정보과학회 논문지 (Journal of KIISE)

  • 제43권11호
  • /
  • Pages.1179-1187
  • /
  • 2016
  • /
  • 2383-630X(pISSN)
  • /
  • 2383-6296(eISSN)
한국정보과학회 (Korean Institute of Information Scientists and Engineers)
권호 표지
DOI QR코드

DOI QR Code

안드로이드 장치 드라이버에 대한 효과적 취약점 탐지 기법

An Effective Technique for Detecting Vulnerabilities in Android Device Drivers

  • 투고 : 2016.07.11
  • 심사 : 2016.08.18
  • 발행 : 2016.11.15
⟨ 이전 논문 다음 논문 ⟩

초록

안드로이드 및 리눅스 기반 임베디드 시스템에서는 디바이스 드라이버가 커널 함수로 포함되는 구조로 되어 있다. 어떤 디바이스 드라이버들의 경우, 여러 Third-party에 의해 제공되는 소프트웨어(펌웨어)가 포함되는데, 그 보안 수준에 대해 검토되지 않고 사용되는 경우가 많다. 보안 취약점 분석을 위해 일반적으로 사용되는 정적 분석의 경우, 오탐 가능성으로 인하여 실제 권한상승과 같은 주요 취약점을 확인하는데 많은 비용이 발생한다. 본 논문에서는 안드로이드 시스템에서 사용되는 디바이스 드라이버를 대상으로 정적 및 동적 분석 기반의 효과적인 보안 취약점 탐지 기법을 제시하고 그 효용성을 확인한다.

Android- and Linux-based embedded systems require device drivers, which are structured and built in kernel functions. However, device driver software (firmware) provided by various 3rd parties is not usually checked in terms of their security requirements but is simply included in the final products, that is, Android-based smart phones. In addition, static analysis, which is generally used to detect vulnerabilities, may result in extra cost to detect critical security issues such as privilege escalation due to its large proportion of false positive results. In this paper, we propose and evaluate an effective technique to detect vulnerabilities in Android device drivers using both static and dynamic analyses.

키워드

참고문헌

  1. Common Vulnerabilities and Exposures (CVE) for Android. [Online]. Available: https://cve.mitre.org/cgibin/cvekey.cgi?keyword=Android
  2. SEI CERT secure coding standards. [Online]. Available: https://www.securecoding.cert.org
  3. ETSI standards. [Online]. Available: http://www.etsi.org
  4. L. Wu, "Vulnerability Detection and Mitigation in Commodity Android Devices," Ph.D. dissertation, Dept. of Computer Science, North Carolina State University, 2015.
  5. J. H. Bang, "Development Trend for Open Source Code Security Weakness Analysis Tools," Internet & Security Focus, May 2014. (in Korean)
  6. W.T. Sim, J. Kim, J. Ryou, and B. Noh, "Android Application Analysis Method for Malicious Activity Detection," Journal of the Korean Institute of Information Security and Cryptology, Vol. 21, No. 1, pp. 213-219, Feb. 2011. (in Korean)
  7. L. Batyuk, M. Herpich, S.A. Camtepe, K. Raddatz, A. Schmidt, S. Albayrak, "Using Static Analysis for Automatic Assessment and Mitigation of Unwanted and Malicious Activities within Android Applications," 2011 6th International Conference on Malicious and Unwanted Software, pp. 66-72, 2011.
  8. H. Cho, D. Weon, and J. Kim, "A Study on the Security Vulnerability of Android," Asia-pacific Journal of Multimedia Services Convergent with Art, Humanities, and Sociology, Vol. 5, No. 6, pp. 1-8, Dec. 2015. (in Korean) https://doi.org/10.14257/AJMAHS.2015.06.05
  9. Y. Choi, and E.M. Choi, "Analysing Weak Point of Android Applications Using Static Analysis based on Anti-patterns," KIISE Transactions on Computing Practices, Vol. 18, No. 4, pp. 316-320, Apr. 2012. (in Korean)
  10. M. Sutton, A. Greene, and P. Amini, Fuzzing: Brute Force Vulnerability Discovery, Addison-Wesley, 2007.
  11. B. Cui, Y. Ni, Y. Fu, "ADDFuzzer: A New Fuzzing Framework of Android Device Drivers," The 10th International Conference on Broadband and Wireless Computing, Communication and Applications (BWCCA), pp. 88-91, Nov. 2015.
  12. L.K. Yan, H. Yin, "DroidScope: Seamlessly Reconstruction the OS and Dalvik Semantic Views for Dynamic Android Malware Analysis," Proc. of the 21st USENIX Security Symposium, pp. 569-584, Aug. 2012.
  13. C. Wright, C. Cowan, S. Smalley, J. Morris, G. Kroah-Hartman, "Linux Security Modules: General Security Support for the Linux Kernel," USENIX Security Symposium, Vol. 2, pp. 1-14, 2002.
  14. S. Bugiel, S. Heuser, A. Sadeghi, "Flexible and Fine-grained Mandatory Access Control on Android for Diverse Security and Privacy Policies," Proc. of the 22nd USENIX Security Symposium, pp. 131-146, Aug. 2013.
  15. Common Weakness Enumeration (CWE). [Online]. Available: https://cwe.mitre.org/
  16. Y. Younan, "25 Years of Vulnerabilities: 1988-2012," Research Report, Sourcefire Vulnerability Research Team (VRT). [Online]. Available: https://courses.cs.washington.edu/courses/cse484/14au/reading/25-years-vulnerabilities.pdf
  17. IBM AppScan. [Online]. Available: http://www-03.ibm.com/software/products/en/appscan
  18. Explorer. [Online]. Available: http://mogua.us
  19. NIST, Source Code Security Analyzer. [Online]. Available: https://samate.nist.gov/index.php/Source_Code_Security_Analyzers.html