research-article

On lightweight mobile phone application certification

Authors:

William Enck,

Machigar Ongtang,

Patrick McDanielAuthors Info & Claims

CCS '09: Proceedings of the 16th ACM conference on Computer and communications security

Pages 235 - 245

https://doi.org/10.1145/1653662.1653691

Published: 09 November 2009 Publication History

Get Access

Abstract

Users have begun downloading an increasingly large number of mobile phone applications in response to advancements in handsets and wireless networks. The increased number of applications results in a greater chance of installing Trojans and similar malware. In this paper, we propose the Kirin security service for Android, which performs lightweight certification of applications to mitigate malware at install time. Kirin certification uses security rules, which are templates designed to conservatively match undesirable properties in security configuration bundled with applications. We use a variant of security requirements engineering techniques to perform an in-depth security analysis of Android to produce a set of rules that match malware characteristics. In a sample of 311 of the most popular applications downloaded from the official Android Market, Kirin and our rules found 5 applications that implement dangerous functionality and therefore should be installed with extreme caution. Upon close inspection, another five applications asserted dangerous rights, but were within the scope of reasonable functional needs. These results indicate that security configuration bundled with Android applications provides practical means of detecting malware.

References

[1]

AdMob. AdMob Mobile Metrics Report. http://www.admob.com/marketing/pdf/ mobile_metrics_feb_09.pdf, February 2009.

Google Scholar

[2]

J. P. Anderson. Computer Security Technology PlanningStudy. Technical Report ESD-TR-73-51, The Mitre Corporation, Air Force Systems Division, Hanscom AFB,Badford, MA, October 1972.

Crossref

Google Scholar

[3]

Apple, Inc. Get Ready for iPhone OS 3.0. http://developer.apple.com/iphone/ program/sdk.html. Accessed April 2009.

Google Scholar

[4]

A. Bose, X. Hu, K. G. Shin, and T. Park. BehavioralDetection of Malware on Mobile Handsets. In Proceedings of the International Conference on Mobile Systems, Applications, and Services (MobiSys), pages 225--238, 2008.

Digital Library

Google Scholar

[5]

P. Chen, M. Dean, D. Ojoko-Adams, H. Osman, L. Lopez, and N. Xie. System Quality Requirements Engineering (SQUARE) Methodology: Case Study on Asset Management System. Technical Report CMU/SEI-2004-SR-015, Software Engineering Institute, Carnegie Mellon University, December 2004.

Google Scholar

[6]

J. Cheng, S. H. Wong, H. Yang, and S. Lu. SmartSiren: Virus Detection and Alert for Smartphones. In Proceedings of the International Conference on Mobile Systems, Applications, and Services (MobiSys), pages 258--271, June 2007.

Digital Library

Google Scholar

[7]

L. F. Cranor. P3P: Making Privacy Policies More Useful. IEEE Security&Privacy magazine, 1(6):50--55, November-December 2003.

Digital Library

Google Scholar

[8]

D. Dagon, T. Martin, and T. Starner. Mobile Phones as Computing Devices: The Viruses are Coming! IEEE Pervasive Computing, 3(4):11--15, October-December 2004.

Digital Library

Google Scholar

[9]

L. Desmet, W. Joosen, F. Massacci, P. Philippaerts, F. Piessens, I. Siahaan, and D. Vanoverberghe. Security-by-contract on the .NET platform. Information Security Technical Report, 13(1):25--32, January 2008.

Digital Library

Google Scholar

[10]

W. Enck, M. Ongtang, and P. McDaniel. Mitigating AndroidSoftware Misuse Before It Happens. Technical Report NAS-TR-0094-2008, Network and Security Research Center, Department of Computer Science and Engineering, Pennsylvania State University, University Park, PA, USA, November 2008.

Google Scholar

[11]

W. Enck, M. Ongtang, and P. McDaniel. Understanding Android Security. IEEE Security&Privacy Magazine, 7(1):50--57, January/February 2009.

Digital Library

Google Scholar

[12]

F-Secure Corporation. Virus Description: Cabir. http://www.f-secure.com/v-descs/cabir.shtml. Accessed March 2009.

Google Scholar

[13]

F-Secure Corporation. Virus Description: Cardblock.A. http://www.f-secure.com/v-descs/cardblock_a.shtml. Accessed March 2009.

