[Paper Review] ACMiner: Extraction and Analysis of Authorization Checks in Android's Middleware

Sigmund Albert Gorski, Benjamin Andow+5 more|arXiv (Cornell University)|Jan 11, 2019

Advanced Malware Detection Techniques4 citations

TL;DR

ACMiner is a static analysis framework that automatically extracts and analyzes authorization checks in Android's system services by mining code patterns leading to SecurityException throws, then applies association rule mining to detect inconsistencies indicating missing or flawed access control. It identified 28 vulnerabilities in Android 7.1.1, reducing manual analysis from 4,004 entry points to 246, with 7 in third-party-exploitable, security-sensitive entry points.

ABSTRACT

Billions of users rely on the security of the Android platform to protect phones, tablets, and many different types of consumer electronics. While Android's permission model is well studied, the enforcement of the protection policy has received relatively little attention. Much of this enforcement is spread across system services, taking the form of hard-coded checks within their implementations. In this paper, we propose Authorization Check Miner (ACMiner), a framework for evaluating the correctness of Android's access control enforcement through consistency analysis of authorization checks. ACMiner combines program and text analysis techniques to generate a rich set of authorization checks, mines the corresponding protection policy for each service entry point, and uses association rule mining at a service granularity to identify inconsistencies that may correspond to vulnerabilities. We used ACMiner to study the AOSP version of Android 7.1.1 to identify 28 vulnerabilities relating to missing authorization checks. In doing so, we demonstrate ACMiner's ability to help domain experts process thousands of authorization checks scattered across millions of lines of code.

Motivation & Objective

• To address the lack of systematic analysis of access control enforcement in Android’s privileged system services, which are critical to platform security.
• To overcome limitations of prior tools like Kratos and AceDroid that rely on manually curated checks or coarse-grained analysis.
• To enable domain experts to efficiently identify missing or inconsistent authorization checks across thousands of service entry points in millions of lines of code.
• To improve detection coverage and precision in identifying vulnerabilities related to missing or misconfigured access control in Android’s middleware.
• To provide actionable insights through association rule mining that suggest consistent access control patterns for triage and remediation.

Proposed method

• ACMiner identifies authorization checks by analyzing program logic between service entry points and code that throws a SecurityException, using static analysis to extract relevant conditions.
• It applies text analysis and regular expressions to mine security-relevant constants and variable/method names influencing conditional logic leading to SecurityException throws.
• The framework constructs policy rules from these mined conditions, representing the intended access control policy per service entry point.
• It applies association rule mining at the service granularity to compare authorization checks across entry points within the same service, identifying inconsistencies that may indicate vulnerabilities.
• The method supports semi-automated discovery of diverse authorization checks, including those not covered by prior tools like App Ops or manually defined lists.
• Results are prioritized and triaged using association rule suggestions, enabling efficient manual validation by security experts.

Experimental results

Research questions

• RQ1 How can authorization checks in Android’s system services be systematically and automatically extracted from large-scale, complex codebases?
• RQ2 To what extent can association rule mining detect inconsistencies in access control enforcement across entry points within the same system service?
• RQ3 What is the coverage and precision of ACMiner in identifying missing or flawed authorization checks compared to existing tools like Kratos and AceDroid?
• RQ4 Can ACMiner reduce the manual analysis effort required to identify security vulnerabilities in Android’s core system services?
• RQ5 Which types of vulnerabilities—especially those exploitable by third-party apps—can be uncovered using this approach?

Key findings

• ACMiner analyzed 4,004 system service entry points in AOSP Android 7.1.1 and identified 1,995 with authorization checks.
• Among these, association rule mining flagged 246 entry points with inconsistent authorization checks, significantly narrowing the attack surface for manual review.
• Manual investigation of the 246 suspicious entry points revealed 28 security vulnerabilities, including 7 in third-party-exploitable, security-sensitive entry points.
• An additional 12 vulnerabilities were found in entry points that, while not directly exploitable by third-party apps, still represent critical access control flaws.
• ACMiner achieved a 2552% improvement in check coverage over Kratos by using a semi-automated mining approach instead of relying on manually curated lists.
• The framework demonstrated superior scalability and precision by reducing the number of entry points requiring expert analysis from over 4,000 to just 246, enabling efficient triage with actionable suggestions from association rule mining.