05-02-2013, 01:01 PM
Android Security What is out there?
[attachment=49680]
Android App Market Security Model
No formal application screening process.
Any developer can upload an application.
Android Market relies on community to identify and flag:
Malfunctioning applications
Malicious applications
Inherently, early adopters suffer if the application is malicious.
Note: Unlike iPhone, Android application can be directly downloaded and installed from a third party as well.
Phishing App Example
Bank Phishing application:
Advertised to do banking activities from phone.
User to give account information and credentials for the app to facilitate banking activities.
In reality the app did only the following:
Open the banking website in phone’s browser. That’s it!!
A number of users were scammed before the application was taken out from Android Market.
Android Market Statistics
About 20% of 48,000 apps in Android Marketplace allow a third-party application access to sensitive or private information.
5% apps can place calls to any number without user interaction.
2% apps can send text messages without user interaction.
29 apps require the exact same permissions as applications that are known to be spyware.
383 apps have the ability to read and use the authentication credentials from another app or service.
Rooting Android
Rooting Android: Gaining root access to Android operating system.
It can be deemed as similar to iPhone jailbreaking.
Why root Android?
To gain full control over the system.
Modify system files: themes, core apps, boot images, linux binaries, etc.
Run applications that require system level access
[attachment=49680]
Android App Market Security Model
No formal application screening process.
Any developer can upload an application.
Android Market relies on community to identify and flag:
Malfunctioning applications
Malicious applications
Inherently, early adopters suffer if the application is malicious.
Note: Unlike iPhone, Android application can be directly downloaded and installed from a third party as well.
Phishing App Example
Bank Phishing application:
Advertised to do banking activities from phone.
User to give account information and credentials for the app to facilitate banking activities.
In reality the app did only the following:
Open the banking website in phone’s browser. That’s it!!
A number of users were scammed before the application was taken out from Android Market.
Android Market Statistics
About 20% of 48,000 apps in Android Marketplace allow a third-party application access to sensitive or private information.
5% apps can place calls to any number without user interaction.
2% apps can send text messages without user interaction.
29 apps require the exact same permissions as applications that are known to be spyware.
383 apps have the ability to read and use the authentication credentials from another app or service.
Rooting Android
Rooting Android: Gaining root access to Android operating system.
It can be deemed as similar to iPhone jailbreaking.
Why root Android?
To gain full control over the system.
Modify system files: themes, core apps, boot images, linux binaries, etc.
Run applications that require system level access