[Paper Review] PolyScope: Multi-Policy Access Control Analysis to Triage Android Systems

Y. Lee, William Enck+7 more|arXiv (Cornell University)|Aug 8, 2020

Advanced Malware Detection Techniques4 citations

TL;DR

PolyScope is a novel access control analysis tool that identifies and triages file-based attack vectors in Android by analyzing the interplay between mandatory (SEAndroid) and discretionary (UNIX) access controls. It detects permission expansion—where adversaries exploit policy flexibility to escalate privileges—and computes actual attack operations, revealing 15–20% of expanded permissions are non-exploitable, enabling targeted vulnerability triage in Google and OEM Android releases, including two previously unknown flaws.

ABSTRACT

Android filesystem access control provides a foundation for Android system integrity. Android utilizes a combination of mandatory (e.g., SEAndroid) and discretionary (e.g., UNIX permissions) access control, both to protect the Android platform from Android/OEM services and to protect Android/OEM services from third-party apps. However, OEMs often create vulnerabilities when they introduce market-differentiating features because they err when re-configuring this complex combination of Android policies. In this paper, we propose the PolyScope tool to triage the combination of Android filesystem access control policies to vet releases for vulnerabilities. The PolyScope approach leverages two main insights: (1) adversaries may exploit the coarse granularity of mandatory policies and the flexibility of discretionary policies to increase the permissions available to launch attacks, which we call permission expansion, and (2) system configurations may limit the ways adversaries may use their permissions to launch attacks, motivating computation of attack operations. We apply PolyScope to three Google and five OEM Android releases to compute the attack operations accurately to vet these releases for vulnerabilities, finding that permission expansion increases the permissions available to launch attacks, sometimes by more than 10X, but a significant fraction of these permissions (about 15-20%) are not convertible into attack operations. Using PolyScope, we find two previously unknown vulnerabilities, showing how PolyScope helps OEMs triage the complex combination of access control policies down to attack operations worthy of testing.

Motivation & Objective

• To address the challenge of identifying real attack vectors in Android systems where OEMs introduce vulnerabilities by reconfiguring complex access control policies.
• To detect how adversaries can exploit the flexibility of discretionary access control (DAC) and coarse-grained mandatory access control (MAC) to expand their permissions.
• To compute actual attack operations—feasible exploit paths—rather than just integrity violations, enabling effective triage of vulnerabilities for testing.
• To provide a scalable method for analyzing combined MAC and DAC policies in Android, including Android permissions, to improve platform integrity.
• To reveal previously unknown vulnerabilities in OEM Android releases by accurately modeling permission expansion and attack feasibility.

Proposed method

• PolyScope computes integrity violations where low-integrity subjects (adversaries) are authorized to modify resources used by high-integrity subjects (victims).
• It models permission expansion by analyzing how adversaries can manipulate DAC policies to gain broader access than originally permitted by MAC policies.
• The tool combines SEAndroid MAC policies, UNIX DAC policies, and Android permission models to reason about combined access control behavior.
• It computes attack operations by determining whether expanded permissions can be leveraged to execute real attacks, such as file squatting or link traversal.
• PolyScope uses symbolic execution and policy composition techniques to analyze all possible permission expansions and their exploitability across multiple Android releases.
• The method includes a filtering step to eliminate non-exploitable expanded permissions, reducing false positives and enabling efficient triage.

Experimental results

Research questions

• RQ1 How can adversaries exploit the flexibility of discretionary access control (DAC) to expand their effective permissions beyond what is granted by mandatory access control (MAC) in Android?
• RQ2 Which integrity violations in Android filesystem access control are actually exploitable as real attack operations, and which are benign due to access constraints?
• RQ3 To what extent do OEM modifications to Android access control policies introduce new, previously unknown attack vectors?
• RQ4 How much does permission expansion increase the attack surface, and how many of these expanded permissions are actually usable in real attacks?
• RQ5 Can a unified analysis of combined MAC, DAC, and Android permission policies accurately identify exploitable vulnerabilities without excessive false positives?

Key findings

• Permission expansion increases the number of potentially exploitable permissions by more than 10x in some Android releases, significantly expanding the attack surface.
• Despite this expansion, approximately 15–20% of the newly available permissions are not convertible into actual attack operations, indicating a high rate of non-exploitable threats.
• PolyScope identified two previously unknown vulnerabilities in OEM Android releases, demonstrating its effectiveness in real-world triage.
• The tool successfully reduced the number of false positives by filtering out non-exploitable expanded permissions, enabling focused testing on high-risk attack operations.
• The analysis revealed that OEMs often fail to address integrity violations introduced during feature customization, leading to persistent vulnerabilities.
• Scoped storage does not affect the integrity violations identified outside of external storage, confirming the relevance of PolyScope’s findings to core filesystem access control.