Focus

Understanding
Android Security

T
he next generation of open operating systems middleware layer running on an
embedded Linux kernel, so de-
won’t be on desktops or mainframes but on the velopers wishing to port their
application to Android must use
small mobile devices we carry every day. The its custom user interface environ-
ment. Additionally, Android re-
openness of these new environments will lead to stricts application interaction to its
special APIs by running each ap-
new applications and markets and will enable greater integration plication as its own user identity.
Although this controlled interac-
William Enck, with existing online services. and applications are now available tion has several beneficial security
Machigar However, as the importance of the for it. One of Android’s chief sell- features, our experiences devel-
Ongtang, data and services our cell phones ing points is that it lets developers oping Android applications have
and Patrick support increases, so too do the seamlessly extend online services revealed that designing secure
McDaniel opportunities for vulnerability. It’s to phones. The most visible exam- applications isn’t always straight-
Pennsylvania essential that this next generation ple of this feature is, unsurprising- forward. Android uses a simple
State of platforms provides a compre- ly, the tight integration of Google’s permission label assignment model
University hensive and usable security infra- Gmail, Calendar, and Contacts to restrict access to resources and
structure. Web applications with system util- other applications, but for reasons
Developed by the Open Hand- ities. Android users simply supply a of necessity and convenience, its
set Alliance (visibly led by Google), username and password, and their designers have added several po-
Android is a widely anticipated phones automatically synchro- tentially confusing refinements as
open source operating system for nize with Google services. Other the system has evolved.
mobile devices that provides a vendors are rapidly adapting their This article attempts to un-
base operating system, an applica- existing instant messaging, social mask the complexity of Android
tion middleware layer, a Java soft- networks, and gaming services to security and note some possible
ware development kit (SDK), and Android, and many enterprises are development pitfalls that occur
a collection of system applications. looking for ways to integrate their when defining an application’s se-
Although the Android SDK has own internal operations (such as curity. We conclude by attempt-
been available since late 2007, the inventory management, purchas- ing to draw some lessons and
first publicly available Android- ing, receiving, and so forth) into identify opportunities for future
ready “G1” phone debuted in late it as well. enhancements that should aid in
October 2008. Since then, An- Traditional desktop and server clarity and correctness.
droid’s growth has been phenom- operating systems have struggled
enal: T-Mobile’s G1 manufacturer to securely integrate such per- Android Applications
HTC estimates shipment volumes sonal and business applications The Android application frame-
of more than 1 million phones by and services on a single platform. work forces a structure on devel-
the end of 2008, and industry in- Although doing so on a mobile opers. It doesn’t have a main()
siders expect public adoption to platform such as Android remains function or single entry point for
increase steeply in 2009. Many nontrivial, many researchers hope execution—instead, developers
other cell phone providers have ei- it provides a clean slate devoid of must design applications in terms
ther promised or plan to support it the complications that legacy soft- of components.
in the near future. ware can cause. Android doesn’t
A large community of devel- officially support applications de- Example Application
opers has organized around An- veloped for other platforms: ap- We developed a pair of applications
droid, and many new products plications execute on top of a Java to help describe how Android ap-

