Reference : Automatically Securing Permission-Based Software by Reducing the Attack Surface: An A...

	Document type :	Parts of books : Contribution to collective works
	Discipline(s) :	Engineering, computing & technology : Computer science
	To cite this reference:	http://hdl.handle.net/10993/3888

Title :	Automatically Securing Permission-Based Software by Reducing the Attack Surface: An Application to Android
Language :	English
Author, co-author :	Bartel, Alexandre [University of Luxembourg > Interdisciplinary Centre for Security, Reliability and Trust (SNT) > >]
	Klein, Jacques [University of Luxembourg > Faculty of Science, Technology and Communication (FSTC) > Computer Science and Communications Research Unit (CSC) >]
	Monperrus, Martin [University of Lille, France]
	Le Traon, Yves [University of Luxembourg > Faculty of Science, Technology and Communication (FSTC) > Computer Science and Communications Research Unit (CSC) >]
Publication date :	2011
Main document title :	Automatically Securing Permission-Based Software by Reducing the Attack Surface: An Application to Android (Tech Report)
Publisher :	Tech Report
Pages :	1-11
Peer reviewed :	No
ISBN :	9782879711072
Keywords :	[en] call-graph ; android ; security ; soot ; java ; static analysis
Abstract :	[en] Android based devices are becoming widespread. As a result and since those devices contain personal and confidential data, the security model of the android software stack has been analyzed extensively. One key feature of the security model is that applications must declare a list of permissions they are using to access resources. Using static analysis, we first extracted a table from the Android API which maps methods to permissions. Then, we use this mapping within a tool we developed to check that applications effectively need all the permissions they declare. Using our tool on a set of android applications, we found out that a non negligible part of the applications do not use all the permissions they declare. Consequently, the attack surface of such applications can be reduced by removing the non-needed permissions.
Permalink :	http://hdl.handle.net/10993/3888
Commentary :	Tech Report

	File(s) associated to this reference
	Fulltext file(s): File Commentary Version Size Access Open access AttackSurfaceReduction-tr.pdf No commentary Author postprint 434.65 kB View/Open

All documents in ORBi^lu are protected by a user license.

 

University of Luxembourg Library |  Feedback |  Legal notices Site Map