NDLI: SPOKE: Scalable Knowledge Collection and Attack Surface Analysis of Access Control Policy for Security Enhanced Android

Please wait, while we are loading the content...

Hardware Trojans and Other Threats against Embedded Systems

Detecting Privileged Side-Channel Attacks in Shielded Execution with Déjà Vu

To Update or Not to Update: Insights From a Two-Year Study of Android App Evolution

Lightweight Swarm Attestation: A Tale of Two LISA-s

Strict Virtual Call Integrity Checking for C++ Binaries

Functional Encryption with Oblivious Helper

DoS Attacks on Your Memory in Cloud

VTBPEKE: Verifier-based Two-Basis Password Exponential Key Exchange

Pinpointing Vulnerabilities

Understanding Human-Chosen PINs: Characteristics, Distribution and Security

Proofs of Data Residency: Checking whether Your Cloud Files Have Been Relocated

Scaling and Effectiveness of Email Masquerade Attacks: Exploiting Natural Language Generation

Secure Wallet-Assisted Offline Bitcoin Payments with Double-Spender Revocation

The Role of Hosting Providers in Fighting Command and Control Infrastructure of Financial Malware

SPOKE: Scalable Knowledge Collection and Attack Surface Analysis of Access Control Policy for Security Enhanced Android

Secure Integration of Web Content and Applications on Commodity Mobile Operating Systems

Securing Memory Encryption and Authentication Against Side-Channel Attacks Using Unprotected Primitives

DRIVE: Dynamic Runtime Integrity Verification and Evaluation

Group Signatures with Time-bound Keys Revisited: A New Model and an Efficient Construction

SECRET: On the Feasibility of a Secure, Efficient, and Collaborative Real-Time Web Editor

BRIDEMAID: An Hybrid Tool for Accurate Detection of Android Malware

POSTER: Enabling End-Users to Protect their Privacy

Advanced Security Research in the Era of the Internet of Things

SGX-Log: Securing System Logs With SGX

Toward Detecting Collusive Ranking Manipulation Attackers in Mobile App Markets

Model-based Attack Detection Scheme for Smart Water Distribution Networks

BinSequence: Fast, Accurate and Scalable Binary Code Reuse Detection

Mis-operation Resistant Searchable Homomorphic Encryption

Side Channels in Deduplication: Trade-offs between Leakage and Efficiency

Boosting the Guessing Attack Performance on Android Lock Patterns with Smudge Attacks

Extracting Conditional Formulas for Cross-Platform Bug Search

Evaluating Behavioral Biometrics for Continuous Authentication: Challenges and Metrics

EncKV: An Encrypted Key-value Store with Rich Queries

On the Detection of Kernel-Level Rootkits Using Hardware Performance Counters

Privacy-preserving and Optimal Interval Release for Disease Susceptibility

Automatically Inferring Malware Signatures for Anti-Virus Assisted Attacks

Android Database Attacks Revisited

DroidForensics: Accurate Reconstruction of Android Attacks via Multi-layer Forensic Logging

Don't Skype & Type!: Acoustic Eavesdropping in Voice-Over-IP

An Attack Against Message Authentication in the ERTMS Train to Trackside Communication Protocols

Almost Universal Forgery Attacks on the COPA and Marble Authenticated Encryption Algorithms

WedgeTail: An Intrusion Prevention System for the Data Plane of Software Defined Networks

How Discover a Malware using Model Checking

POSTER: Detecting Inter-App Information Leakage Paths

CoverUp: Privacy Through "Forced" Participation in Anonymous Communication Networks

The Circle Game: Scalable Private Membership Test Using Trusted Hardware

Collusive Data Leak and More: Large-scale Threat Analysis of Inter-app Communications

Towards Formal Security Analysis of Industrial Control Systems

PrivWatcher: Non-bypassable Monitoring and Protection of Process Credentials from Memory Corruption Attacks

A Ciphertext-Policy Attribute-based Encryption Scheme With Optimized Ciphertext Size And Fast Decryption

Sharing Proofs of Retrievability across Tenants

What You See is Not What You Get: Leakage-Resilient Password Entry Schemes for Smart Glasses

Discovering Logical Vulnerabilities in the Wi-Fi Handshake Using Model-Based Testing

Pass-O: A Proposal to Improve the Security of Pattern Unlock Scheme

MoPS: A Modular Protection Scheme for Long-Term Storage

Gossip: Automatically Identifying Malicious Domains from Mailing List Discussions

Towards Extending Noiseless Privacy: Dependent Data and More Practical Approach

PayBreak: Defense Against Cryptographic Ransomware

TriFlow: Triaging Android Applications using Speculative Information Flows

DroidPill: Pwn Your Daily-Use Apps

Hit by the Bus: QoS Degradation Attack on Android

Using Program Analysis to Synthesize Sensor Spoofing Attacks

A Terrorist-fraud Resistant and Extractor-free Anonymous Distance-bounding Protocol

The Case for In-Network Replay Suppression

POSTER: Detection of Information Leaks via Reflection in Android Apps

Control-Flow Hijacking: Are We Making Progress?

