See discussions, stats, and author profiles for this publication at: https://www.researchgate.

net/publication/319388903

Android Security: A Review

Article in Academic Journal of Nawroz University · August 2017

DOI: 10.25007/ajnu.v6n3a99

CITATIONS READS
11 131

2 authors:

Omar Ahmed Amira Bibo Sallow

Duhok Polytechnic University Duhok Polytechnic University
23 PUBLICATIONS 1,083 CITATIONS 49 PUBLICATIONS 776 CITATIONS

SEE PROFILE SEE PROFILE

All content following this page was uploaded by Omar Ahmed on 24 May 2020.

The user has requested enhancement of the downloaded file.

Academic Journal of Nawroz University (AJNU) 135

Android Security: A Review

Omar M. Ahmed 1 and Amira B. Sallow2

1Department of Computer Science, Faculty of Science, Zakho University, Duhok, Kurdistan Region – Iraq
2Department of Computer Science and Information Technology, College of Computer Science & Information
Technology, Nawroz University, Duhok, Iraq

ABSTRACT
Smartphones are used by billions of people that means the applications of the smartphone is increasing, it is out of
control for applications marketplaces to completely validate if an application is malicious or legitimate. Therefore, it
is up to users to choose for themselves whether an application is safe to use or not. It is important to say that there
are differences between mobile devices and PC machines in resource management mechanism, the security solutions
for computer malware are not compatible with mobile devices. Consequently, the anti-malware organizations and
academic researchers have produced and proposed many security methods and mechanisms in order to recognize
and classify the security threat of the Android operating system. By means of the proposed methods are different
from one to another, they can be arranged into various classifications. In this review paper, the present Android
security threats is discussed and present security proposed solutions and attempt to classify the proposed solutions
and evaluate them.
KEYWORDS: Android, Security, Smartphone.

I. INTRODUCTION damage the developer reputation and the apps markets.

Android is a platform for mobile that is designed and Furthermore, because the Android platform is
developed to be totally open source. An advanced level considered one of the access control of the device,
of software and hardware can be used by Android consume excessive battery, steal private data, and even
applications, in addition to local and server data and transform the smartphone from normal into a botnet
information, uncovered by the operating system in order zombie (Appbrain, 2017).
to gets value and innovation to consumers. On the way There are huge diversity of Android vulnerabilities are
to guarantee the security of user’s application, existing which they could appear in many layers of
information, and data Android platform should be Android operating system’s security, like framework
having a powerful security mechanism. In order to layer or application layer or even Linux Kernel layer.
provide security for Open source platform, it requires a Vulnerabilities as well occurs in benign or any
powerful and severe security architecture. With applications by the unintended include of design flaws or
multilayered security, the architecture of Android coding faults. As mentioned previously, the flawed
platform is designed that gives the flexibility required for Android operating system gives the opportunity for
hackers or attackers to use it. There is many of security
an open source platform (Android, 2017).
threats exists on Android phones, like Denial of Service
Android applications are increasing very fast, the attacks, colluding, repackaging apps to inject malicious
informal application developers, and the open source code, permission escalation, and unauthorized access
platform encourages the malicious software developers between the application.
to Exploit of such application and vulnerable platform The objective of this paper is for expanding the coverage
and steal the user’s private data to unintentionally of malicious application growth, and Android security
threats. In this review paper, the main proposed works in
Academic Journal of Nawroz University (AJNU) Android operating system privacy and security will be
Volume 6, No 3(2017), 6 pages covered, and furthermost of the existing deployed tools
Received 1 May 2017; Accepted 29 August 2017 and techniques.
Regular research paper: Published 30 August 2017 1. Android Platform Security Architecture
Corresponding author’s e-mail: [email protected] Android is developed by Google at first and then via Open
Copyright ©2017 Omar M. Ahmed and Amira B. Sallow Handset Alliance (OHA) is promoted. The Android
open source platform, it permits or authorise the using of
This is an open access article distributed under the Creative platform is located on highest of the Linux kernel which is
third-party
Commons market applications.
Attribution License. Malicious software can

