Grab 'n Run

Ofek Wittenberg

Introduction

• The Android Market is huge
• This promotes competition
• Which leads to the use of DCL (Dynamic Code Loading)

What is DCL?

• Similar to shared libraries.
• Allows applications to load code that is not part of the initial code base.
• Library is loaded at runtime.

Why use DCL?

• Promote code reuse
• Self upgrade functionality
• Boost performance
• Extensibility

The drawbacks of DCL?

• Hard to make secure
  • Can lead to code injection attacks (Man in the middle attacks)
• Evades static and dynamic analysis systems (Google Bouncer)
• 16% of the top 50 apps are affected

How is DCL Exploited?

• Code Retrieval
  • Vulnerabilities: Plain text
• Code Storage - needed due to framework restrictions
  • Vulnerabilities: Vulnerable storage location such as in a world writable location - Enable malicious code to obtain rights of host app
• ​Code Loading & Verification - Initialize the Android Framework responsible for handling the loading operation
  • ​Vulnerabilities  - Ensuring end to end code integrity.

Threat Model

The scope this solution aims to meet?

• Device - Execute malicious code
• Network Communication - Exploitation of unencrypted connections (MITM).
• Remote Server(s) - attacker cannot compromise a remote server

Grab n Run Goals

• Create a new library for DCL
• The library must be practical
• Make this library usable also when DCL functionality are implemented within third-party libraries.

Code Verification Protocol

Repackaging Tool

1. Unpacking
   
   
2.  Manifest Update
   
   
3. Call Site Identification
   
   
4. Patching
   ​
   
5. Reassembly

Performance

Improvements

• Reduce overhead
  • if code retrieved via trusted HTTPS source no need to verify?
• Configurable automation tool
  • Allow for any methods of DCL
• Remove single point of failure -
  • Ensure, that code and certificates are stored in different domains
  • Google services integration
  • Utilize a Public Key Infrastracture (PKI)
• More comprehensive evaluation

Summary

• Dynamic Code Loading (DCL) is a useful feature of Android, but is supported and implemented insecurely. 
• Grab ‘N Run aims to ensure DCL is done securely and easily, including third party applications.
• Grab ‘N Run does this by implementing:
  • Secure storage of dynamically loaded code.
  • Guaranteed code verification via certificates
• Grab ‘N Run automated patcher
• Several significant limitations