Thumbnail
Access Restriction
Open

Author Hao, Hao ♦ Singh, Vicky ♦ Du, Wenliang
Source CiteSeerX
Content type Text
File Format PDF
Subject Domain (in DDC) Computer science, information & general works ♦ Data processing & computer science
Subject Keyword Api-level Access Control ♦ Fine-grained Access Control ♦ Access Control ♦ Bytecode Rewriter ♦ Us Static Analysis ♦ Weak Link ♦ Android O ♦ Systematic Evaluation ♦ Api Call ♦ Android Operating System ♦ Identified Attack ♦ First Systematic Study ♦ Security-sensitive Api Method ♦ Potential Attack ♦ Android Application ♦ Android Platform ♦ Engineering Secure Bytecode Rewriting Tool ♦ Incomplete Implementation
Abstract Bytecode rewriting on Android applications has been widely adopted to implement fine-grained access control. It endows more flexibility and convenience without modifying the Android platform. Bytecode rewriting uses static analysis to identify the usage of security-sensitive API methods, before it instruments the bytecode to control the access to these API calls. Due to the significance of this technique, the effectiveness of its performance in providing fine-grained access control is crucial. We have provided a systematic evaluation to assess the effectiveness of API-level access control using bytecode rewriting on Android Operating System. In our evaluation, we have identified a number of potential attacks targeted at incomplete implementations of bytecode rewriting on Android OS, which can be applied to bypass access control imposed by bytecode rewriter. These attacks can either bypass the API-level access control or make such access control difficult to implement, exposing weak links in the bytecode rewriting process. Recommendations on engineering secure bytecode rewriting tools are presented based on the identified attacks. This work is the first systematic study on the effectiveness of using bytecode rewriting for API-level access control.
Educational Role Student ♦ Teacher
Age Range above 22 year
Educational Use Research
Education Level UG and PG ♦ Career/Technical Study