Original article | doi: 10.25007/ajnu.v6n3a97

136 Academic Journal of Nawroz University (AJNU)

consists of the APIs, libraries, and middleware by writing components, the Android operating system is based,
in c programming language, and above the application which is organized by five major layers like appeared in
framework the application software is running which Figure 1. Android operating system and platform
contains other libraries which they are Java-compatible. components and layers are described and analyzed as
Like open source licenses by Google, the Android’s source Threats and Defenses of Android Security (Brähler, 2010).
code is published. By means of a stack of software

Fig 1: Android operating system architecture

The Linux kernel is the most important among all layers example of native libraries such as for Internet security
of the whole system. This layer for the embedded the SSL libraries are used, for providing various media
environment is customized especially containing limited codecs the Media framework is used, to show 2D or 3D
resources. The entire Android operating system is graphics content the OpenGL is used, the common
constructed on top of the Linux kernel and by Google library libc, for storing data the SQLite database engine
extra architectural changes has been made. This layer as is used, and to display HTML content the Web browser
well performances as a deliberation layer between the engine WebKit is used.
software and hardware layers. The basic system The Android runtime has an element named Dalvik
functionality is provided Linux kernel such as the Virtual Machine (DVM), which is an interpreter for byte
management of device, memory, and process. Beside, an code that has been converted from Java Virtual Machine
array of device drivers is provided by Linux kernel (JVM) particularly designed and enhanced for Android.
which makes the job simpler while communicating the From Linux core features the Dalvik takes advantage
peripheral devices with Android. such as memory management, multitasking execution
The native libraries of the Android on top of the Linux environment, and multi-threading, which is for Java
kernel were developed. For handling different types of language it is very essential. Dalvik provides control to
data on the device this layer is enabled. Different useful applications to work as a process immediately with its
libraries are provided for Android OS as the well- own VM and the Linux kernel. While Dalvik is utilizing
function. These libraries are developed for a particular JVM, which gives clients a group of APIs and libraries to
hardware and were written in C or C++ language. As an design and create Android application mainly via Java

Original article | doi: 10.25007/ajnu.v6n3a97

Academic Journal of Nawroz University (AJNU) 137

programming language. can apply decompiling/disassembling of .apk files and

The application framework is written in Java and it is a inserting malicious code inside the main source code. By
collection of services that together make an environment using of repackaging techniques as a normal app with
for managing and running Android applications. As Java distract the malicious code can be disguised. The
classes, the services are provided to applications. These differentiate between a normal app and a repackaged
services are allowed for application developers to use in malicious code can be difficult because as the same way
their applications. The main services of application as the legitimate one the repackaged app typically
framework are View System, Notifications Manager, appears to function.
Resource Manager, Content Providers, and Activity 2.4. Denial of Service Attack
Manager. The growing quantity of mobile devices which they are
Application layer which is the last layer is placed on the connected to the Internet as a big network which could
upper of the Android operating system stack. This layer be a stage for evolution of DoS attacks. Because the
