Journal of Computer Science

Original Research Paper

An Empirical Analysis of Android Permission System Based

on User Activities
Ankur Rameshbhai Khunt and P. Prabu

Christ University, Hosur Road, Bangalore-560029, Karnataka, India

Article history Abstract: In today’s world there has been an exponential growth among
Received: 09-12-2017 smart-phone users which has led to the unbridled growth of smart-phone
Revised: 13-01-2018 apps available in Google play store, app store etc., In case of android
Accepted: 6-02-2018 application, there are many free applications for which the user need not
Corresponding Author:
shell out a penny to use the services. Here the magic word is “free” which
Ankur Rameshbhai Khunt entices millions of pliant people into installing those apps and giving
Christ University, Hosur Road, unnecessary access to their data and device control. Current studies have
Bangalore-560029, Karnataka, shown that over 70% of the apps in market, request to gather data
India digressive to the most functions of apps that might cause seeping of
Email: personal data or inefficient use of mobile resources. Of late, couple of
[email protected]
malignant applications gather unobtrusive information of the user through
Co-Author: third-party applications by increasing their permissions to high-level on
Dr. Prabu. P. the Android Operating System. Android permission system provides, the
Christ University, Hosur Road, user access to the third party apps and in return based on the permissions
Bangalore-560029, Karnataka, granted by the user, an app can access the related resource from the user's
India mobile. A user is bound to grant or deny permits during the installation of
[email protected] the application. For the most part, users don't focus on the asked
permissions, or sometimes users do not understand the meaning of the
permission and install the app on their device. They allow a way for
attackers to perform the malicious task by demanding for more than
expected set of permissions. These extra permissions permit the attacker
to exploit the device and also retrieve sensitive information from it. In
this research paper we describe how permission system security can
create an awareness among the users that would assist them in deciding
on permission grants. This improved and responsible user activities in
Android OS can help the users in utilizing their device securely.

Keywords: Android Security, Permissions, Malicious Application, Data

Leakage

Introduction Android is the widely used open source operating

system. This in-turn makes it very difficult in
Android is simply an operating system that facilitates managing as any developer can make application in
a user to interact and manage mobile devices through a their own way and user isn’t aware of pitfalls in the
Graphical User Interface (GUI). Some of the features of application, about its background services and
an android driven smart-phone are GPS capability, activities and the related security threats.
camera functionality, internet accessibility, touch screen Android operating system is based on Linux kernel.
interface, provision for application installation which is There are four layers in Android architecture. Each layer
the main differentiating and important feature in has different tasks. The base layer is Linux kernel which
comparison with generic mobile phones. To run these maintains Android operating system security and other
applications, Android devices support Operating System components. This layer contains all device drivers, USB
(OS) in the similar way as computer supports the drivers, Bluetooth drivers, Wi-Fi drivers, display drivers
operating system. Some most popular OS are Windows, and it is also helpful in maintaining power management of
Android, Linux, iOS, etc. Android system. Rooting of the device creates security

© 2018 Ankur Rameshbhai Khunt and P. Prabu. This open access article is distributed under a Creative Commons Attribution
(CC-BY) 3.0 license.
Ankur Rameshbhai Khunt and P. Prabu / Journal of Computer Science 2018, 14 (3): 324.333
DOI: 10.3844/jcssp.2018.324.333

