprotectedsourcestoappsinks§ IRM

- Dynamicpermissionenforcement

§ Hot-patchingofvulnerabilities

- Detectandfixcommonvulnerabilitiesintroducedbydevelopers

§ Enforcedappcompartmentalization- Splitapplicationsintodistinctsecurityprincipals

§ DebuggingandProfiling

- Injectcustomdebugginghooksandbenchmarkingcode

§ …

CASE STUDY:TAINT TRACKING WITH ARTIST

§ De-factostandardTaintDroid notapplicableanymoreonART

- Existingworksfocusondex rewriting(TaintMan,…)

§ Investigatewhethertainttrackingcanbeimplementedusingcompiler-basedinstrumentation

- Specificchallenges

- Compileroperatesonmethod-level

- Interplaywithoptimizations

§ Hybridanalysis

- Lightweightstaticanalysistosupporttargetedinstrumentation

- Nofullstatictaintanalysis!

- Dynamictainttrackinghappensatruntime

CASE STUDY:INFORMATION FLOW ANALYSIS

§ Refiningthedefinitionsofsourcesandsinks

- Globalsource/sink:dataenters/leavesapplication- Localsource/sink:dataenters/leavescurrentmethod

§ Intra-methodtainttracking

- Staticallycomputebackwardslicesofglobalandlocalsinks

- Stopatmethodborder,i.e.localsources

§ Inter-methodtainttracking- Injectcodeatsourcesandsinkstoobtainandpropagatetaintinformation

- Thread-localtaintstackfortaintedargumentsandreturnvalues

- Createidentifierforobjectandstaticfieldsandstoreinmap- Addcodetochecktaintvalueatglobalsinks

CASE STUDY:TAINT TRACKING EXAMPLE

ONGOING WORK

§ IntegrateARTist withBoxify

- Currentimplementationrequiresroot

§ Combinewithstate-of-the-artstaticanalysis

- Evenmoretargetedinstrumentation

§ Multi-dex support

- Allowstoalsorecompilethelargestapps(Facebook,…)

- Moveadditionaldex mergingintothecompileritself

application-layer security extensions · 2016-09-15 · 1 application-layer security extensions •...

Documents

ibm i: secure sockets layer/transport layer security ·...

june 2011 volume 14, number 2ip security (ipsec), secure...

improve physical layer security via...

verified security for browser extensions

7 layer security

layer-3 security on layer-2 cisco switches

dnssec : domain name sytem security extensions

network layer security

domain name system security extensions (dnssec ... ·...

transport layer security (tls) extensions · 2009-06-25 ·...

veriï¬ed security for browser extensions

dns security extensions

link layer security

presentation layer security

role and impact of information quality in the department...

transport layer security

mac layer security

physical layer security

security extensions for cmmi

application layer security