Automatically Securing Permission-Based Software by Reducing the Attack Surface: An Application to Android
Résumé
In the permission-based security model (used e.g. in An-droid and Blackberry), applications can be granted more permissions than they actually need, what we call a "per-mission gap". Malware can leverage the unused permissions for achieving their malicious goals, for instance using code injection. In this paper, we present an approach to detecting permission gaps using static analysis. Using our tool on a dataset of Android applications, we found out that a non negligible part of applications suffers from permission gaps, i.e. does not use all the permissions they declare.
Domaines
Génie logiciel [cs.SE]Origine | Fichiers éditeurs autorisés sur une archive ouverte |
---|
Loading...