involve both of the preinstalled application and third- smartphones are not fortified or having less protections
party application developed and created by informal compared with PCs, the developers of malicious
application developers, such as Contacts Manager, applications find it as an appropriate platform for DoS
Browser, and Email apps. attacks. The primarily objectives of DoS attacks are
2. Android Security Threats targeting Overusing limited CPU, battery power,
Android operating system security is designed as a memory, and network bandwidth.
permission-based mechanism which manages and 2.5. Colluding
control the admission and approval of third-party The colluding threat is happening from the side of the
Android apps to reach critical resources. This users. Here, users deploy a group of applications that
permission-based mechanism is extensively criticized for have the same certificate and grant various sorts of
the inefficient permission management and controlling permissions could be non-sensitive or sensitive. These
the application permissions, by end-users, marketers, applications after installing it can get access to all their
and developers. Let's say, all permission requests from resources and permissions by taking advantage of a
an app can either be accepted by users to install it or not. shared UID.
Here, the major security threats of the Android will be 3. Proposed Solutions
discussed, which makes the user’s information Android security solutions separated into two kinds: 1)
vulnerable to leak and places the privacy at risk (Faruki Static; 2) Dynamic which both can use for vulnerability
et al., 2015). assessment, analysis, and detection. Static methods are
2.1. Information Leakage fast, yet it needs to manage false-positives sensibly.
The design of the present Android architecture restricts Dynamic methods, however time-consuming, are
applications from using or accessing other applications exceptionally useful when applications are extremely
or resources except it is approved by the users. Before obscured. There are also hybrid methods that merge both
installing and using an application the user has to grant dynamic and static methods together with the limitations
all access requests of the resources. Information leakage of both.
happens when without any restriction from OS the users 3.1. Crowdroid
grant resources. However, permission control In (Burguera, Zurutuza, & Nadjm-Tehrani, 2011) they
mechanism of the Android Operating system proposed a Crowrdoid system which is a behavior based
ineffectively protect user’s resource and privacy from malware detection. Which is having two mechanisms, a
malware. crowd sourcing application that should be deployed on
2.2. Privilege Escalation user-devices and other is for malware detection which is
Privilege escalation threats are utilized by taking a remote-server. The crowd sourcing application
advantage of freely accessible Android kernel communicates with the remote server by sending the
vulnerabilities to obtain higher or all access to resources behavioral data and this data could be as an application
which is typically protected from a user or app. Such log file. The application log file contains fundamental
kind of threat can be a consequence of unauthorized device info, behavioral data, and a list of installed apps.
activities from apps with extra privileges than intended, This data is processed at the remote-server to produce
as a result, can lead to many sensitive information feature vectors which later might be analyzed by 2-
leakages. To obtain access to the critical permissions the means partition clustering for recognizing if the app
Android exported components can be exploited. malicious or benign. An application report is created and
2.3. Repackaging Apps deposited in the remote-server’s database.
In the Android operating system, one of the most 3.2. AndroSimilar
common and important security threat is Repackaging. In (Faruki, Ganmoor, Laxmi, Gaur, & Bharmal, 2013)
Repackaging by using reverse-engineering techniques they propose AndroSimilar method which is used

