Systematic Detection of Capability Leaks in Stock Android Smartphones.

摘要: Recent years have witnessed a meteoric increase in the adoption of smartphones. To manage information and features on such phones, Android provides permission-based security model that requires each application to explicitly request permissions before it can be installed run. In this paper, we analyze eight popular smartphones discover stock phone images do not properly enforce permission model. Several privileged are unsafely exposed other applications which need them for actual use. identify these leaked or capabilities, developed tool called Woodpecker. Our results with show among 13 examined so far, 11 were leaked, individual phones leaking up permissions. By exploiting them, an untrusted wipe out user data, send SMS messages, record conversation affected – all without asking any permission.