vulnerability in the Android operating system. After rooting android threats, crime and also protect the sensitive data.
the device hacker or attacker can have direct access to Given below are some sorts of permissions mostly used
Linux kernel. Once the device is rooted, then there is no in the android application:
permission required for accessing the device.
Native libraries are the upper layer of Linux kernel • Android.permission.READ_CONTAC
which mainly consist of all kind of default libraries, for • Android.permission.WRITE_CONTACT
example, SQLite is for all database related operation, • Android.permission.READ_STORAGE
Webkit is used for inbuilt web browser, OpenGL is • Android.permission.WRITE_STORAGE
utilized for 2D and 3D graphics in Android and SSL is • Android.permission.RECEIVE_SMS
giving network access related authentications. The • Android.permission.WRITE_SMS
developer can use all libraries in their application, but • Android.permission.SEND_SMS
many times attackers may put some extra permission in • Android.permission.READ_SMS
their apps and might misuse those libraries.
• Android.permission.INTERNET
Android runtime also provides the core libraries
• Android.permission.READ_PHONE_STATE
and most importantly Dalvik Virtual Machine (DVM)
facilities which help to run the application on the
Through the above given set of permissions, the
device. DVM as compared to JVM optimizes the
applications can have access over all the resources. This
Android device providing fast performance while
manifest file is written within the XML which contains
consuming less memory.
some kind of tags. Through those tags one can define the
Android Framework provides us with the lot of
usage of application and structure of permission.
APIs like package manager, View Manager, content
In Fig. 1 we can see the architecture of the Access
provider, Activity Manager, Resource Manager and
Permission in Android. This is a basic model and it's
also provides lots of classes and interfaces for
same for all android devices. There are two applications,
Android application development.
Application 1 and Application 2 where application 2
The existing android system is a permission based
provides access to local data like contacts, sms, etc. and
system. For most applications, there are a set of
device component control like camera, mic, etc. In
permissions that need to be accepted for successful
Application 1, there is one module “A” and in
launching of the application. Most of these permissions
Application 2 there are modules “B” and “C”. Module A
concern with user sensitive data that are not needed for
can access the module “B” and “C” if they are assigned
that application, for example a gaming app asking for
permission labels of Application 1.
permission to access contacts. So, the proposed system
lets the user know how many other users have either
accepted or rejected these permissions.
Permission System
In Android, each application has one manifest .xml file
and in the absence of this file, task of running the
application is nearly impossible. It contains the entire list of
activities which are used in the apps and additionally it also
includes all the permissions which the application needs.
Android forces apps to declare the permissions
during the installation. The app user has to decide to
grant or revoke the permission of any android
applications before or after the installation. Malicious
apps cannot be a treat to device until user allow access to
demanded permissions. Most of the time user allow
application to access android sub-services unknowingly,
which causes improper working of device. To create
basic awareness, the user could decide whether to allow
to access certain permission or not. By providing
information at bottom of the permission box, about how
many people liked or disliked the set of permissions
asked by application at its first time of use. Based on
number of likes it helps the user to make certain
decisions. Providing this reference, it helps to reduce Fig. 1: Access permission architecture (Enck et al., 2009)

325
Ankur Rameshbhai Khunt and P. Prabu / Journal of Computer Science 2018, 14 (3): 324.333
DOI: 10.3844/jcssp.2018.324.333

Literature Review must be vigilant in setting the choice since attacker and
malware developer exploit user's lack of regard and
All applications once installed resides in the sandbox, develop the malicious application that requests
a secluded zone of the framework that does not have unnecessary permissions (Jain and Prachi, 2016).
access to device control or device data, unless In the early years of android, according to William
permissions are explicitly allowed by the user when the Enck and their team android straightforwardly made use
apps is being installed. In most cases, permission is of permission mark task show to limit access to
requested only when the application is run on the device resources and applications. Later on developers brought
by the user and not when installed. In either case, about several changes in the way android applications
permission based mechanism is broadly criticized for its were built by which explicit permission setting wasn’t
coarse-grained control of application permissions and the needed to access the resources but it can be done just by
inefficient permission management by developers, installing the applications. It can be done by setting the
marketers and end-users. For instance, users can either exported attribute to false or by letting the android
acknowledge all permission demands from an decide at its discretion based on a distinct attribute in its
application to install it or not install the application manifest to create a private component. Security control
(Rashidi and Fung, 2009). can be trimmed using such components. By making a
Luyi et al. (2014) proclaimed that they had developed component private, the developers do not have to worry
a new service for automatically identifying the Pileup about permissions label that has to be assigned to it or
risks on a mobile OS. They also claim that their about the likelihood that application might get them
approach can continuously scan new emerging Android another label (Enck et al., 2009).
versions to find out new vulnerabilities and can also A survey was done based on a research paper on the
conveniently detect related malicious apps on Android topic of security issues on Android Smartphone’s. This
devices without undermining its utility. research paper was named as Timing Information
To be on the safer side always make sure that only Stealing Smartphone Application (TISSA). According to
apps published in trusted and well-known market place this research, TISSA is a structure which is convenient
like Google play are download and installed. Disabling for serving security to the call logs, contacts and so on.
application download from poorly trusted sharing The user without being worried can safeguard all of its
channels can protect from accidental installation of poorly contacts and call logs by stuffing all of the permissions,
trusted or malicious packages (Vecchiato et al., 2016).
by employing TISSA. The users without any doubt can
With all said and done android security depends on
give the unrestricted access to its data in exceptional
equipment and programming along with the portrayal
protection mode and this all happens in the groove of
and integration of user interface with the device. An
submitting all of the permissions. The private data of the
individual smart-phone uses various technologies i.e.
user which is spilled under some circumstances
music player, telephone, advanced camera and much
influence a whole lot of android applications which is
more, which may contain directions for serious roles to
examined by TISSA. TISSA uses three principle
abuse different attack routes (Vecchiato et al., 2016).
The developers gain consent permissions through the components such as dexterous CPU, memory and vitality
Manifest file inside an application. Developers which give safety and reliability to the call logs, contacts
characterize the application’s security framework. By and other data. These principal components are the
duping the users into giving consent to the permission privacy setting content provider that is deployed to
requests, the developers gets undetectable access to the provide current privacy setting to the already installed
device’s secured resources and data (Faruki et al., 2015). apps. Privacy setting manager is very beneficial in
When approaching users for permission in an enhancing the privacy setting for the installed apps or
Android app, the OS may face proper restrictions which any execution. Privacy aware components are extended
enforced upon by the server. To avoid the forced to access the entrance into the user's data which further
restriction by the server, the app must be stated as integrates contacts, call logs and other data. When the
medicinal application while installing. This ensures that user dispatches a request through an installed application
the user application is properly interfaced with the to the current provider that is when TISSA start to work.
trusted server of association (Andow and Wang, 2015). Third party applications collect user’s routine usage,
For introducing an application, the user needs to ask for high priority permissions and demand to be a part
grant all the asked permission requests for that particular of Android OS. Chances of getting attacked by the
application or else that application won’t be installed on malicious and unsafe third party applications cause risk
the user’s device. Accepting the installation implies that to Android OS as it changes the various root-level
user is giving the permission to the application for permission and can separate the entire framework
getting access to all the resources asked for by the security. That will cause malfunctioning of the system
application from the device. Along these lines, the user (Android device) and android OS will not perform as per

