The impact of vendor customizations on android security

摘要: The smartphone market has grown explosively in recent years, as more and consumers are attracted to the sensor-studded multipurpose devices. Android is particularly ascendant; an open platform, manufacturers free extend modify it, allowing them differentiate themselves from their competitors. However, vendor customizations will inherently impact overall security such still largely unknown.In this paper, we analyze ten representative stock images five popular vendors (with two models each vendor). Our goal assess extent of issues that may be introduced further determine how situation evolving over time. In particular, take a three-stage process: First, given smartphone's image, perform provenance analysis classify app image into three categories: apps originating AOSP, customized or written by vendor, third-party simply bundled image. Such allows for proper attribution detected examined images. Second, permission usages pre-loaded identify overprivileged ones unnecessarily request permissions than they actually use. Finally, vulnerability analysis, detect buggy can exploited mount re-delegation attacks leak private information.Our evaluation results worrisome: significant on devices whole responsible bulk problems device. Specifically, our show average 85.78% all with majority directly customizations. addition, 64.71% 85.00% vulnerabilities every (except Sony) arose general, pattern held time -- newer smartphones, found, not necessarily secure older ones.