50 Published by the IEEE Computer Society ■ 1540-7993/09/$25.00 © 2009 IEEE ■ IEEE Security & Privacy
 Focus

plications operate. Interested readers

FriendTracker application FriendViewer application
can download the source code from
our Web site (http://siis.cse.psu.
BootReceiver FriendTracker FriendReceiver FriendTracker
edu/android_sec_tutorial.html).
Let’s consider a location-sen- Broadcast receiver Service Broadcast receiver Activity
sitive social networking applica-
tion for mobile phones in which FriendTracker- FriendViewer
users can discover their friends’ Control FriendProvider
locations. We split the functional- Activity Content provider Activity
ity into two applications: one for
tracking friends and one for view-
ing them. As Figure 1 shows, the Figure 1. Example Android application. The FriendTracker and FriendViewer applications
FriendTracker application consists consist of multiple components of different types, each of which provides a different set of
of components specific to tracking functionalities. Activities provide a user interface, services execute background processing,
friend locations (for example, via a content providers are data storage facilities, and broadcast receivers act as mailboxes for
Web service), storing geographic messages from other applications.
coordinates, and sharing those co-
ordinates with other applications.
The user then uses the Friend- veloper can also use services as Figure 1 shows the Friend­
Viewer application to retrieve the application-­specific daemons, Tracker and FriendViewer appli-
stored geographic coordinates and possibly starting on boot. Ser- cations containing the different
view friends on a map. vices often define an interface component types. The developer
Both applications contain mul- for Remote Procedure Call specifies components using a man-
tiple components for performing (RPC) that other system com- ifest file (also used to define policy
their respective tasks; the com- ponents can use to send com- as described later). There are no
ponents themselves are classi- mands and retrieve data, as well restrictions on the number of com-
fied by their component types. An as register callbacks. ponents an application defines for
Android developer chooses from • Content provider components store each type, but as a convention, one
predefined component types de- and share data using a relational component has the same name as
pending on the component’s pur- database interface. Each content the application. Frequently, this is
pose (such as interfacing with a provider has an associated “au- an activity, as in the FriendViewer
user or storing data). thority” describing the content it application. This activity usually
contains. Other components use indicates the primary activity that
Component Types the authority name as a handle the system application launcher
Android defines four component to perform SQL queries (such as uses to start the user interface;
types: SELECT, INSERT, or DELETE) to however, the specific activity cho-
read and write content. Although sen on launch is marked by meta
• Activity components define an content providers typically store information in the manifest. In
application’s user interface. values in database records, data the FriendTracker application,
Typically, an application devel- retrieval is implementation- for example, the FriendTracker-
oper defines one activity per ­specific—for example, files are Control activity is marked as the
“screen.” Activities start each also shared through content pro- main user interface entry point.
other, possibly passing and re- vider interfaces. In this case, we reserved the name
turning values. Only one activ- • Broadcast receiver components “FriendTracker” for the service
ity on the system has keyboard act as mailboxes for messages component performing the core
and processing focus at a time; from other applications. Com- application logic.
all others are suspended. monly, application code broad- The FriendTracker application
• Service components perform casts messages to an implicit contains each of the four com-
background processing. When destination. Broadcast receivers ponent types. The FriendTracker
an activity needs to perform thus subscribe to such destina- service polls an external service
some operation that must con- tions to receive the messages to discover friends’ locations. In
tinue after the user interface sent to it. Application code can our example code, we generate
disappears (such as download a also address a broadcast receiv- locations randomly, but extend-
file or play music), it commonly er explicitly by including the ing the component to interface
starts a service specifically de- namespace assigned to its con- with a Web service is straightfor-
signed for that action. The de- taining application. ward. The FriendProvider con-

www.computer.org/security/ ■ IEEE Security & Privacy 51

 Focus

System server Contacts application (system) of requested action—for exam-

ple, if the “VIEW” action string
System Location
service manager
ViewContact is specified in an intent with data
fields pointing to an image file,
the system will direct the intent to
Broadcast intent Bind Start the preferred image viewer. De-
FriendTracker FriendViewer velopers also use action strings to
application Broad- application
cast broadcast a message to a group of
BootReceiver
intent
FriendReceiver FriendMap
broadcast receivers. On the receiv-
FriendTracker
ing end, developers use an intent
filter to subscribe to specific action
Start/stop Read/write Read
Start strings. Android includes addi-
FriendTracker- Read tional destination resolution rules,
FriendViewer
Control FriendProvider but action strings with optional
data types are the most common.
Figure 2 shows the interac-
Figure 2. Component interaction. Android’s application-level interactions let the FriendTracker tion between components in the
and FriendViewer applications communicate with each other and system-provided applications. FriendTracker and FriendViewer
Interactions occur primarily at the component level. applications and with components
in applications defined as part of
the base Android distribution. In
tent provider maintains the most Component Interaction each case, one component initi-
recent geographic coordinates for The primary mechanism for ates communication with another.
friends, the FriendTrackerCon- component interaction is an in- For simplicity, we call this inter-
trol activity defines a user inter- tent, which is simply a message component communication (ICC).
face for starting and stopping the object containing a destination In many ways, ICC is analogous
tracking functionality, and the component address and data. to ­inter-process communication
BootReceiver broadcast receiver The Android API defines meth- (IPC) in Unix-based systems. To
obtains a notification from the ods that accept intents and uses the developer, ICC functions iden-
system once it boots (the applica- that information to start activities tically regardless of whether the
tion uses this to automatically start (startActivity(Intent) ), target is in the same or a different
the FriendTracker service). start services (startService application, with the exception of
The FriendViewer application (Intent)), and broadcast messag- the security rules defined later in
is primarily concerned with show- es (sendBroadcast(Intent)). this article.
ing information about friends’ lo- The invocation of these methods The available ICC actions de-
cations. The FriendViewer activity tells the Android framework to pend on the target component.
lists all friends and their geograph- begin executing code in the target Each component type supports
ic coordinates, and the FriendMap application. This process of in- interaction specific to its type—
activity displays them on a map. tercomponent communication is for example, when FriendViewer
The FriendReceiver broadcast re- known as an action. Simply put, an starts FriendMap, the FriendMap
ceiver waits for messages that in- intent object defines the “intent” activity appears on the screen.
dicate the physical phone is near to perform an “action.” Service components support start,
a particular friend and displays a One of Android’s most pow- stop, and bind actions, so the
message to the user upon such an erful features is the flexibility al- FriendTrackerControl activity,
event. Although we could have lowed by its intent-addressing for instance, can start and stop the
placed these components within mechanism. Although develop- FriendTracker service that runs
the FriendTracker application, ers can uniquely address a target in the background. The bind ac-
we created a separate application component using its application’s tion establishes a connection be-
to demonstrate cross-application namespace, they can also specify tween components, allowing the
communication. Additionally, by an implicit name. In the latter initiator to execute RPCs defined
separating the tracking and user case, the system determines the by the service. In our example,
interface logic, we can create al- best component for an action by FriendTracker binds to the loca-
ternative user interfaces with dif- considering the set of installed ap- tion manager in the system server.
ferent displays and features—that plications and user choices. The Once bound, FriendTracker in-
is, many applications can reuse the implicit name is called an action vokes methods to register a call-
logic performed in FriendTracker. string because it specifies the type back that provides updates on