Google Scholar

[14]

F-Secure Corporation. Virus Description: Commwarrior. http://www.f-secure.com/v-descs/commwarrior.shtml. Accessed March 2009.

Google Scholar

[15]

F-Secure Corporation. Virus Description: Drever.A. http://www.f-secure.com/v-descs/drever_ a.shtml. Accessed March 2009.

Google Scholar

[16]

F-Secure Corporation. Virus Description: Lasco.A. http://www.f-secure.com/v-descs/lasco_a.shtml. Accessed March 2009.

Google Scholar

[17]

F-Secure Corporation. Virus Description: Pbstealer.A. http://www.f-secure.com/v-descs/pbstealer_a.shtml. Accessed March 2009.

Google Scholar

[18]

F-Secure Corporation. Virus Description: Skulls.A. http://www.f-secure.com/v-descs/skulls.shtml. Accessed March 2009.

Google Scholar

[19]

F-Secure Corporation. Virus Description: Viver.A. http://www.f-secure.com/v-descs/trojan_ symbos_viver_a.shtml. Accessed March 2009.

Google Scholar

[20]

F-Secure Corporation. Virus Description: Worm:SymbOS/Yxe.A. http://www.f-secure.com/v-descs/worm_symbos_yxe.shtml. Accessed March 2009.

Google Scholar

[21]

F-Secure Corporation. Telia Sonera Finland and F-Secure united against mobile viruses: Cabir spreads at the World Championships. http://www.f-secure.com/en_EMEA/about-us/pressroom/news/2005/fs_news_20050811_1_eng.html, August 2005.

Google Scholar

[22]

F-Secure Corporation. Just because it's Signed doesn't meanit isn't spying on you. http://www.f-secure.com/ weblog/archives/00001190.html, May 2007.

Google Scholar

[23]

C. Fleizach, M. Liljenstam, P. Johansson, G. M. Moelker, and A. Mehes. Can you Infect Me Now? Malware Propagation in Mobile Phone Networks. In Proceedings ofthe ACM Workshop On Rapid Malcode (WORM), pages 61--68, Novermber 2007.

Digital Library

Google Scholar

[24]

Georgia Tech Information Security Center. Emerging Cyber Threats Report for 2009. http://www.gtisc.gatech.edu/pdf/CyberThreatsReport2009.pdf, October 2008.

Google Scholar

[25]

C. Guo, H. J. Wang, and W. Zhu. Smart-Phone Attacks and Defenses. In Third Workshop on Hot Topics in Networks (HotNets), November 2004.

Google Scholar

[26]

C. B. Haley, J. D. Moffett, R. Laney, and B. Nuseibeh. A framework for security requirements engineering. In SESS'06: Proceedings of the 2006 international workshop on Software engineering for secure systems, pages 35--42, 2006.

Digital Library

Google Scholar

[27]

D. Hatebur, M. Heisel, and H. Schmidt. A Pattern System for Security Requirements Engineering. In ARES'07: Proceedings of the The Second International Conference on Availability, Reliability and Security, pages 356--365, 2007.

Digital Library

Google Scholar

[28]

M. Hypponen. Mobile Malware. USENIX Security Symposium, August 2007. Invited Talk.

Google Scholar

[29]

Independent Security Evaluators. Exploiting Android. http://securityevaluators.com/content/ case-studies/android/index.jsp.

Google Scholar

[30]

I. Ion, B. Dragovic, and B. Crispo. Extending the Java Virtual Machine to Enforce Fine-Grained Security Policies in Mobile Devices. In Proceedings of the Annual ComputerSecurity Applications Conference (ACSAC), December 2007.

Crossref

Google Scholar

[31]

ISO/IEC 15408--1 Information technology - Security techniques - Evaluation criteria for IT security - Part 1: Introduction and general model, October 2005.

Google Scholar

[32]

S. Lipner and M. Howard. The Trustworthy Computing Security Development Lifecycle. http://msdn.microsoft.com/en-us/library/ ms995349.aspx, March 2005.

Digital Library

Google Scholar

[33]

J. McDermott and C. Fox. Using Abuse Case Models for Security Requirements Analysis. In Proceedings of the 15th Annual Computer Security Applications Conference, 1999.

Digital Library

Google Scholar

[34]

N. R. Mead. How To Compare the Security QualityRequirements Engineering (SQUARE) Method with Other Methods. Technical Report CMU/SEI-2007-TN-021,Software Engineering Institute, Carnegie Mellon University, August 2007.

