Permission Re-Delegation: Attacks and Defenses

By Adrienne Porter Felt, Helen J. Wang, Alexander Moshchuk, Steve Hanna, Erika Chin. USENIX Security Symposium, 2011

576 citations recorded by the source corpus.

View Paper: https://www.semanticscholar.org/paper/451f72230e607cb59d60f996299c578623a19294

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

Citations in the corpus

Hey, You, Get Off of My Market: Detecting Malicious Apps in Official and Alternative Android Markets (2012, background): “Comdroid [31] and the subsequent work [39] analyze the vulnerability in inter-app communication in Android apps and find a number of exploitable vulnerabilities.”
PScout: analyzing the Android permission specification (2012, background): “There is a large body of security research on permissionbased systems [15,16] and in Android security [6,7,8,11,12, 13, 18].”
Unsafe exposure analysis of mobile in-app advertisements (2012, methodology): “, collusion [26], re-delegation [18, 20], or indirect channels [31]) that could avoid using dangerous Android APIs being modeled by AdRisk while still accessing various personal information on the”
QUIRE: Lightweight Provenance for Smart Phone Operating Systems (2011, background): “We similarly do not need to poly-instantiate services to ensure that each instance only handles a single security label as in systems like DStar/HiStar [39] or IPC Inspection [15].”
Vetting undesirable behaviors in android apps with permission use analysis (2013, background): “Permission re-delegation attack in Android was ﬁrst introduced in [23,31].”
Effective inter-component communication mapping in Android with Epicc: an essential step towards holistic security analysis (2013, background): “Past analyses of Android applications [12] [14] [15] [17] [19] [36] have largely focused on analyzing application components in isolation.”
You Get Where You're Looking for: The Impact of Information Sources on Code Security (2016, background): “The participants were assigned to one of four conditions: free choice of resources, Stack Overflow only, official Android documentation only, or books only.”
Towards Taming Privilege-Escalation Attacks on Android (2012, methodology): “Internet sockets ICC File system [35] System components [35] Addressed by previous research (Quire, IPC Inspection) Figure 2.”
XManDroid: A New Android Evolution to Mitigate Privilege Escalation Attacks (2011, background): “IPC Inspection [17] is a very recent work that similarly to QUIRE addresses confused deputy attacks.”
Systematic Detection of Capability Leaks in Stock Android Smartphones (2012, background): “Felt et al. [19] propose the notion of permission re-delegation in the generalized contexts applicable for both web and smartphone apps.”
Expectation and purpose: understanding users' mental models of mobile app privacy through crowdsourcing (2012, background): “For example, Facebook and Path, were found uploading users’ contact lists to their servers, which greatly surprised their users and made them feel very uncomfortable [21, 34].”
RiskRanker: scalable and accurate zero-day android malware detection (2012, background): “[42] offer extensions to the Android IPC model that allow the ultimate implementor of a privileged feature to check the IPC call chain to ensure unprivileged apps can not launch confused-deputy attacks unnoticed.”
Modeling Users' Mobile App Privacy Preferences: Restoring Usability in a Sea of Permission Settings (2014, background): “A great deal of past work analyzing smartphone apps has focused on developing useful techniques and tools to detect and manage leakage of sensitive personal information [8-10, 14-26] or studying how users react to these usages [6, 13, 27, 28].”
CHEX: statically vetting Android apps for component hijacking vulnerabilities (2012, background): “Recent works [11, 20, 21, 27] reported attacks similar to this particular example, all of which derive from the classic confused deputy attack [23] and aim at escalating privileges of attacking apps in the context of Android’s permission system.”
A visual analytics approach to understanding cycling behaviour (2012, unknown): “…timescale proposed by Nicholls and Ranger [2] can be used as a convenient non-dimensionalisation parameter for understanding the temporal development of the process: It is generally considered [1] that when the Oh number is less than 0.1 the droplet breakup is mostly influenced by the We number.”
Security Enhanced (SE) Android: Bringing Flexible MAC to Android (2013, background): “Most of these extensions, including Kirin [14], SAINT [39], TaintDroid [13], Porscha [38], AppFence [18], IPC Inspection [15], and QUIRE [10] only attempt to address access control at the Android middleware layer and provide no solution for the underlying weaknesses of the Linux DAC mechanism.”
Dissecting Android Malware: Characterization and Evolution (2012, background): “Accordingly, researches have proposed several possible solutions [37] [40] [41] to this issue.”