52 IEEE Security & Privacy ■ January/February 2009

 Focus

Android applications
FriendTracker application FriendViewer application Contacts application

ICC reference monitor

Android middleware
user: app_11 user: app_12 user: app_4
home: /data/data/friendtracker home: /data/data/friendviewer home: /data/data/contacts
Linux system

Figure 3. Protection. Security enforcement in Android occurs in two places: each application executes as its own user identity, allowing
the underlying Linux system to provide system-level isolation; and the Android middleware contains a reference monitor that mediates
the establishment of inter-component communication (ICC). Both mechanisms are vital to the phone’s security, but the first is
straightforward to implement, whereas the second requires careful consideration of both mechanism and policy.

the phone’s location. Note that if Security Enforcement process boundaries. In fact, all
a service is currently bound, an As Figure 3 shows, Android pro- ICC occurs via an I/O control
explicit “stop” action won’t ter- tects applications and data through command on a special device
minate the service until all bound a combination of two enforcement node, /dev/binder. Because
connections are released. mechanisms, one at the system the file must be world readable
Broadcast receiver and content level and the other at the ICC lev- and writable for proper opera-
provider components have unique el. ICC mediation defines the core tion, the Linux system has no way
forms of interaction. ICC targeted security framework and is this ar- of mediating ICC. Although user
at a broadcast receiver occurs as an ticle’s focus, but it builds on the separation is straightforward and
intent sent (broadcast) either ex- guarantees provided by the under- easily understood, controlling
plicitly to the component or, more lying Linux system. ICC is much more subtle and war-
commonly, to an action string In the general case, each ap- rants careful consideration.
the component subscribes to. For plication runs as a unique user As the central point of secu-
example, FriendReceiver sub- identity, which lets Android limit rity enforcement, the Android
scribes to the developer-defined the potential damage of program- middleware mediates all ICC es-
“FRIEND_NEAR” action string. ming flaws. For example, the Web tablishment by reasoning about
FriendTracker broadcasts an in- browser vulnerability discovered labels assigned to applications and
tent to this action string when it recently after the official release of components. A reference moni-
determines that the phone is near T-Mobile G1 phones only affected tor1 provides mandatory access
a friend; the system then starts the Web browser itself (http:// control (MAC) enforcement of
FriendReceiver and displays a securityevaluators.com/content/ how applications access compo-
message to the user. case-studies/android/index.jsp). nents. In its simplest form, access
Content providers don’t use in- Because of this design choice, the to each component is restricted by
tents—rather, they’re addressed via exploit couldn’t affect other ap- assigning it an access permission
an authority string embedded in a plications or the system. A similar label; this text string need not be
special content URI of the form vulnerability in Apple’s iPhone unique. Developers assign applica-
content://<authority>/ gave way to the first “jail break- tions collections of permission la-
<table>/[<id>]. Here, ­<table> ing” technique, which let users bels. When a component initiates
indicates a table in the content pro- replace parts of the underlying ICC, the reference monitor looks
vider, and <id> optionally specifies system, but would also have en- at the permission labels assigned to
a record in that table. Components abled a network-based adversary its containing application and—
use this URI to perform a SQL to exploit this flaw (http://security if the target component’s access
query on a content provider, op- eva lu ator s.com /content/ca se permission label is in that collec-
tionally including WHERE condi- -studies/iphone/index.jsp). tion—allows ICC establishment
tions via the query API. ICC isn’t limited by user and to proceed. If the label isn’t in the