326
Ankur Rameshbhai Khunt and P. Prabu / Journal of Computer Science 2018, 14 (3): 324.333
DOI: 10.3844/jcssp.2018.324.333

the expectation. Transitive rights utilization is not allowed or denied, but after applying this module users
managed by the android OS which allows applications to will frequently be able to decide whether the permission
bypass the denied access services. This is done by need to be allowed or denied.
forcing a user to allow access in term of permissions In the module, we are putting one label with
asked during installation of a particular application. permission which is recommended to the user to allow or
Allowing for various permissions is a loop hole in deny the permissions. This special label shows the how
Android OS causing possibilities of various attacks that many users had allowed or denied that special permission.
have been reported (Lee et al., 2013). Based on working of application, its requirements
During installation, any application asks for permissions must be fulfilled. If user does not grant permit to any one
which are granted by the user, but there are some of the permissions, those service will not be accessed by
applications which disturb the performance of android OS application.. So blindly never grant access to any
and also affect the working of other applications, without application to use our device services.
asking for permissions. Permission security model is a part
of Android which allows the user to decide whether to trust
on any application or not. Any applications cannot collect
information like ISP unless and until user allows or permit
application. Allowing applications by granting
permissions could lead to attack scenario which cause
malfunctioning of the device as well as Android OS. So
during installation process any application, the user must
focus on what kind of permission is asked and be careful
while granting permissions requested by the particular
application (Mohini et al., 2013).
Concluding all, the secured and safe behavior of
Android device is completely user depended because at
the end users decision matters a lot. During installation,
the display shows the list of permissions demanded by
the application. It could be dismissed or approved at the
will of the user (Enck et al., 2012).
Android gives authentication to component security
prerequisites by using permissions. Android OS has a
capability of permitting centrally so that the system
software and other application work properly. A similar
mechanism is used by the third-party application to set
and define new permissions that are brought in work by Fig. 2: Demo view of permission module in Android
taking OS permission. Finally, permissions are accorded
to apps during installation and stored in Package
Manager Service (PMS) (Heuser et al., 2014). Android
Most users do not bother to read or have a Device
comprehensive understanding of the way that the install
time permission works in android application. Cloud
Considering that the users are exploited by malware DB
which uses Android Security Model (ASM) applications
benefits (Heuser et al., 2014).
Local
The different security mechanism like permission
DB
systems, robust detachment between apps, etc., are being
executed in android and other portable operating
systems. But it was found that this mechanism was
insufficient (Fragkaki et al., 2012).
Permission,
Device ID,
Proposed Work Application ID
In our research work, we want to implement small
extra module in Android permission system.
Occasionally many users might not know or might not
understand that how many permissions should be Fig. 3: Implementation of module

