QUIRE: Lightweight Provenance for Smart Phone Operating Systems

By Michael Dietz, Shashi Shekhar, Yuliy Pisetsky, Anhei Shu, D. Wallach. USENIX Security Symposium, 2011

394 citations recorded by the source corpus.

Smartphone apps are often granted to privilege to run with access to the network and sensitive local resources. This makes it difficult for remote endpoints to place any trust in the provenance of network connections originating from a user's device. Even on the phone, different apps with distinct privilege sets can communicate with one another. This can allow one app to trick another into improperly exercising its privileges (resulting in a confused deputy attack). In Quire, we engineered two new security mechanisms into Android to address these issues. First, Quire tracks the call chain of on-device IPCs, allowing an app the choice of operating with the reduced privileges of its callers or exercising its full privilege set by acting explicitly on its own behalf. Second, a lightweight signature scheme allows any app to create a signed statement that can be verified by any app on the same phone. Both of these mechanisms are reflected in network RPCs. This allows remote systems visibility into the state of the phone when the RPC was made. We demonstrate the usefulness of Quire with two example applications: an advertising service that runs advertisements separately from their hosting applications, and a remote payment system. We show that Quire's performance overhead is minimal.

Subfields: Artificial Intelligence, Computer Networks and Communications, Signal Processing

View Paper: https://www.semanticscholar.org/paper/90d1799b35b3f42faa336799c2553f62b66a01a3

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Computer Networks and Communications

In Signal Processing

Citations in the corpus

Vetting undesirable behaviors in android apps with permission use analysis (2013, background): “Permission re-delegation attack in Android was ﬁrst introduced in [23,31].”
Security Enhanced (SE) Android: Bringing Flexible MAC to Android (2013, background): “Most of these extensions, including Kirin [14], SAINT [39], TaintDroid [13], Porscha [38], AppFence [18], IPC Inspection [15], and QUIRE [10] only attempt to address access control at the Android middleware layer and provide no solution for the underlying weaknesses of the Linux DAC mechanism.”
Permission Re-Delegation: Attacks and Defenses (2011, background): “Dietz et al. built Quire [10], an extension to the Android IPC mechanisms that helps developers avoid permission re-delegation attacks.”
FM 99.9, Radio Virus: Exploiting FM Radio Broadcasts for Malware Deployment (2013, background): “Some solutions to address this problem have been proposed [24], [39], however they are not backward compatible with most existing applications.”
Dissecting Android Malware: Characterization and Evolution (2012, background): “Accordingly, researches have proposed several possible solutions [37] [40] [41] to this issue.”
CHEX: statically vetting Android apps for component hijacking vulnerabilities (2012, methodology): “Next, we present a concrete example to illustrate component hi-jacking vulnerabilities, as well as typical challenges associated with performing data-ﬂow analysis on Android apps.”
The Evolution of Android Malware and Android Analysis Techniques (2017, background): “…or clustering frameworks [Zhang et al. 2014; Schmidt et al. 2009a; Zhou and Jiang 2012b; Grace et al. 2012; Rasthofer et al. 2014], policy frameworks [Ongtang et al. 2009; Distefano et al. 2010; Dietz et al. 2011; Xu et al. 2012; Davis et al. 2012; Backes et al. 2013], and malware detectors.”
Aurasium: Practical Policy Enforcement for Android Applications (2012, background): “The second consists of modifying the Android OS to insert monitoring modules at key interfaces to allow the interception of malicious activity as it occurs on the device [19, 27, 17, 33, 13].”
TaintDroid (2010, background): “2011] and Quire [Dietz et al. 2011] track Android intent messages through a chain of applications to prevent privilege escalation attacks.”
Systematic Detection of Capability Leaks in Stock Android Smartphones (2012, background): “Other researchers also warn of similar attacks in Android [10, 12, 29].”
Unsafe exposure analysis of mobile in-app advertisements (2012, background): “Note that there are some ongoing research projects that aim to detect or mitigate these attacks [9, 10, 11, 18].”
Effective inter-component communication mapping in Android with Epicc: an essential step towards holistic security analysis (2013, background): “Alternative approaches dynamically prevent some classes of privilege escalation attack through ICC [4, 9].”
Hey, You, Get Off of My Market: Detecting Malicious Apps in Official and Alternative Android Markets (2012, background): “Quire [32] addresses the confused deputy attacks in Android by proposing a set of extensions.”
Towards Taming Privilege-Escalation Attacks on Android (2012, methodology): “In contrast to QUIRE, we opted for a system-centric call-chain.”
Detecting repackaged smartphone applications in third-party android marketplaces (2012, background): “Quire [11] similarly addresses the permission delegation problem by proposing an IPC call chain tracking mechanism to identify the provenance of these IPC requests and enforce certain policy.”
XManDroid: A New Android Evolution to Mitigate Privilege Escalation Attacks (2011, methodology): “QUIRE [9] is a recent Android security extension.”
RiskRanker: scalable and accurate zero-day android malware detection (2012, methodology): “To deal with this problem, QUIRE [36] and Felt et al.”