www.computer.org/security/ ■ IEEE Security & Privacy 53

 Focus

Application 1 Application 2
Implicitly Open
Components
Permission A: ... B: 1
Permission Developers frequently define in-
labels labels
tent filters on activities to indicate
... X
C: ... that they can handle certain types
1
Inherit permissions 2
of action/data combinations. Re-
call the example of how the sys-
tem finds an image viewer when
Figure 4. Access permission logic. The Android middleware implements a reference monitor an intent specifying the VIEW
providing mandatory access control (MAC) enforcement about how applications access action and an image reference is
components. The basic enforcement model is the same for all component types. Component passed to the “start activity” API.
A’s ability to access components B and C is determined by comparing the access permission In this case, the caller can’t know
labels on B and C to the collection of labels assigned to application 1. beforehand (much less at develop-
ment time) what access permission
is required. The developer of the
collection, establishment is denied section provides an exhaustive list target activity can permit such
even if the components are in the of refinements we identified as of functionality by not assigning an
same application. Figure 4 depicts the v1.0r1 SDK release. access permission to it—that is, if
this logic. a public component doesn’t ex-
The developer assigns permis- Public vs. Private plicitly have an access permission
sion labels via the XML manifest Components listed in its manifest definition,
file that accompanies every appli- Applications often contain com- Android permits any application
cation package. In doing so, the ponents that another application to access it.
developer defines the application’s should never access—for example, Although this default policy
security policy—that is, assigning an activity designed to return a specification enables functional-
permission labels to an application user-entered password could be ity and ease of development, it can
specifies its protection domain, started maliciously. Instead of de- lead to poor security practices and
whereas assigning permissions to fining an access permission, the is contrary to Saltzer and Schroed-
the components in an application developer could make a compo- er’s principle of fail-safe defaults.4
specifies an access policy to protect nent private by either explicitly Referring back to our example
its resources. Because Android’s setting the exported attribute to FriendViewer application, if the
policy enforcement is mandatory, false in the manifest file or letting FriendReceiver broadcast receiver
as opposed to discretionary,2 all Android infer if the component isn’t assigned an access permission,
permission labels are set at install should be private from other attri- any unprivileged installed appli-
time and can’t change until the butes in its manifest definition. cation can forge a FRIEND_NEAR
application is reinstalled. How- Private components simplify se- message, which represents a sig-
ever, despite its MAC properties, curity specification. By making a nificant security concern for appli-
Android’s permission label model component private, the developer cations making decisions based on
only restricts access to components doesn’t need to worry which per- information passed via the intent.
and doesn’t currently provide in- mission label to assign it or how As a general practice, security-
formation flow guarantees, such as another application might acquire aware developers should always
in domain type enforcement.3 that label. Any application can ac- assign access permissions to public
cess components that aren’t explic- components—in fact, they should
Security Refinements itly assigned an access permission, have an explicit reason for not as-
Android’s security framework is so the addition of private compo- signing one. All inputs should be
based on the label-oriented ICC nents and inference rules (intro- scrutinized under these conditions.
mediation described thus far, but duced in the v0.9r1 SDK release,
our description is incomplete. Par- August 2008) significantly reduces Broadcast Intent
tially out of necessity and partially the attack surface for many applica- Permissions
for convenience, the Google de- tions. However, the developer must Components aren’t the only re-
velopers who designed Android be careful when allowing Android source that requires protection. In
incorporated several refinements to determine if a component is pri- our FriendTracker example, the
to the basic security model, some vate. Security-aware developers FriendTracker service broadcasts
of which have subtle side effects should always explicitly define the an intent to the FRIEND_NEAR ac-
and make its overall security diffi- exported attribute for compo- tion string to indicate the phone is
cult to understand. The rest of this nents intended to be private. physically near a friend’s location.