327
Ankur Rameshbhai Khunt and P. Prabu / Journal of Computer Science 2018, 14 (3): 324.333
DOI: 10.3844/jcssp.2018.324.333

Due to advancement in android security, user can and D = deny. The local database information will be
grant or deny permissions demanded. Further Fig. 2 stored likewise. Depending on the device’s internet
shows the exact scenario with examples which is connectivity if the device is connected to the internet it
outcome of the proposed work. Figure 3 is the overall will store the data in both the databases at the same
architecture of proposed work. It would lead to instance, otherwise it will store the data in the local
increases the awareness of user and help the user to database and will update the server when the internet
make the decision whether to allow or deny the will be connected.
permission before or after installation of the When the user allows the permission, the allow
applications. Providing a bottom line showing likes variable (A) will be incremented by 1 and the whole
and dislike help user as well as developer.
record with full information like AppID, DeviceID,
Hangouts application is asking permission for “send
PermissionLabel, A = 1 and D = 0. When the user allows
and view SMS messages?” which was permitted by 2K
the permission, the deny variable (D) will be 0. Same
users and denied by 110 users. In the same way
WhatsApp application is asking permission for “access will be vice versa when the user denies the permission
your Microphone?” that was permitted by 9K users and (A = 0, D = 1). Once the choices are made by the user, it
denied by 11 users. Now the new user installing the app will check for the internet connectivity and if connected,
can check these permissions statistics to decide whether the data will also be stored in the server database,
or not to allow that permission request. otherwise only in the local database and will update in
The statistical information will come from the the server on establishing the connection.
Internet when user’s internet is ON or OFF and it will Algorithms and Results of the Proposed System
display the label. Through this tag, the user can quickly
decide the permission should be allowed or denied. There are two different algorithms that have been
Based on this simple tag we can improve the Android used in the proposed system. These algorithms are used
permission related security than the existing. to fetch the data from user’s device and displays it. The
algorithms and the results are as follows:
Implementation
Algorithm 1: Get Data from user’s Device
When the user gets his device connected to the
internet the Android local database syncs with server Now, the application permission data from the user
database given the application is installed on the device. device has been fetched using the above algorithm. For
All devices are recognized through a unique device id displaying how many users have allowed or how many
similar to the MAC address of PC and other computing has denied, the data will be displayed from the server
devices. Through the given device id, we can get the with the different algorithm.
information about installed application like the So, here we can see an example of the database and
application ID. After getting application id, one can how data is stored. The database comprises of five
easily view all the permissions utilized by particular columns. First is device id, which will store the all users
application and can also insert entries in a database. device id. Second is App id, which will store the app id
In the database, four initial entries do appear Device of install applications by the users and third is
id, Application id, Permission Label and State. State Permission, It stores permission asked by the installed
demonstrates that permission accepted or denied by the app. The 3rd and 4th column is Allow and Deny. It will
user. The value of the state is 0 or 1. Zero means Denied store the operation performed by the user on particular
and One means Allowed appropriate permission.
app permissions.
Figure 4 shows the working of getting the permission
There a two ways or scenarios in which the database
data whether the user has denied or allowed the
in the server gets updated.
permission request of the application. When any
application is installed by the user in their device, the During first time installation and running of the
application might ask for the set of permissions to access software, based on the customer preferences on the
the device components like camera, microphone, storage permission request, the device ID, App ID and different
or user’s data like location, contacts, SMS etc. The permissions and its status would be added as a new line
applications have different types of permissions with item in the database.
different functionalities. In this algorithm I’m trying to During second time or repeated installation and
get the data from the user’s device to the server which is running of the software, only the status of each
the choice of the user about to allow or deny the request permission request would be updated as per the user
of the permission. choice. A new line entry for the same device ID won’t be
In the server database the information which is to be created to avoid duplicate entries that can impact the
stored is DeviceID, AppID, PermissionLabel, A = allow total count statistics adversely.

