Uraniborg’s Device Preloaded App Risks Scoring Metrics

The security of Android devices depends on a wide range of factors. In this paper we focus on quantifying the risks associated with one important factor: the security and privacy posture of preloaded apps. Such applications deserve particular attention since they are installed by the manufacturer on all devices of a particular make and model, individual apps may have elevated privileges beyond those available to apps installed via the Google Play Store, and typically cannot be removed by the user. In order to measure the risk presented by preloaded apps in a quantifiable way, we adopt a numerical approach and derive a single overall score for a given handset and therefore support the relative comparison of risks posed by different handsets. Due to the difficulty in computing the security and privacy risk, we approximate the actual risk by estimating the attack surface presented by this layer of software. We therefore present an extensible mathematical software framework that allows us to define, compute, and analyze various aspects of security and privacy risks of preloaded Android apps in a systematic manner. This work fits into a larger effort called Uraniborg [12]. Uraniborg is designed to be an open-access observatory or database of preloaded app metadata that is envisioned to cover all Android devices in the ecosystem, for the benefit of end users. An instance of Uraniborg is hosted on the Android Device Security Database website [8]. Specifically, this work attempts to quantitatively measure the change in the risk introduced by preloaded apps on a given Android device by comparing it against a baseline risk measurement: Uraniborg’s Device Preloaded App Risk (DPAR). It specifically does not consider the exact utility or features provided by the app. We assume that a perfect baseline implementation exists, where security risks have been considered and tailored to produce a minimally functional Android device. While we acknowledge that a number of apps are preloaded in order to provide additional value and features, every line of additional code comes with an inherent security risk due to the potential bugs that can turn into security vulnerabilities or be abused by developers themselves. In other words, configuration and installation of every app on a device contributes to overall device security. Thus, it is important to note that the scores produced do not provide an absolute mandate of what is good or bad, but instead provide a quantitative comparison relative to a minimalistic build and measure the additional risk introduced by the manufacturer through the introduction of preloaded apps on a specific device. While we consider the likelihood and damage potential of security risk, we currently do not consider the cost of such risk. This is mainly because the cost is usually associated with the attempt to measure the difficulty of launching a certain attack. Based on the information that we are working on (metadata of packages and other device configurations but explicitly without a model of potential adversaries), we are not able to factor the cost into consideration for this framework. Instead, we assume equal cost for all preloaded apps.