54 IEEE Security & Privacy ■ January/February 2009

 Focus

Although this event notification fect the data’s integrity. Security- APIs available to third-party ap-
lets the FriendViewer application aware developers should define plications. Android protects these
update the user, it potentially in- separate read and write permis- sensitive APIs with additional per-
forms all installed applications of sions, even if the distinction isn’t mission label checks: an applica-
the phone’s proximity. In this case, immediately apparent. tion must declare a corresponding
sending the unprotected intent is a permission label in its manifest file
privacy risk. More generally, un- Service Hooks to use them. Bitfrost takes a simi-
protected intent broadcasts can Although it wasn’t explicitly iden- lar approach (the “one laptop per
unintentionally leak information tified, the ­FriendTracker ser- child” security model5), but it al-
to explicitly listening attackers. vice defines RPC interfaces: is lows controlled permission change
To combat this, the Android API Tracking() and addNickname after installation.
for broadcasting intents optionally (String). The isTracking() By protecting sensitive APIs
allows the developer to specify a method doesn’t change the ser- with permissions, Android forces
permission label to restrict access vice’s running state; it simply re- an application developer to de-
to the intent object. turns whether FriendTracker is clare the desire to interface with
The access permission label as- currently tracking locations. How- the system in a specific way. Con-
signment to a ­broadcasted intent— ever, addNickname(String) sequently, vulnerable applications
for example, sendBroadcast does modify the running state can’t gain unknown access if ex-
(intent, “perm.FRIEND_NEAR”)— by telling FriendTracker to start ploited. The most commonly en-
restricts the set of applications that tracking another friend. Due to countered protected API is for
can receive it (in this example, this state modification, the devel- network connections—for exam-
only to applications containing oper might want to differentiate ple, the FriendViewer application
the “perm.FRIEND_NEAR” per- access to the two interfaces. Un- requires Internet access for map
mission label). This lets the devel- fortunately, Android only lets the information, so it must declare
oper control how information is developer assign one permission the INTERNET permission label.
disseminated, but this refinement label to restrict starting, stopping, In general, protected APIs make
pushes an application’s security and binding to a service. Under an application’s protection domain
policy into its source code. The this model, any application that can much clearer because the policy is
manifest file therefore doesn’t give start or stop FriendTracker can also defined in the manifest file.
the entire picture of the applica- tell it to monitor new friends. To
tion’s security. address this, Android provides the Permission
checkPermission() method, Protection Levels
Content Provider which lets developers arbitrarily Early versions of the Android SDK
Permissions extend the reference monitor with let developers mark a permission
In our FriendTracker application, a more restrictive policy. In effect, as “application” or “system.” The
the FriendProvider content pro- these service hooks let the devel- default application level meant
vider stores friends’ geographic oper write code to perform custom that any application requesting the
coordinates. As a developer, we runtime security. permission label would receive it.
want our application to be the only Service hooks provide much Conversely, system permission la-
one to update the contents but for greater flexibility when defining bels were granted only to applica-
other applications to be able to access policy—in fact, several ser- tions installed in /data/system
read them. Android allows such a vices provided in the base Android (as opposed to /data/app, which
security policy by modifying how distribution use them. However, is independent of label assign-
access permissions are assigned to like broadcast intent permissions, ment). The likely reason is that
content providers—instead of us- service hooks move policy into only system applications should be
ing one permission label, the de- the application code, which can able to perform operations such as
veloper can assign both read and cloud application security. interfacing directly with the tele-
write permissions. phony API.
If the application perform- Protected APIs The v0.9r1 SDK (August
ing a query with write side ef- Not all system resources (such as 2008) extended the early model
fects ­(INSERT, DELETE, UPDATE) the network, camera, and mi- into four protection levels for
doesn’t have the write permission, crophone) are accessed through permission labels, with the meta
the query is denied. The separate components—instead, Android information specified in the
read and write permissions let provides direct API access. In fact, manifest of the package defining
the developer distinguish between the services that provide indi- the permission. “Normal” per-
data users and interactions that af- rect access to hardware often use missions act like the old applica-