Original article | doi: 10.25007/ajnu.v6n3a97

138 Academic Journal of Nawroz University (AJNU)

statistically implausible feature selection by means of for approval regarding the same.
similarity digest hashing mechanism. The proposed 3.6. FireDroid
solution efficiently detects code obfuscated malware, In (Russello, Jimenez, Naderi, & van der Mark, 2013) they
control flow obfuscation, method renaming, and junk propose FireDroid which is a framework that is policy-
method addition. Signature produced through the based by interleaving process system calls can
proposed method is sufficiently solid to detect unknown implementing security policies. In this method an
samples obfuscated with several code obfuscation application monitor is generated for tracking all
techniques which they are not detected by the common processes spawned in Android operating system and
Antivirus application. Manually analyzing the suspected based on humanly managed policies can accept or reject
samples detected by the method in which through them. At runtime, the FireDroid can identify if an app is
present Android malware signatures is verifying their executing illegitimate or potentially harmful actions by
similarity. This proposed signature method is strong in interrupting the system calls the app executes.
counter to repackaged apps. Regardless of if the malware is repackaged or a new type
3.3. Kirin of an existing one: FireDroid can detect and implement
In (Bahman Rashidi, Fung, & Vu, 2014) they proposed the proper security policies once the malware executes
Kirin method the main goal of this method is to harmful system calls.The objective of FireDroid is that it
qualifying malicious applications at install time utilizing is entirely transparent to the apps along with Android
certification process on applications. On app’s requested operating system. By this the users are not complicated
permissions this method uses a set of previously defined with a heavy interaction.
security rules for finding the matched permission 3.7. DroidScope
requests that are considered as a malicious. The defined In (Yan & Yin, 2012) they proposed DroidScope which is
rules are based on the sensitive permissions which lead a Virtual Machine Introspection (VMI) that is for
to abusing of dangerous activities and permissions. Android applications is dynamic analysis framework.
3.4. RecDroid Contrasting other dynamic analysis frameworks, it
In (B Rashidi, Fung, & Vu, 2014) they proposed the doesn't be located inside the emulator but creating
RecDroid method it is a framework through Dalvik-level and OS-level semantics by locating outside
crowdsourcing for resource accessing permission the emulator. By this, even in the kernel, the privilege
control. RecDroid tries to help users to choose the correct escalation attacks can be detected. It likewise makes the
choice to decide if a permission request ought to be attackers mission of disorderly analysis hard. upon
denied or accepted. RecDroid is an approval framework QEMU emulator the DroidScope is built, and likewise,
that brings together the user’s permission responses to make a set of APIs available to modify analysis needs to
the application’s permission requests, also for evaluating human analysts.
the level of experience of users this method is utilized 3.8. RiskMon
and to figure a proper response to the permission request In (Jing, Ahn, Zhao, & Hu, 2014) they propose the
even to be rejected or accepted. RecDroid depends on a RiskMon method which is integrated runtime behaviors
slight group of seed expert users that might generate and user’s expectations of authorized apps to produce a
dependable recommendations for a slight group of apps. risk assessment baseline in which can seizures suitable
To ignore malicious responses and detecting the behaviors of apps. User’s expectations on the apps are
malicious clients this method in addition utilizes a game- the key part of the operating system. Initially, the user’s
theoretic Bayesian. expectations of the deployed applications are gathered
3.5. Aurasium and the position of permission sets based on their
In (Xu, Saïdi, & Anderson, 2012) they proposed relevancy to the corresponding app. After that,
Aurasium technique which is a very useful technique depending on the gathered data from the user, it
that takes control of execution of applications, by forcing generates or produce the risk assessment baseline for the
arbitrary security rules at runtime. In order to have the apps. Lastly, utilizing the produced baseline, the method
ability to do that, Aurasium includes code for rules ranks deployed apps depending on the risk of the
enforcement to Android applications by repackages it. application’s interactions.
Aurasium can apply security rules across multiple 3.9. RiskRanker
applications not only at individual application. Any In (Grace, Zhou, Zhang, Zou, & Jiang, 2012) they propose
privacy and security violations are informed to the user. RiskRanker is a practical active procedure to recognize
So, it rejects the necessity of manipulating an Android zero-day Android malicious apps. It attempts to assess
operating system to monitor application behavior. It potential security risks caused by unauthorized
interferes when the application accessing sensitive data applications. They design an automated system with the
like phone identifiers, messages, contacts and purpose of analyzing the harmful behavior of
implementing shell-commands by requesting the user applications dynamically. The proposed method

Original article | doi: 10.25007/ajnu.v6n3a97

Academic Journal of Nawroz University (AJNU) 139

achieves a two-stage risk analysis. Firstly, they 3.10. DroidRanger

recognizes applications with medium and high risk. The In (Zhou, Zhou, Jiang, & Ning, 2012) they present a
purpose of recognizing these applications it traces non- survey to estimate the security of applications on some
obfuscated implementations of applications that invoke: existing unofficial Android application markets and
privacy violation attacks, illegal cost creation, and Google Play. The DroidRanger has two-stage analysis to
launching root exploits. Secondly, so as to determine detect zero-day malware and existing known malware.
those applications that encrypt exploit code to avoid the They utilize a permission-based behavioral footprinting
previous stage analysis it achieves an additional scheme so as to detect known malware. The other stage,
investigation by analyzing suspicious application to identify certain inherent behaviors of a zero-day
behavior. To solve this encounter, they make a set of malware they apply a heuristics-based filtering scheme.
heuristics to map applications to associated risk types The summary of all previous proposed solutions is
(Low, Medium, and High risk). presented in Table.1.
Table.1. Proposed solutions
Proposed Objective Mechanisms
Solutions Assessment Analysis Detection Static Dynamic
Crowrdoid
AndroSimilar
Kirin
RecDroid
Aurasium
FireDroid
DroidScope
RiskMon
RiskRanker
DroidRanger