Memory Safety for Embedded Devices with nesCheck

Breaking Ad-hoc Runtime Integrity Protection Mechanisms in Android Financial Apps

On the Robustness of RSA-OAEP Encryption and RSA-PSS Signatures Against (Malicious) Randomness Failures

Cache-Based Application Detection in the Cloud Using Machine Learning

Updatable Block-Level Message-Locked Encryption

Practical Black-Box Attacks against Machine Learning

BlindIDS: Market-Compliant and Privacy-Friendly Intrusion Detection System over Encrypted Traffic

SCM: Secure Code Memory Architecture

Heterogeneous Rainbow Table Widths Provide Faster Cryptanalyses

Taming Asymmetric Network Delays for Clock Synchronization Using Power Grid Voltage

POSTER: Localization of Spoofing Devices using a Large-scale Air Traffic Surveillance System

Security in Personal Genomics: Lest We Forget

DataShield: Configurable Data Confidentiality and Integrity

LINCOS: A Storage System Providing Long-Term Integrity, Authenticity, and Confidentiality

An Efficient KP-ABE with Short Ciphertexts in Prime OrderGroups under Standard Assumption

Accurate Manipulation of Delay-based Internet Geolocation

POSTER: Traffic Analysis Attacks in Anonymity Networks

The Case for System Command Encryption

POSTER: Quantitative Security Assessment Method based on Entropy for Moving Target Defense

POSTER: A Behavioral Biometric Authentication Framework on Smartphones

POSTER: A Secure, Practical & Safe Packet Spoofing Service

SPOKE: Scalable Knowledge Collection and Attack Surface Analysis of Access Control Policy for Security Enhanced Android

Content Provider	ACM Digital Library
Author	Chen, Xun Li, Ninghui Wang, Ruowen Enck, William Shen, Wenbo Ning, Peng Cheng, Yueqiang Azab, Ahmed M.
Abstract	SEAndroid is a mandatory access control (MAC) framework that can confine faulty applications on Android. Nevertheless, the effectiveness of SEAndroid enforcement depends on the employed policy. The growing complexity of Android makes it difficult for policy engineers to have complete domain knowledge on every system functionality. As a result, policy engineers sometimes craft over-permissive and ineffective policy rules, which unfortunately increased the attack surface of the Android system and have allowed multiple real-world privilege escalation attacks. We propose SPOKE, an SEAndroid Policy Knowledge Engine, that systematically extracts domain knowledge from rich-semantic functional tests and further uses the knowledge for characterizing the attack surface of SEAndroid policy rules. Our attack surface analysis is achieved by two steps: 1) It reveals policy rules that cannot be justified by the collected domain knowledge. 2) It identifies potentially over-permissive access patterns allowed by those unjustified rules as the attack surface. We evaluate SPOKE using 665 functional tests targeting 28 different categories of functionalities developed by Samsung Android Team. SPOKE successfully collected 12,491 access patterns for the 28 categories as domain knowledge, and used the knowledge to reveal 320 unjustified policy rules and 210 over-permissive access patterns defined by those rules, including one related to the notorious libstagefright vulnerability. These findings have been confirmed by policy engineers.
Starting Page	612
Ending Page	624
Page Count	13
File Format	PDF
ISBN	9781450349444
DOI	10.1145/3052973.3052991
Language	English
Publisher	Association for Computing Machinery (ACM)
Publisher Date	2017-04-02
Publisher Place	New York
Access Restriction	Subscribed
Subject Keyword	Seandroid Selinux Mandatory access control Android
Content Type	Text
Resource Type	Article

Central Library (ISO-9001:2015 Certified)
Indian Institute of Technology Kharagpur
Kharagpur, West Bengal, India | PIN - 721302

See location in the Map
03222 282435
Mail: support@ndl.gov.in

Sl.	Authority	Responsibilities	Communication Details
1	Ministry of Education (GoI), Department of Higher Education	Sanctioning Authority	https://www.education.gov.in/ict-initiatives
2	Indian Institute of Technology Kharagpur	Host Institute of the Project: The host institute of the project is responsible for providing infrastructure support and hosting the project	https://www.iitkgp.ac.in
3	National Digital Library of India Office, Indian Institute of Technology Kharagpur	The administrative and infrastructural headquarters of the project	Dr. B. Sutradhar bsutra@ndl.gov.in
4	Project PI / Joint PI	Principal Investigator and Joint Principal Investigators of the project	Dr. B. Sutradhar bsutra@ndl.gov.in Prof. Saswat Chakrabarti will be added soon
5	Website/Portal (Helpdesk)	Queries regarding NDLI and its services	support@ndl.gov.in
6	Contents and Copyright Issues	Queries related to content curation and copyright issues	content@ndl.gov.in
7	National Digital Library of India Club (NDLI Club)	Queries related to NDLI Club formation, support, user awareness program, seminar/symposium, collaboration, social media, promotion, and outreach	clubsupport@ndl.gov.in
8	Digital Preservation Centre (DPC)	Assistance with digitizing and archiving copyright-free printed books	dpc@ndl.gov.in
9	IDR Setup or Support	Queries related to establishment and support of Institutional Digital Repository (IDR) and IDR workshops	idr@ndl.gov.in