基于能力依赖图的SEAndroid安全策略分析

SEAndroid作为Android系统安全机制的重要组成部分,直接关系到系统的安全性.在本文中,我们提出一种基于能力依赖图的SEAndroid安全策略分析方法.能力依赖图描述了实际Android系统中用户的能力迁移以及其SEAndroid子系统的访问控制配置.我们首先对SEAndroid的具体实现进行分析,收集安全策略和系统信息,并进行逻辑建模.然后,我们依据SEAndroid的策略判定模式设计逻辑推导规则,并以此利用逻辑编程的方式生成能力依赖图.基于能力依赖图,我们提取出可能的攻击路径和攻击模式.我们对多个AOSP发布的不同Android版本的SEAndroid访问控制系统子进行了评估与分析.我们发现随着Android版本的提升,其SEAndroid安全策略也进行了更新,新的SEAndroid对系统提供了更强的约束和保护.此外,我们在实验中发现了一种被黑客在实际攻击中使用到的攻击模式,从而验证我们方法的有效性.     

Android vs. SEAndroid: An empirical assessment

Android has a layered architecture that allows applications to leverage services provided by the underlying Linux kernel. However, Android does not prevent applications from directly triggering the kernel functionalities through system call invocations. As recently shown in the literature, this feature can be abused by malicious applications and thus lead to undesirable effects. The adoption of SEAndroid in the latest Android distributions may mitigate the problem. Yet, the effectiveness of SEAndroid to counter these threats is still to be ascertained. In this paper we present an empirical evaluation of the effectiveness of SEAndroid in detecting malicious interplays targeted to the underlying Linux kernel. This is done by extensively profiling the behavior of honest and malicious applications both in standard Android and SEAndroid-enabled distributions. Our analysis indicates that SEAndroid does not prevent direct, possibly malicious, interactions between applications and the Linux kernel, thus showing how it can be circumvented by suitably-crafted system calls. Therefore, we propose a runtime monitoring enforcement module (called Kernel Call Controller) which is compatible both with Android and SEAndroid and is able to enforce security policies on kernel call invocations. We experimentally assess both the efficacy and the performance of KCC on actual devices.