Google Scholar

[35]

D. Mellado, E. Fernandez-Medina, and M. Piattini. Applying a Security Requirements Engineering Process. LNCS: Computer Security -- ESORICS 2006, 4189/2006:192-206, September 2006.

Digital Library

Google Scholar

[36]

D. Mellado, E. Fernández-Medina, and M. Piattini. Acommon criteria based security requirements engineering process for the development of secure information systems. Computer Standards&Interfaces, 29(2):244--253, 2007.

Digital Library

Google Scholar

[37]

J. D. Moffett, C. B. Haley, and B. Nuseibeh. Core Security Requirements Artefacts. Technical report, Open University, UK, 2004.

Google Scholar

[38]

D. Muthukumaran, A. Sawani, J. Schiffman, B. M. Jung, and T. Jaeger. Measuring Integrity on Mobile Phone Systems. In Proceedings of the ACM Symposium on Access Control Models and Technologies, pages 155--164, June 2008.

Digital Library

Google Scholar

[39]

G. C. Necula. Proof-Carrying Code. In Proceedings of the Symposium on Principles of Programming Languages (POPL), pages 106--119, Jan. 1997.

Digital Library

Google Scholar

[40]

Open Web Application Security Project (OWASP) Foundation. CLASP (Comprehensive, Lightweight Application Security Process) Project. http://www.owasp.org/index.php/OWASP_CLASP_Project, March 2009.

Google Scholar

[41]

Oracle. Oracle Software Security Assurance. http://www.oracle.com/security/ software-security-assurance.html, April 2009.

Google Scholar

[42]

M. Polychronakis, P. Mavrommatis, and N. Provos. GhostTurns Zombie: Exploring the Life Cycle of Web-based Malware. In Proceedings of the USENIX Workshop on Large-Scale and Emergent Threats (LEET), April 2008.

Digital Library

Google Scholar

[43]

S. Rueda, D. King, and T. Jaeger. Verifying Compliance of Trusted Programs. In Proceedings of the USENIX Security Symposium, pages 321--334, August 2008.

Digital Library

Google Scholar

[44]

A.-D. Schmidt, F. Peters, F. Lamour, C. Scheel, S. A.Camtepe, and S. Albayrak. Monitoring Smartphones for Anomaly Detection. Mobile Networks and Applications, 14(1):92--106, February 2009.

Digital Library

Google Scholar

[45]

M. Schumacher, E. Fernandez-Buglioni, D. Hybertson,F. Buschmann, and P. Sommerlad. Security Patterns: Integrating Security and Systems Engineering. Wiley, 2009.

Digital Library

Google Scholar

[46]

D. Shin, J. Ahn, and C. Shim. Progressive Multi Gray-Leveling: A Voice Spam Protection Algorithm. IEEE Network, 20(5):18--24, September-October 2006.

Digital Library

Google Scholar

[47]

G. Sindre and A. L. Opdahl. Eliciting security requirements with misuse cases. LNCS: Requirements Engineering, pages 34--44, June 2004.

Digital Library

Google Scholar

[48]

N. Yoshioka, H. Washizaki, and K. Maruyama. A survey onsecurity patterns. Progress in Informatics, Special issue: The future of software engineering for security and privacy, 5:35--47, October 2008.

Google Scholar

[49]

X. Zhang, O. Aciic,mez, and J.-P. Seifert. A Trusted MobilePhone Reference Architecture via Secure Kernel. In Proceedings of the ACM workshop on Scalable Trusted Computing, pages 7--14, November 2007.

Digital Library

Google Scholar

Cited By

View all

Bemmann FStoll HMayer S(2024)Privacy Slider: Fine-Grain Privacy Control for SmartphonesProceedings of the ACM on Human-Computer Interaction10.1145/36765198:MHCI(1-31)Online publication date: 24-Sep-2024
https://dl.acm.org/doi/10.1145/3676519
Barzolevskaia ABranca EStakhanova N(2024)Measuring and Characterizing (Mis)compliance of the Android Permission SystemIEEE Transactions on Software Engineering10.1109/TSE.2024.336292150:4(742-764)Online publication date: Apr-2024
https://doi.org/10.1109/TSE.2024.3362921
Nisa SAl Asad NRahaman A(2024)Developing Explainable Deep Learning Models for Android Malware Detection2024 IEEE International Conference on Power, Electrical, Electronics and Industrial Applications (PEEIACON)10.1109/PEEIACON63629.2024.10800115(175-179)Online publication date: 12-Sep-2024
https://doi.org/10.1109/PEEIACON63629.2024.10800115
Show More Cited By