328
Ankur Rameshbhai Khunt and P. Prabu / Journal of Computer Science 2018, 14 (3): 324.333
DOI: 10.3844/jcssp.2018.324.333

Install
application

If user allow Ask set of If user deny

permissions

A+ = 1 D+ = 1

Get device Id,

get App Id,
permission,
A=n,
D=n

If internet is not Check if If internet is working

internet is
working

Store data in Store data in local

local DB DB as well as
server DB

Device ID,
App ID,
permission, Google Device ID,
A=n, services App ID,
D=n permission,
A=n,
D=n

Check
Store data in
internet is
No Yes server DB
working

Fig. 4: How to get data from user’s device

In this example the chatApp has been installed on six In Fig. 6, the data to be provided to the user from
devices. The chatApp has many permissions but here we the server is been described. In this algorithm,
mention only two namely “READ_CONTACT” and globally allowed and denied permissions statistics for
“BLUETOOTH” permissions. 1st, 2nd and 4th users the application is provided to the user at the time of
allow “READ_CONTACTS” permission and 3rd user application download. The user can leverage on this
denies that permission. 5th user allows “BLUETOOTH” information to make the right decision in addressing
permission and 6th user denies that permission. This each permission request. Now let us understand the
example shows how server database stores all data. working of the algorithm.

329
Ankur Rameshbhai Khunt and P. Prabu / Journal of Computer Science 2018, 14 (3): 324.333
DOI: 10.3844/jcssp.2018.324.333

Fig. 5: Graph of Table 1

When a user initiates an application installation Table 1: Example of how data store in server
process from any App store, the OS initially checks Device ID App ID Permission (A) (D)
whether the app is already installed in the device or A3s0s253 com.chatApp READ_CONTACT 1 0
not. If not, then it will immediately stop the process. Dcjek09d com.chatApp READ_CONTACT 1 0
Otherwise, during the installation process it will get KLD987s com.chatApp READ_CONTACT 0 1
the App ID and Device ID for that particular device Hjdm67w com.chatApp READ_CONTACT 1 0
and store it in the local database. After that it will JHk8udh com.chatApp BLUETOOTH 1 0
fetch the count of Allowed (A) and Denied (D) based Dchjd7dj com.chatApp BLUETOOTH 0 1
on the App ID and Device ID for the particular
permission from the server to the device. This
Table 2: Example of how data store in local database
permission statistics data from the server helps the
Device ID App ID Permission (A) (D)
user in deciding which permission request he should
honor or not as per the public opinion. Based on the Abcde1 com.chatApp READ_CONTACT 3 1
choices made for each permission request, a line Abcde1 com.chatApp BLUETOOTH 1 1
record would be created for each permission request
with its status in the local device. The following database table shows the information
transferred from the server.
Algorithm 2: Fetch Data from Server to User’s
Now, when the user opens the application after
Device
installation, it will ask for certain permissions to the
Now after fetching the data from the server, it will user. As shown in Fig. 2 it will show a dialog box with
check whether the App ID is there in the local database two options namely Allow and Deny for any particular
or not. If not, then data will be fetched from the server permission like using Camera, accessing Contacts etc. It
with information like Device ID, App ID, Permission, will additionally show the count of how many people
A = n, D = n (n = number of counts). But if found, allowed the permission for that particular application and
then it will compare the permission and its global how many denied for the same.
status count. If there is no difference then, it will stop In Fig. 7 example server data is shown in Table 1, In
as it contains all the data updated as in the server. In that table total three users allowed “READ_CONTACT”
case, there are any changes in the two databases, it permission and one user denied. For “BLUETOOTH”
will update the local database with specific records permission, one user allowed and 1 user denied that
with the data fetched from the server and will store permission. Same count summary of appropriate
the final content of data in the local database. permissions is shown in Table 2.

330
Ankur Rameshbhai Khunt and P. Prabu / Journal of Computer Science 2018, 14 (3): 324.333
DOI: 10.3844/jcssp.2018.324.333

Install App from

Google Playstore

Check
application No
installed or not

Yes

Get App Id,

Device Id

Get count of A & D

based on permission
of particular App Id
& device Id

No App Id is exist Yes

in local db Stop

Store data in
local database No Verify count of allow Yes
and deny check if it is
matching or not

Update records of
specific App Id

Device id
App id,
permission,
A=n,
D=n

Fig. 6: How to fetch data from server to user’s device

Com.chatApp
READ_CONTACT
2
Com.chatApp
BLUETOOTH
1

0
(A) (D)

Fig. 7: Graph of Table 2

331
Ankur Rameshbhai Khunt and P. Prabu / Journal of Computer Science 2018, 14 (3): 324.333
DOI: 10.3844/jcssp.2018.324.333

