The Peril of Fragmentation: Security Hazards in Android Device Driver Customizations

Abstract

Abstract-Android phone manufacturers are under the perpetual pressure to move quickly on their new models, continuously customizing Android to fit their hardware. However, the security implications of this practice are less known, particularly when it comes to the changes made to Android's Linux device drivers, e.g., those for camera, GPS, NFC etc. In this paper, we report the first study aimed at a better understanding of the security risks in this customization process. Our study is based on ADDICTED, a new tool we built for automatically detecting some types of flaws in customized driver protection. Specifically, on a customized phone, ADDICTED performs dynamic analysis to correlate the operations on a security-sensitive device to its related Linux files, and then determines whether those files are under-protected on the Linux layer by comparing them with their counterparts on an official Android OS. In this way, we can detect a set of likely security flaws on the phone. Using the tool, we analyzed three popular phones from Samsung, identified their likely flaws and built end-to-end attacks that allow an unprivileged app to take pictures and screenshots, and even log the keys the user enters through touchscreen. Some of those flaws are found to exist on over a hundred phone models and affect millions of users. We reported the flaws and helped the manufacturers fix those problems. We further studied the security settings of device files on 2423 factory images from major phone manufacturers, discovered over 1,000 vulnerable images and also gained insights about how they are distributed across different Android versions, carriers and countries.

Your Voice Assistant is Mine

“…One feasible solution is to prepare a customized Android version with modified audio drivers. One recent research [54] has pointed out the security risks in Android device driver customizations. Android inherits the driver management methods of Linux and devices are placed under /dev (or /sys) as files.…”

AceDroid: Normalizing Diverse Android Access Control Checks for Inconsistency Detection

“…The vendor customizations have been proven to be problematic in prior studies. ADDICTED [37] finds under-protected Linux drivers on customized ROMs by comparing them with their counterparts on AOSP images. Harehunter [7] reveals the Hanging Attributes References vulnerability caused by the underregulated Android customization.…”

Sensor Guardian: prevent privacy inference on Android sensors

“…This problem arises when a variety of customized Android versions are used in different vendors' devices. This problem makes it difficult to provide a universal patch to enforce new security enhancement at the system level on all Android devices, due to misaligned incentives from different parties including Google, hardware vendors, and cell phone carriers [18,30,31]. Sensor Guardian does not need to modify the system to deploy the security enforcement, thus not affected by the Android fragmentation problem.…”