[Paper Review] A Novel Attack against Android Phones

Michael Backes, Sebastian Gerling+1 more|arXiv (Cornell University)|Jun 21, 2011

Advanced Malware Detection Techniques3 citations

TL;DR

This paper presents a novel, permission-free attack on Android phones that enables unauthorized installation of arbitrary applications from the Android Market. Exploiting a vulnerability in the Android package installation mechanism, the attack bypasses user consent and system security controls, demonstrating a critical zero-permission exploit with severe implications for device security.

ABSTRACT

In the first quarter of 2011, Android has become the top-selling operating system for smartphones. In this paper, we present a novel, highly critical attack that allows unprompted installation of arbitrary applications from the Android Market. Our attack is based on a single malicious application, which, in contrast to previously known attacks, does not require the user to grant it any permissions.

Motivation & Objective

• To identify and exploit a critical vulnerability in Android's package installation mechanism that allows unauthorized app installation.
• To demonstrate a zero-permission attack that does not require user consent or explicit permissions.
• To highlight the security implications of such a flaw in a widely deployed mobile OS like Android.
• To responsibly disclose the vulnerability to vendors for timely patching.

Proposed method

• The attack leverages a flaw in the Android system's handling of package installation requests, specifically in the interaction between the package manager and the Android Market.
• A single malicious application is crafted to trigger the installation process without requiring any user-authorized permissions.
• The exploit manipulates the system's intent handling and package verification mechanisms to install arbitrary apps silently.
• The attack is executed entirely within the Android framework, without requiring root access or low-level system modifications.
• The researchers used a controlled environment to reproduce the vulnerability and validate its exploitability.

Experimental results

Research questions

• RQ1 Can an Android application install arbitrary apps from the Google Play Store without requiring any user permissions?
• RQ2 What system-level flaws in Android's package management allow silent, unauthorized app installation?
• RQ3 How can a malicious app bypass standard security checks and user consent mechanisms during installation?
• RQ4 What are the implications of such a vulnerability for the security of widely used mobile operating systems?

Key findings

• The vulnerability allows the installation of arbitrary applications from the Android Market without any user interaction or permission grants.
• The attack is effective on standard, non-rooted Android devices, demonstrating a critical flaw in the OS's security model.
• The exploit was successfully reproduced and reported to Google, leading to a responsible disclosure process.
• The vulnerability was confirmed by Google and patched, highlighting the severity of the issue.