Index Terms

On lightweight mobile phone application certification
1. Security and privacy
  1. Systems security
    1. Operating systems security

Recommendations

Enhancing Stealthiness & Efficiency of Android Trojans and Defense Possibilities (EnSEAD) - Android's Malware Attack, Stealthiness and Defense: An Improvement
FIT '11: Proceedings of the 2011 Frontiers of Information Technology

In this work, we have studied Android Architecture from a security point of view. We have studied various defense mechanisms that are present in current Android Platform or are recently proposed. We took inspiration from Sound comber--a recent Android ...
Android application security: detecting Android malware and evaluating anti-malware software

Mobile devices have become widespread computing technology, people prefer to use than desktop devices. These connected devices and their features like an exchange of data, video calling etc. have made our lives simple but, this has also increased data ...
Effectiveness of Android Obfuscation on Evading Anti-malware
CODASPY '18: Proceedings of the Eighth ACM Conference on Data and Application Security and Privacy

Obfuscation techniques have been conventionally used for legitimate applications, including preventing application reverse engineering, tampering and protecting intellectual property. A malware author could also leverage these benign techniques to hide ...

Reviews

Reviewer: Edgar R. Weippl

Enck, Ongtang, and McDaniel present a methodology for certifying mobile phone applications during the installation process. During the installation process, the application is classified according to its behavior and possibly suspicious activities-for example, accessing a global positioning system (GPS) location and sending it over the Internet. Android's standard security decisions are primarily based on the application's packet manifest-permissions may or may not be granted to applications, as requested. The authors defined the security rules using their Kirin Security Language; for instance, a rule may state that a certain application must not be debugged by another application. To validate their method, they analyzed existing applications and found that several applications, such as GPS-tracking programs, violate some of their rules and are thus classified as potentially dangerous. If installed in secret, tracking GPS locations and sending them over the Internet can be maliciously used for spying. The researchers also discovered some security flaws; for instance, in their early versions, Android applications created short message service (SMS) text messages that appeared to have been received over the cellular network when in fact they had been created locally. In summary, the authors present three main ideas in this paper: they describe a methodology for implementing additional security features in Android; they show how applications can be dynamically certified; and they provide and validate some rules that may be used to characterize the behavior of applications on mobile devices. This paper is for readers who are interested in "practical mobile phone security." Online Computing Reviews Service

Access critical reviews of Computing literature here

Become a reviewer for Computing Reviews.

Comments

Information & Contributors

Information

Published In

CCS '09: Proceedings of the 16th ACM conference on Computer and communications security

November 2009

664 pages

ISBN:9781605588940

DOI:10.1145/1653662

General Chair:
Ehab Al-Shaer
University of North Carolina, Charlotte, USA
,
Program Chairs:
Somesh Jha
University of Wisconsin, USA
,
Angelos D. Keromytis
Columbia University, USA and Symantec Research Labs Europe, France

Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. Copyrights for components of this work owned by others than ACM must be honored. Abstracting with credit is permitted. To copy otherwise, or republish, to post on servers or to redistribute to lists, requires prior specific permission and/or a fee. Request permissions from [email protected]

Publisher

Association for Computing Machinery

New York, NY, United States

Publication History

Published: 09 November 2009

Permissions

Request permissions for this article.

Request Permissions

Check for updates

Author Tags

Qualifiers

Research-article

Conference

CCS '09

Sponsor:

