Android leverages a set of system permissions to protect platform resources. At the same time, it allows untrusted third-party applications to declare their own custom permissions to regulate access to app components. However, Android treats custom permissions the same way as system permissions even though they are declared by entities of different trust levels. In this work, we describe two new classes of vulnerabilities that arise from the ‘predicament’ created by mixing system and custom permissions in Android. These have been acknowledged as serious security ﬂaws by Google and we demonstrate how they can be exploited in practice to gain unauthorized access to platform resources and to compromise popular Android apps. To address the shortcomings of the system, we propose a new modular design called Cusper for the Android permission model. Cusper separates the management of system and custom permissions and introduces a backward-compatible naming convention for custom permissions to prevent custom permission spooﬁng. We validate the correctness of Cusper by 1) introducing the ﬁrst formal model of Android runtime permissions, 2) extending it to describe Cusper, and 3) formally showing that key security properties that can be violated in the current permission model are always satisﬁed in Cusper. To demonstrate Cusper’s practicality, we implemented it in the Android platform and showed that it is both effective and efﬁcient.
Distinguished Paper Award at NDSS ‘18
Finalist at the Cybersecurity Awareness Worldwide (CSAW) applied research competition