Security and system architecture: comparison of Android customizations

Abstract

Smartphone manufacturers frequently customize Android distributions so as to create competitive advantages by adding, removing and modifying packages and configurations. In this paper we show that such modifications have deep architectural implications for security. We analysed five different distributions: Google Nexus 4, Google Nexus 5, Sony Z1, Samsung Galaxy S4 and Samsung Galaxy S5, all running OS versions 4.4.X (except for Samsung S4 running version 4.3). Our conclusions indicate that serious security issues such as expanded attack surface and poorer permission control grow sharply with the level of customization.

Analisis Kredensial Untuk Konfigurasi Keamananan Rom Android Custom

“…Tian et al, (2014) mengekstrak aplikasi dan pustaka prainstal dari image Android kustom, membangun sistem yang cocok dari AOSP, lalu membandingkan aplikasi dan pustaka prainstal untuk menemukan modifikasi dan menilai keamanannya. Penelitian oleh Gallo et al (2015), menyoroti masalah keamanan dalam model izin Android berkaitan dengan kustomisasi Android.…”

Certified Copy? Understanding Security Risks of Wi-Fi Hotspot based Android Data Clone Services

“…In order to support a functionality, manufacturers might need to modify the standard Android system by embedding support components. However, such customized components often result in vulnerabilities due to incorrect implementation [11,17]. Some previous works have focused on different customized components for vulnerability detection including customized Android phone driver [39], permission re-delegation [16], vendor-specific certification [32], and insecure validation [37].…”

AceDroid: Normalizing Diverse Android Access Control Checks for Inconsistency Detection

“…Another prominent research work analyzes pre-installed apps and reports the presence of known problems such as over-privileged apps, permission redelegation [15], [14]. Gallo et al [16] analyzed five different custom devices and concluded that serious security issues such as poorer permission control grow sharply with the level of customization. More recently, Zhang et al analyzed ION related vulnerabilities caused by the customization it undergoes through different devices [35].…”