www.computer.org/security/ ■ IEEE Security & Privacy 55

 Focus

tion permissions and are granted basic MAC model. The v0.9r1 tember 2008) introduced another
to any application that requests SDK release (August 2008) intro- delegation mechanism—URI per­
them in its manifest; “dangerous” duced the concept of a “pending missions. Recall that Android
permissions are granted only after intent,” which is rather straightfor- uses a special content URI to ad-
user confirmation. Similar to se- ward: a developer defines an intent dress content providers, optionally
curity checks in popular desktop object as normally done to per- specifying a record within a table.
operating systems such as Micro- form an action (to start an activity, The developer can pass such a
soft Vista’s user account control for example). However, instead of URI in an intent’s data field—for
(UAC), when an application is in- performing the action, the devel- example, an intent can specify the
stalled, the user sees a screen list- oper passes the intent to a special VIEW action and a content URI
ing short descriptions of requested method that creates a PendingIn- identifying an image file. If used
dangerous permissions along with tent object corresponding to the to start an activity, the system will
OK and Cancel buttons. Here, desired action. The PendingIntent choose a component in a differ-
the user has the opportunity to object is simply a reference pointer ent application to view the image.
accept all permission requests or that can pass to another applica- If the target application doesn’t
deny the installation. “Signature” tion, say, via ICC. The recipient have read permission to the con-
permissions are granted only to application can modify the origi- tent provider containing the im-
applications signed by the same nal intent by filling in unspecified age file, the developer can use a
developer key as the package de- address and data fields and specify URI permission instead. In this
fining the permission (application when the action is invoked. The case, the developer sets a read flag
signing became mandatory in the invocation itself causes an RPC in the intent that grants the target
v0.9r1 SDK). Finally, “signature with the original application, in application access to the specific
or system” permissions act like which the ICC executes with all intent-identified record.
signature permissions but exist its permissions. URI permissions are essen-
for legacy compatibility with the Pending intents allow applica- tially capabilities for database re-
older system permission type. tions included with the framework cords. Although they provide least
The new permission protec- to integrate better with third-par- privilege4 access to content provid-
tion levels provide a means of ty applications. Used correctly, ers, the addition of a new delega-
controlling how developers as- they can improve an application’s tion mechanism further diverges
sign permission labels. Signature security—in fact, several Android from the original MAC model. As
permissions ensure that only the APIs require pending intents, such mentioned with pending intents,
framework developer can use as the ­location manager, which has delegation potentially impacts the
the specific functionality (only a “proximity update” feature that tractability of policy analysis. A
Google applications can directly notifies an application via intent content provider must explicitly
interface the telephony API, for broadcast when a geographic area allow URI permissions, therefore
example). Dangerous permissions is entered or exited. The pending they require the data store devel-
give the end user some say in the intent lets an application direct oper’s participation.
permission-granting process—for the broadcast to a specific private
example, FriendTracker defines broadcast receiver. This prevents Lessons in
the permission label associated forging without the need to co- Defining Policy
with the FRIEND_NEAR intent ordinate permissions with system Our experiences working with
broadcast as dangerous. However, applications. the Android security policy re-
the permission protection levels However, pending intents vealed that it begins with a rela-
express only trivial granting poli- diverge from Android’s MAC tively easy-to-understand MAC
cies. A third-party application still model by introducing delegation. enforcement model, but the num-
doesn’t have much control if it By using a pending intent, an ap- ber and subtlety of refinements
wants another developer to use the plication delegates the ability to make it difficult for someone to
permission label. Making a per- influence intent contents and the discover an application’s policy
mission “dangerous” helps, but it time of performing the action. simply by looking at it. Some re-
depends on the user understand- Historically, certain delegation finements push policy into the
ing the security implications. techniques have substantial nega- application code. Others add dele-
tive effects on the tractability of gation, which mixes discretionary
Pending Intents policy evaluation.6 controls into the otherwise typical
All the security refinements de- MAC model. This situation makes
scribed up to this point fall within URI Permissions gathering a firm grasp on An-
the realm of an extension to the The v1.0r1 SDK release (Sep- droid’s security model nontrivial.

