ACMiner: Extraction and Analysis of Authorization Checks in Android's Middleware

TL;DR

ACMiner is a framework that analyzes Android's middleware to identify inconsistencies in authorization checks, helping detect security vulnerabilities in access control enforcement.

Contribution

It introduces a novel combination of program and text analysis techniques for systematic evaluation of Android's authorization enforcement.

Findings

Identified 28 vulnerabilities related to missing checks in Android 7.1.1

Demonstrated effectiveness in processing millions of lines of code

Showed potential to improve Android security through automated analysis

Abstract

Billions of users rely on the security of the Android platform to protect phones, tablets, and many different types of consumer electronics. While Android's permission model is well studied, the enforcement of the protection policy has received relatively little attention. Much of this enforcement is spread across system services, taking the form of hard-coded checks within their implementations. In this paper, we propose Authorization Check Miner (ACMiner), a framework for evaluating the correctness of Android's access control enforcement through consistency analysis of authorization checks. ACMiner combines program and text analysis techniques to generate a rich set of authorization checks, mines the corresponding protection policy for each service entry point, and uses association rule mining at a service granularity to identify inconsistencies that may correspond to vulnerabilities. We used ACMiner to study the AOSP version of Android 7.1.1 to identify 28 vulnerabilities relating to missing authorization checks. In doing so, we demonstrate ACMiner's ability to help domain experts process thousands of authorization checks scattered across millions of lines of code.