Android Permission机制的实现与安全分析

被引:8
作者
张中文
雷灵光
王跃武
机构
[1] 中国科学院信息工程研究所信息安全国家重点实验室
关键词
Android系统; Permission; 安全; 漏洞;
D O I
暂无
中图分类号
TP309 [安全保密];
学科分类号
081201 ; 0839 ; 1402 ;
摘要
Permission机制作为Android安全的重要组成部分,受到了越来越多的关注,已有的研究主要集中在对应用程序申请的Permission进行静态分析上。文章从分析Permission机制的实现过程入手,分析了Permission机制自身的安全问题,发现了一个Permission机制漏洞。应用程序利用该漏洞可以绕过权限管理,主动提升应用程序的访问权限,为后续攻击提供支持。同时文章也对Permission机制其它方面的安全特性进行了分析。
引用
收藏
页码:3 / 6
页数:4
相关论文
共 8 条
[1]  
Taming information-stealing Smartphone applications (on Android). Y.Zhou,X.Zhang,X.Jiang,VW Freeh. Proceedings of the4th International Conference on Trust and Trustworthy Computing . 2011
[2]  
A methodology for empirical analysis of permission-based security models and its application to android. David Barrera,Hilmi Günes Kayacik,Paul C van Oorschot,Anil Somayaji. ACM Conference on Computer and Communications Security . 2010
[3]  
A Formal Model to Analyze the Permission Authorization and Enforcement in the Android Framework. Shin, Wook,Kiyomoto, Shinsaku,Fukushima, Kazuhide,Tanaka, Toshiaki. IEEE International Conference on Social Computing (SocialCom 2010) . 20111
[4]  
A small but non-negligible aw in the Android permission scheme. Wook Shin,Sanghoon Kwak,Shinsaku Kiyomoto,Kazuhide Fukushima,Toshiaki Tanaka. Proceedings of the 2010 IEEE International Symposium on Policies for Distributed Systems and Networks . 2010
[5]  
Hey,You,Get Off My Market:Detecting Malicious Apps in Alternative Android Markets. Y.Zhou,Z.Wang,W.Zhou,X.Jiang. Proceedings of the 16th Network and Distributed System Security Symposium . 2012
[6]  
Android Permissions Demystified. A.P.Felt,E.Chin,S.Hanna,D.Song,D.Wagner. Proceedings of the18th ACM Conference on Computer and Communications Security,CCS’’11 . 2011
[7]  
"Privilege escalation attacks on android,". L.Davi,A.Dmitrienko,A.-R.Sadeghi,M.Winandy. Proceedings of the 13th international conference on Information security, ser.ISC’’10 . 2011
[8]  
On Lightweight Mobile Phone Application Certification. W.Enck,M.Ongtang,P.McDaniel. Proceedings of the16th ACM Conference on Computer and Communications Security,CCS’’09 . 2009