Penetration Test Report (MITRE): pr 16 0202 android security analysis final report

MTR150440
MITRE TECHNICAL REPORT
Android Security Analysis
Final Report
Sponsor: NSA
Dept. No.: J83H
Contract No.: W56KGU-14-C-0010
Project No.: 0715N6CZ-AA
The views, opinions and/or findings
contained in this report are those of the
MITRE Corporation and should not be
construed as an official government position,
policy, or decision, unless designated by
other documentation.
Approved for public release; distribution Michael Peck
unlimited. 16-0202
Gananand Kini
©2016 The MITRE Corporation. Andrew Pyles
All rights reserved.
March 2016
Approved By
Christine Alicea, Project Leader Date
1
Table of Contents
1 Introduction ............................................................................................................................................4
2 Addressing Android App Vulnerabilities with the Android Lint Checker ............................................5
2.1 App Data-in-Transit Vulnerabilities due to Insecure Certificate Validation or Hostname
Validation ......................................................................................................................................5
2.2 App Data-at-Rest Vulnerabilities due to Insecure File Permissions .............................................7
2.3 Broadcast Receiver Vulnerabilities ...............................................................................................7
2.4 Best Practices for Native Code ......................................................................................................8
2.5 Demonstrating Effectiveness of Lint Checks ................................................................................8
2.5.1 MITRE Secure Code Review Practice ....................................................................................8
2.5.2 F-Droid ....................................................................................................................................9
2.6 Applying Lint Checks without Source Code Access ....................................................................9
3 Enhancing Android OS Platform Security ..........................................................................................11
3.1 Data-in-Transit Vulnerabilities ....................................................................................................11
3.1.1 Certificate Pinning Manifest Attribute ..................................................................................11
3.1.2 Manifest Attributes to Prevent Overriding X509TrustManager and HostnameVerifier ......12
3.2 Data-at-Rest Vulnerabilities due to Insecure File Permissions ...................................................12
3.3 Mitigations for Platform Exploitation Techniques ......................................................................13
3.3.1 Preventing Dynamic Code Execution ...................................................................................13
3.3.1.1 Android WebView .......................................................................................................15
3.3.1.2 ART..............................................................................................................................16
3.3.1.3 Dynamic Bytecode Execution ......................................................................................17
3.3.2 Limiting Privileges of the System Userid .............................................................................17
3.4 KeyChain Improvements .............................................................................................................17
4 Conclusion and Potential Future Work ................................................................................................19
5 References ……………………………………………………………………………………………20
Appendix A Using the New Lint Checks ...............................................................................................25
Appendix B Demonstration Application ................................................................................................27
Appendix C Android Runtime (ART) Additional Discussion ...............................................................28
C.1 ART Background .........................................................................................................................28
C.2 JIT Compilation in ART ..............................................................................................................28
C.2.1 Motivation .............................................................................................................................28
C.2.2 Security Risks .......................................................................................................................29
Appendix D Memory Mapping Examples .............................................................................................30
D.1 Memory Mappings of Chrome App ............................................................................................30
D.2 Memory Mappings of Application Using WebView ..................................................................31
2
List of Figures
Figure 1: Example Lint Output Reporting a Vulnerable HostnameVerifier Implementation ........ 5
Figure 2: Spoofed SMS Intent Example ......................................................................................... 9
Figure 3: Example of a Malicious App Downloading and Executing Exploit Code after
Installation ..................................................................................................................................... 14
Figure 4: Example of Using the KeyChain to Select a Key ......................................................... 18
Figure 5: Memory Mappings of Chrome App .............................................................................. 30
Figure 6: Memory Mappings of Audible App .............................................................................. 31
3
1 Introduction
According to recent worldwide sales figures reported by Gartner [1], Android is the most popular
operating system (OS) when considering all general-purpose computing platforms (smartphones,
tablets, laptops, and PCs). Mobile OSes such as Android introduce new security architectures
designed with the experience of past lessons learned from traditional computing platforms. Most
notably, Android provides a sandbox for applications (hereinafter “apps") which isolates app
data and code execution from other apps [2]. Android places security controls on allowed
interactions between apps, and between each app and underlying device resources. The Android
security architecture is designed to provide protection from malicious app behaviors, and to
increase resilience to prevent or minimize the impact of exploitation of security vulnerabilities.
By default, apps cannot access data stored by another app, and are restricted from interfering
with the behavior of another app. Apps must request permission to access device capabilities
such as the microphone, camera, or physical location services, such as Global Positioning
System (GPS). Apps also must request permission to access sensitive information repositories
such as contact lists. Apps are also limited in their ability to access other underlying device
resources and services. Every app must include a manifest file (AndroidManifest.xml) that
defines the app’s permissions and other important properties. The contents of the manifest file
are read and enforced by the Android OS.
Nevertheless, opportunities for exploiting app security vulnerabilities exist. Several types of
vulnerabilities are commonly found in Android apps. These vulnerabilities, when present, can be
exploited by resident malicious apps or by network-based attackers. Additionally, malicious apps
may attempt to exploit Android platform vulnerabilities as a means of bypassing Android’s
sandbox protections. This report describes the results of our research efforts to mitigate these
issues by:
• Developing static