Results and Discussion Ethics

As we see in algorithm 1 the individual data of each All information provided in this paper is
user is fetched. The permission name along with its confidential and unique. This paper has neither been
status are extracted for each user. This data has been published nor is under review elsewhere. In this
processed by algorithm 2 to generate the consolidated article, we propose a new method and algorithm for
report. This report consists of each permission name and the Android security. Any implementation or
the number of users who have either accepted or denied adaptation of this idea is subjected to the user’s own
the demand permission (Fig. 2). result and the idea and result in this paper no way
This number of acceptances and rejections are very guarantees safety, security or some pre defied result.
useful for a any new user to decide whether to allow
or deny the permission for the application. If more References
number of users have denied the permission, then the Andow, B. and H. Wang, 2015. A distributed android
new user will know that it may not be safe to allow security framework. Proceedings of the IEEE
the permission. International Conference on Smart City, Dec. 19-21,
IEEE Xplore Press, pp: 1045-52.
Conclusion DOI: 10.1109/SmartCity.2015.207
Enck, W., D. Octeau, P. McDaniel and S. Chaudhuri, 2012.
A wide range of applications incorporate permission A study of android application security. Systems and
excursive to the application’s utility. These permissions Internet Infrastructure Security Laboratory.
allow access to assets which are delicate in nature. This Enck, W., M. Ongtang and P. McDaniel, 2009.
may result in the spillover of user data or utilized by Understanding android security. IEEE Security
the third party identified by the application. The user is
Privacy Magazine, 7: 50-57.
unaware of this and agrees to the permissions because
DOI: 10.1109/MSP.2009.26
the user is not warned about these threats in any
Faruki, P., A. Bharmal, V. Laxmi, V. Ganmoor and M.
possible ways. So the proposed system permits the user
to see that in reality how many people have genuinely Gaur et al., 2015. Android security: A survey of
agreed to this permission and how many have not. This issues, malware penetration and defenses. IEEE
increases the security of information and permits the Commun. Surveys Tutorials, 17: 998-1022.
user to choose which information he/she needs to share. DOI: 10.1109/COMST.2014.2386139
In future, I expect up-gradation of security by Fragkaki, E., L. Bauer, L. Jia and D. Swasey, 2012.
evacuating those permissions which are dismissed by Modeling and enhancing android's permission
the greatest number of users. The application will make system. CyLab at Carnegie Mellon University.
a request to the developer to avoid those permissions Heuser, S., A. Nadkarni, W. Enck and Ahmad-Reza
which most users have rejected in order to continue in Sadeghi, 2014. ASM: A programmable interface
the application market. This initiative would guarantee for extending android security. Proceedings of the
general safety and security of user information and 23rd USENIX Conference on Security
counteractive action of third party applications utilizing Symposium, Aug. 20-22, USENIX Association,
private information. San Diego, CA, pp: 1005-19.
Jain, A. and Prachi, 2016. Android security: Permission
Acknowledgment based attacks. Proceedings of the 3rd International
Conference on Computing for Sustainable Global
We thank our colleagues from Christ University,
Development, Mar. 16-18, IEEE Xplore Press, New
Bangalore who provided insight and expertise that
Delhi, India, pp: 2754-59.
greatly assisted the research.
Lee, C., J. Kim, S. Cho, J. Choi and Y. Park, 2013.
We would also like to show our gratitude to Joy
Unified security enhancement framework for the
Paulose, H.O.D of Department of Computer Science,
Android operating system. J. Supercomput., 67:
Christ University, for sharing their pearls of wisdom
738-756. DOI: 10.1007/s11227-013-0991-y
with us during this research and we thank 3
Luyi, X., P. Xiaorui, W. Rui, K. Yuan and W. XiaoFeng,
“anonymous” reviewers for their so-called insights.
2014. Upgrading your android, elevating my
malware: Privilege escalation through mobile OS
Authors Contributions updating. Proceedings of the IEEE Symposium on
Ankur Rameshbhai Khunt: Android extra module Security and Privacy, May 18-21, IEEE Xplore
for permission system. Press, San Jose, CA, USA, pp: 393-408.
P. Prabu: Allow and deny services. DOI: 10.1109/SP.2014.32

332
Ankur Rameshbhai Khunt and P. Prabu / Journal of Computer Science 2018, 14 (3): 324.333
DOI: 10.3844/jcssp.2018.324.333

Mohini, T., S. Ashish Kumar and G. Nitesh, 2013. Vecchiato, D., M. Vieira and E. Martins, 2016. The
Review on android and Smartphone security. J. perils of android security configuration. Computer,
Comput. Inform. Technol. Sci., 1: 12-19. 49: 15-21. DOI: 10.1109/MC.2016.184
Rashidi, B. and C. Fung, 2009. A survey of android security
threats and defenses. J. Wireless Mobile Netw.
Ubiquitous Comput. Dependable Applic., 6: 3-35.

333