SIGSAC

CCS '09: 16th ACM Conference on Computer and Communications Security 2009

November 9 - 13, 2009

Illinois, Chicago, USA

Acceptance Rates

Overall Acceptance Rate 1,261 of 6,999 submissions, 18%

Upcoming Conference

CCS '25

Sponsor:
sigsac

ACM SIGSAC Conference on Computer and Communications Security

October 13 - 17, 2025

Taipei , Taiwan

Contributors

Other Metrics

View Article Metrics

Bibliometrics & Citations

Bibliometrics

Article Metrics

635
Total Citations
View Citations
4,583
Total Downloads

Downloads (Last 12 months)66
Downloads (Last 6 weeks)1

Reflects downloads up to 26 Jan 2025

Other Metrics

View Author Metrics

Citations

Cited By

View all

Bemmann FStoll HMayer S(2024)Privacy Slider: Fine-Grain Privacy Control for SmartphonesProceedings of the ACM on Human-Computer Interaction10.1145/36765198:MHCI(1-31)Online publication date: 24-Sep-2024
https://dl.acm.org/doi/10.1145/3676519
Barzolevskaia ABranca EStakhanova N(2024)Measuring and Characterizing (Mis)compliance of the Android Permission SystemIEEE Transactions on Software Engineering10.1109/TSE.2024.336292150:4(742-764)Online publication date: Apr-2024
https://doi.org/10.1109/TSE.2024.3362921
Nisa SAl Asad NRahaman A(2024)Developing Explainable Deep Learning Models for Android Malware Detection2024 IEEE International Conference on Power, Electrical, Electronics and Industrial Applications (PEEIACON)10.1109/PEEIACON63629.2024.10800115(175-179)Online publication date: 12-Sep-2024
https://doi.org/10.1109/PEEIACON63629.2024.10800115
Shen LFang MXu J(2024)GHGDroidComputers and Security10.1016/j.cose.2024.103846141:COnline publication date: 1-Jun-2024
https://dl.acm.org/doi/10.1016/j.cose.2024.103846
Sharma YArora A(2024)IPAnalyzer: A novel Android malware detection system using ranked Intents and PermissionsMultimedia Tools and Applications10.1007/s11042-024-18511-683:33(78957-79008)Online publication date: 1-Mar-2024
https://doi.org/10.1007/s11042-024-18511-6
Sharma YArora A(2024)A comprehensive review on permissions-based Android malware detectionInternational Journal of Information Security10.1007/s10207-024-00822-223:3(1877-1912)Online publication date: 4-Mar-2024
https://doi.org/10.1007/s10207-024-00822-2
Niu WZhang XYan RGong JNiu WZhang XYan RGong J(2024)Behavior-Based Detection Method for Android MalwareAndroid Malware Detection and Adversarial Methods10.1007/978-981-97-1459-9_3(43-54)Online publication date: 4-Mar-2024
https://doi.org/10.1007/978-981-97-1459-9_3
Niu WZhang XYan RGong JNiu WZhang XYan RGong J(2024)Feature Code Based Android Malware Detection MethodAndroid Malware Detection and Adversarial Methods10.1007/978-981-97-1459-9_2(23-42)Online publication date: 4-Mar-2024
https://doi.org/10.1007/978-981-97-1459-9_2
Niu WZhang XYan RGong JNiu WZhang XYan RGong J(2024)Introduction of Android Malware DetectionAndroid Malware Detection and Adversarial Methods10.1007/978-981-97-1459-9_1(3-19)Online publication date: 4-Mar-2024
https://doi.org/10.1007/978-981-97-1459-9_1
Perfecto R. Ruaya, Jr. (2023)Smart Lock Technology: Developing and Enhancing Home Security using Android-Based Controlled Door Locking App’sInternational Journal of Advanced Research in Science, Communication and Technology10.48175/IJARSCT-12176(538-547)Online publication date: 25-Jul-2023
https://doi.org/10.48175/IJARSCT-12176
Show More Cited By

View Options

Login options

Check if you have access through your login credentials or your institution to get full access on this article.

Full Access

Get this Publication

View options

PDF

View or Download as a PDF file.

PDF

eReader

View online with eReader.

eReader

Abstract

References

Cited By

Index Terms

Recommendations

Enhancing Stealthiness & Efficiency of Android Trojans and Defense Possibilities (EnSEAD) - Android's Malware Attack, Stealthiness and Defense: An Improvement

Android application security: detecting Android malware and evaluating anti-malware software

Effectiveness of Android Obfuscation on Evading Anti-malware

Reviews

Access critical reviews of Computing literature here

Comments

Information

Published In

Sponsors

Publisher

Publication History

Permissions

Check for updates

Author Tags

Qualifiers

Conference

Acceptance Rates

Upcoming Conference

Contributors

Other Metrics

Bibliometrics

Article Metrics

Other Metrics

Citations

Cited By

Login options

Full Access

View options

PDF

eReader

Share

Share this Publication link

Share on social media

Affiliations