4. Conclusion https://doi.org/10.1145/2046614.2046619
Alongside the expanding of Android smartphones, the Faruki, P., Bharmal, A., Laxmi, V., Ganmoor, V., Gaur, M.
quantity of Android applications, as well as malware is S., Conti, M., & Rajarajan, M. (2015). Android security:
expanding daily. Regardless of existing Android security A survey of issues, malware penetration, and
system, malware exploits the existing security system’s defenses. IEEE Communications Surveys and Tutorials,
weakness to reach and access the granted resources. By 17(2), 998–1022.
this means, various solutions have been proposed in https://doi.org/10.1109/COMST.2014.2386139
order to control and prevent the vulnerabilities in Faruki, P., Ganmoor, V., Laxmi, V., Gaur, M. S., &
Android platform. In this review paper, the proposed Bharmal, A. (2013). AndroSimilar : Robust Statistical
solution is divided into two groups static and dynamic Feature Signature for Android Malware Detection.
and into three goals assessment, analysis, and detection. Proceedings of the 6th International Conference on Security
of Information and Networks, (September 2015), 152–159.
REFERENCES
https://doi.org/10.1145/2523514.2523539
Android. (2017). Android Security Overview. Retrieved
Grace, M., Zhou, Y., Zhang, Q., Zou, S., & Jiang, X. (2012).
from https://source.android.com/security/
RiskRanker: Scalable and Accurate Zero-day Android
Appbrain. (2017). Number of android applications.
Malware Detection. 10th International Conference on
Retrieved July 28, 2017, from
Mobile Systems, Applications, and Services, 281–294.
http://www.appbrain.com/stats/number-of-android-
https://doi.org/10.1145/2307636.2307663
apps
Jing, Y., Ahn, G.-J., Zhao, Z., & Hu, H. (2014). RiskMon :
Brähler, S. (2010). Analysis of the Android Architecture.
Continuous and Automated Risk Assessment of
Karlsruhe Institute for Technology, 52. Retrieved from
Mobile Applications. Proceedings of the 4th ACM
http://os.ibds.kit.edu/downloads/sa_2010_braehler
Conference on Data and Application Security and Privacy
-stefan_android-architecture.pdf
- CODASPY ’14, 99–110.
Burguera, I., Zurutuza, U., & Nadjm-Tehrani, S. (2011).
https://doi.org/10.1145/2557547.2557549
Crowdroid: Behavior-Based Malware Detection
Rashidi, B., Fung, C., & Vu, T. (2014). On lightweight
System for Android. Proceedings of the 1st ACM
mobile phone application certification. Proceedings of
Workshop on Security and Privacy in Smartphones and
the ACM MobiCom Workshop on Security and Privacy in
Mobile Devices - SPSM ’11, 15.
Mobile Environments, 235–245.

Original article | doi: 10.25007/ajnu.v6n3a97

140 Academic Journal of Nawroz University (AJNU)

https://doi.org/10.1145/1653662.1653691
Rashidi, B., Fung, C., & Vu, T. (2014). RecDroid: A resource
access permission control portal and recommendation
service for smartphone users. 2014 ACM MobiCom
Workshop on Security and Privacy in Mobile
Environments, SPME 2014, 13–17.
https://doi.org/10.1145/2646584.2646586
Russello, G., Jimenez, A. B., Naderi, H., & van der Mark,
W. (2013). FireDroid: hardening security in almost-
stock Android. Proceedings of the 29th Annual Computer
Security Applications Conference, 319–328.
https://doi.org/10.1145/2523649.2523678
Xu, R., Saïdi, H., & Anderson, R. (2012). Aurasium:
Practical Policy Enforcement for Android
Applications. Proceedings of the 21st USENIX
Conference, 27. Retrieved from
https://www.usenix.org/system/files/conference/
usenixsecurity12/sec12-
final60.pdf%5Cnhttp://dl.acm.org/citation.cfm?id=2
362793.2362820
Yan, L. K., & Yin, H. (2012). DroidScope: Seamlessly
Reconstructing the OS and Dalvik Semantic Views for
Dynamic Android Malware Analysis. In USENIX
Security Symposium.
https://doi.org/10.1145/2420950.2420980
Zhou, W., Zhou, Y., Jiang, X., & Ning, P. (2012). Detecting
repackaged smartphone applications in third-party
android marketplaces. Proceedings of the Second ACM
Conference on Data and Application Security and Privacy -
CODASKY ’12, 317–326.
https://doi.org/10.1145/2133601.2133640

Original article | doi: 10.25007/ajnu.v6n3a97

View publication stats