Consiglio Nazionale delle Ricerche

Tipo di prodottoArticolo in rivista
TitoloBreaking and fixing the Android Launching Flow
Anno di pubblicazione2013
  • Elettronico
  • Cartaceo
Autore/iArmando A.; Merlo A.; Migliardi M.; Verderame L.
Affiliazioni autoriDIBRIS, Università Degli Studi di Genova, Via all'Opera Pia, 13, 16145 Genova, Italy; Security and Trust Unit, FBK-irst, Trento, Italy; Università E-Campus, Italy; DEI, University of Padova, Italy
Autori CNR e affiliazioni
  • inglese
AbstractThe security model of the Android OS is based on the effective combination of a number of well-known security mechanisms (e.g. statically defined permissions for applications, the isolation offered by the Dalvik Virtual Machine, and the well-known Linux discretionary access control model). Although each security mechanism has been extensively tested and proved to be effective in isolation, their combination may suffer from unexpected security flaws. We show that this is actually the case by presenting a severe vulnerability in Android related to the application launching flow. This vulnerability is based on a security flaw affecting a kernel-level socket (namely, the Zygote socket). We also present an exploit of the vulnerability that allows a malicious application to mount a severe Denial-of-Service attack that makes the Android devices become totally unresponsive. Besides explaining the vulnerability (which affects all versions of Android up to version 4.0.3) we propose two fixes. One of the two fixes has been adopted in the official release of Android, starting with version 4.1. We empirically assess the impact of the vulnerability as well as the efficacy of the countermeasures on the end user. We conclude by extending our security analysis to the whole set of sockets, showing that other sockets do not suffer from the same vulnerability as the Zygote one. © 2013 Elsevier Ltd. All rights reserved.
Lingua abstractinglese
Altro abstract-
Lingua altro abstract-
Pagine da104
Pagine a115
Pagine totali-
RivistaComputers & security
Attiva dal 1982
Editore: Elsevier Science Publishers - Amsterdam
Paese di pubblicazione: Paesi Bassi
Lingua: inglese
ISSN: 0167-4048
Titolo chiave: Computers & security
Titolo proprio: Computers & security.
Titolo abbreviato: Comput. secur.
Titolo alternativo: Computers and security
Numero volume della rivista39
Fascicolo della rivistaPARTA
Verificato da referee-
Stato della pubblicazionePublished version
Indicizzazione (in banche dati controllate)
  • Scopus (Codice:2-s2.0-84888289162)
Parole chiaveAndroid OS, Android security, Android security framework, Denial-of-Service, Zygote vulnerability
Link (URL, URI)
Titolo parallelo-
Data di accettazione-
Note/Altre informazioni-
Strutture CNR
  • IEIIT — Istituto di elettronica e di ingegneria dell'informazione e delle telecomunicazioni
Moduli/Attività/Sottoprogetti CNR
  • INT.P01.004.001 : Rilevazione e controllo di anomalie mediante analisi comportamentale
Progetti Europei-