56 IEEE Security & Privacy ■ January/February 2009

 Focus

Even with all the refinements, variants capture the appropriate McDaniel, Mitigating Android
holistic security concerns have response. We’ve successfully used Software Misuse Before It Happens,
gone largely unaddressed. First, Kirin to identify multiple vulner- tech. report NAS-TR-0094-2008,
what does a permission label really abilities in the base applications Network and Security Research
mean? The label itself is merely provided with Android and have Ctr., Dept. Computer Science and
a text string, but its assignment subsequently established an ongo- Eng., Pennsylvania State Univ.,
to an application provides access ing relationship with Google to Nov. 2008.
to potentially limitless resources. fix the flaws and further investi-
Second, how do you control access gate Android’s security via Kirin. William Enck is a PhD candidate in
to permission labels? Android’s In many ways, Android pro- the Systems and Internet Infrastruc-
permission protection levels pro- vides more comprehensive security ture Security (SIIS) Laboratory in the
vide some control, but more ex- than other mobile phone platforms. Department of Computer Science and
pressive constraints aren’t possible. However, learning how to effec- Engineering at Pennsylvania State Uni-
As a purposefully simple example, tively use its building blocks isn’t versity. His research interests include
should an application be able to easy. We’re only beginning to see operating systems security, telecom-
access both the microphone and different types of applications, and munications security, and systems and
the Internet? as Android matures, we’ll learn network security. Enck has an MS in
how faulty application policy af- computer science and engineering from
fects the phone’s security. We be- Pennsylvania State University. Contact

W ill granting a permission

break the phone’s security?
Do the access permission assign-
lieve that tools such as Kirin and
those like it will help mold An-
droid into the secure operating
him [email protected].

Machigar Ongtang is a PhD candidate

ments to an application’s com- system needed for next-generation in the Systems and Internet Infrastruc-
ponents put the phone or the computing platforms. ture Security (SIIS) Laboratory in the
application at risk? Android cur- Department of Computer Science and
rently provides no means of an- References Engineering at Pennsylvania State Uni-
swering these questions. 1. J.P. Anderson, Computer Security versity. Her research interests include
We developed an enhanced Technology Planning Study, tech. pervasive computing, context-aware
installer and security frame- report ESD-TR-73-51, Mitre, security, and telecommunications secu-
work to answer a variant of Oct. 1972. rity. Ongtang has an MSc in informa-
these questions—namely, “does 2. M.A. Harrison, W.L. Ruzzo, and tion technology for manufacture from
an application break some larger J.D. Ullman, “Protection in Op- the University of Warwick, UK. Contact
phone-wide security policy?” erating Systems,” Comm. ACM, her at [email protected].
Our tool, called Kirin,7 extracts vol. 19, no. 8, 1976, pp. 461–471.
an application’s security policy 3. L. Badger et al., “Practical Do- Patrick McDaniel is a co-director of
from its manifest file to deter- main and Type Enforcement for the Systems and Internet Infrastruc-
mine if the requested permis- UNIX,” Proc. IEEE Symp. Secu- ture Security (SIIS) Laboratory and as-
sions and component permission rity and Privacy, IEEE CS Press, sociate professor in the Department
assignments are consistent with 1995, pp. 66–77. of Computer Science and Engineering
the stakeholders’ definition of 4. J. Saltzer and M. Schroeder, “The at Pennsylvania State University. His
a secure phone (stakeholders in Protection of Information in research interests include systems and
this context range from the net- Computer Systems,” Proc. IEEE, network security, telecommunications
work provider to an enterprise to vol. 63, no. 9, 1975, pp. 1278– security, and security policy. McDaniel
a user). Kirin uses a formalized 1308. has a PhD in computer science from the
model of the policy mechanisms 5. I. Krstic and S.L. Garfinkel, “Bit- University of Michigan. Contact him at
described in this article to gen- frost: The One Laptop per Child [email protected].
erate automated proofs of com- Security Model,” Proc. Symp. Us-
pliance using a Prolog engine able Privacy and Security, ACM
running on the phone. If an ap- Press, 2007, pp. 132–142.
plication’s policy isn’t compliant, 6. N. Li, B.N. Grosof, and J. Feigen- Do you have any comments or
it won’t be installed. By defining baum, “Delegation Logic: A Log- complaints regarding this or any
security requirements in logic, ic-Based Approach to Distributed other article in our issue? Send a
which we call policy invariants, Authorization,” ACM Trans. Infor- letter to the editor! Please email
we significantly reduce the need mation and System Security, vol. 6, editor, Jenny Stout, at jstout@
to defer install-time decisions to no.1, 2003, pp. 128–171. computer.org. We’d love to hear
the user—that is, the policy in- 7. W. Enck, M. Ongtang, and P. from you.

www.computer.org/security/ ■ IEEE Security & Privacy 57