As the mobile computing technology advances, the Linux- based Android operating system specially designed for touch screen mobile devices are becoming more and more popular. International Data Corporation believes that Android will maintain its overall leadership position in mobile device market throughout 2016, but competition among BlackBerry, iOS, and Windows Phone will shift position each year. Secure and reliable Android operating system is critical for its success.
A central principle of the Android security architecture is that no application, by default, has permission to perform any operation that would adversely impact other applications, the operating system, or the user]. To meet this principle, Android sandboxes each application by combining Virtual Machines together with the Linux access control.
These two mechanisms are well studied to achieve a high level of security. Basically, each application is considered as an individual Linux user. However, the Linux kernel that Android built upon may still hide unchecked vulnerabilities. Such kernel level vulnerabilities could be fatal.
Most recently Android Honeycomb operating system is widely used for tablet devices, such as Samsung Galaxy Tab. The Android system programs are usually ef?cient and secure in memory management. However, there has been a few security issues reported that show Android’s insuf?cient protection to the kernel.
In this work, we reveal a new security pitfall in memory management that can cause severe errors and even system failures. Existing security software for android do not detect this pitfall, due to the private implementation of Android kernel. We then discuss two vulnerabilities introduced by this pitfall:
1) malicious programs can escalate the root-level privilege of a process, through which it can disable the security software, implant malicious codes and install rootkits in the kernel; 2) denial of service attacks can be launched.
Experiments have been conducted to verify these two vulnerabilities on Samsung Galaxy Tab 10.1 with Tegra 2 CPU. We have also implement two countermeasures in our Samsung Galaxy tablet 10.1.
In particular, for the Android Honeycomb 3.1.1 version, we built one patched version that includes two patches, by recompiling Android from scratch. Our tests show that both patches are effective and prevent the exploit codes, thereby fixing the two vulnerabilities.
To protect systems from these vulnerabilities, we proposed a patching solution, which has been adopted by Google.
To read this external content in full, download the complete paper from the author archives online at Temple University.