# Malware Analysis in IoT & Android Systems with Defensive Mechanism
## 4 Android System Architecture and Attacks
### Kernel-Based Attack  
Android is implemented over the kernel, and the Linux kernel is responsible for every action and the management of different activities. The Linux kernel takes care of Android runtime environment functionalities. The attacker tries to exploit the kernel and related components such as the memory, device driver, and run time environment. Even though Android uses several security measures such as Secure IPC (Inter-Process Communication), Android Sandbox, cryptography, and an encrypted file system, vulnerabilities continue to be exploited, and some recent examples may be broadly classified into (1) an attack that targets the root privilege, (2) a memory target, (3) a boot loader target, and (4) a device driver. A brief attack pattern, description, and solutions are mentioned below. The attacker tries to access the critical section using the keyclt() function of the Linux kernel and exploits the memory leakage, i.e., CVE-2016-0728.This provides unprivileged access to the system. The zero-day vulnerability CVE-2013-6282 known as a Gooligan Attack exists due to an error in put_user/get_user, a kernel API. The attacker performed unauthorized read and write operations in memory using malicious code. This leads to the exploitation, access, and execution of malicious code. This vulnerability was present in Android versions 4 and 5. The second root privilege attack malware for Android devices is DroidKungfu. It uses vulnerabilities identified by CVE-2010-EASY and CVE-2009-1185. The motivation of this malware is to silently root into the mobile device and unlock the file system and functionalities. It exploits the system resources without requesting services from the kernel. This is performed by exploiting a vulnerability present in the root level code \"udev\" by sending a NETLINK udev event ping. The message hint to udev runs into an arbitrary binary as the root. Jump-oriented programming, Return-oriented programming, Return to libc, and ret-2-usr are some examples of such kinds of attacks. These attacks exploit the address space of the code segment and address space of the kernel. A great deal of work was conducted to secure devices against these attacks, including the randomization of the user address space and kernel address space. The bootloader is responsible for scheduling vital tasks at the initialization of the operating system and kernel process. Mobile phone's bootloaders have the special responsibility of initializing the system, maintaining the device's security, and ensuring the integrity of CoT (Chain of Trust). There are several cases and malware that hinder the process of bootloaders from performing their function and also make them vulnerable to attacks. Most of the vulnerabilities are from the insecure design and coding errors categorized as per OWASP Top 10 2021 (Open Web Application Security Project). The malware BOOTSTMP exploits the vulnerabilities CVE-2014-9798 and CVE-2015-8893 that are present in Qualcomm, Huawei, and NVIDIA's bootloader. These vulnerabilities allow attackers to run malicious code, hence imposing memory corruption, buffer overflow, privilege escalation, and denial-of-service attacks on the device. Designing a bootloader while keeping in mind the following issue is very crucial for developers. The vulnerability present in the device driver allows an attacker to breach the driver, cause the device to become unstable, gain access control, and crash devices. During development, the designer's primary focus is on driver functionality, not security. When a new or updated driver appears, these are made available in the market by the developer, distributor, or using reverse engineering, and an attacker finds security gaps available in that driver. The researcher of Zlab discussed two vulnerabilities, CVE-2016-2411 and CVE-2016-2435, which were present in the MSM thermal driver, and the NVIDIA video driver affects Android version 6.0 in Nexus devices. The implementation flaw and vulnerabilities were present in both the kernel and external driver.