Inside Job: Understanding and Mitigating the Threat of External Device Mis-Bonding on Android

Abstract

Abstract-Today's smartphones can be armed with many types of external devices, such as medical devices and credit card readers, that enrich their functionality and enable them to be used in application domains such as healthcare and retail. This new development comes with new security and privacy challenges. Existing phone-based operating systems, Android in particular, are not ready for protecting authorized use of these external devices: indeed, any app on an Android phone that acquires permission to utilize communication channels like Bluetooth and Near Field Communications is automatically given the access to devices communicating with the phone on these channels.In this paper, we present the first study on this new security issue, which we call external Device Mis-Bonding or DMB, under the context of Bluetooth-enabled Android devices. Our research shows that this problem is both realistic and serious: oftentimes an unauthorized app can download sensitive user data from an Android device and also help the adversary to deploy a spoofed device that injects fake data into the original device's official app on the phone. Specifically, we performed an in-depth analysis on four popular health/medical devices that collect sensitive user information and successfully built end-toend attacks that stealthily gathered sensitive user data and fed arbitrary information into the user's health/medical account, using nothing but Bluetooth permissions and public information disclosed by the phone. Our further study of 68 relevant deviceusing apps from Google Play confirms that the vast majority of the devices on the market are vulnerable to this new threat. To defend against it, we developed the first OS-level protection, called Dabinder. Our approach automatically generates secure bonding policies between a device and its official app, and enforces them when an app attempts to establish Bluetooth connections with a device and unpair the phone from the device (for resetting the Bluetooth link key). Our evaluation shows that this new technique effectively thwarts the DMB attacks and incurs only a negligible impact on the phone's normal operations.

Leave Me Alone: App-Level Protection against Runtime Information Gathering on Android

“…We found that under the strategy for selecting suspicious processes, only 1.68% of the popular apps with perceptible impacts on user experience needed to be closed when they were running in the background and all of them could be swiftly restored without losing their runtime states. Our study further shows that the new technique defeated all known RIG attacks, including audio recording, Bluetooth misbonding [6], a series of side-channel attacks on high-profile apps [1], [4], [5], [20], the recently proposed user-interface inference [2] and voice eavesdropping [7], together with the new IoT attacks we discovered, at a performance cost as low as 5% of CPU time and 40 MB memory.…”

“…More recently, research has found that Android Bluetooth accessories are also vulnerable to such runtime data stealing [6]. The official app of a Bluetooth medical device, such as blood-glucose meter and pulse oximeter, can be monitored by a malicious app with the Bluetooth permission.…”

“…For example, prior research shows that apps with the RECORD_AUDIO permission are capable of selectively extracting confidential data (e.g., credit card number) and stealthily delivering it to the adversary [3]. Also, the official app of an external medical device, such as a blood glucose meter, can be monitored for collecting patient data from the device through the Bluetooth channel, before the official app is able to establish its connection with the device [6]. Particularly concerning here is that even the app not asking for any permission can still obtain highly-sensitive user information from a variety of side channels, demonstrating the fundamental weakness of mobile devices in separating an app's operations from its data.…”

AntiRIG Security System in Android

“…[3]. Also, a Bluetooth operated medical device's genuine app can give away a vital information [6]. A big concern here is that even zero permission can still gain highly profound data from a variety of side channels, signifying the important weakness of mobile devices in extrication an app's operations from its data.…”

SecureRun: Cheat-Proof and Private Summaries for Location-Based Activities

“…As the value of incentives increase, users could be more tempted to cheat when reporting their per-formance [20], which would endanger the viability of the system for the service provider and its affiliates, as well as its attractiveness to the users. For example, location cheating can be achieved by making mobile devices report erroneous location information to the activity-tracking app [21], [22], or by spoofing the GPS/Wi-Fi signals used for geo-location users [23]- [25]. Moreover, some tools enable users to manipulate activity data to lie about their performance [26]- [28].…”