TWU Designing System level Defenses against Cellphone Malware Discussion Question: This week you will review one of the papers you selected (Attached). The

TWU Designing System level Defenses against Cellphone Malware Discussion Question: This week you will review one of the papers you selected (Attached). The importance of the paper reviews is to learn how scientific papers are written and learn how the papers are peer-reviewed. When you learn how papers are critiqued, you will be write good scientific papers. As doctoral students, you will always have opportunities to be peer reviewers to conferences, workshops and symposiums where you present your papers.

Your paper review should be at most 2 pages in length, using 1.5 spacing and font size of 12 in Times New Roman. Make sure that the critique is written in your own words avoid plagiarizing the paper you are reviewing. Below is the rubric I will use to grade your paper review.

#

Grading Elements for Paper Review

Points

1

Summary of the paper’s problem statement, research question and key findings

10

2

Critique of paper’s dataset and sampling techniques

5

3

Critique of paper’s explanation of results, analysis and ground truth

10

4

Critique of paper’s generalizability of results/models and research contributions

10

5

Summary of paper’s research limitations

5

6

Summary of paper’s research gap(s)

5

7

Summary of paper’s mechanics (spellings, grammar, storyboard, coherence)

5

8

Can the paper be extended? Provide suggestions, How about future work?

5

9

Can the paper be improved? Provide suggestions

5

Total points

60 2009 28th IEEE International Symposium on Reliable Distributed Systems
Designing System-level Defenses against Cellphone Malware
Liang Xie*
Xinwen Zhang†
Ashwin Chaugule*
Trent Jaeger*
Sencun Zhu*
∗Department of Computer Science and Engineering, Pennsylvania State University, PA 16802
† Samsung Information Systems America, San Jose, CA 95134
{lxie, avc114, szhu, tjaeger}@cse.psu.edu
xinwen.z@samsung.com
Flexispy [7] monitors a victim’s call history and contacts,
and delivers these sensitive information to a remote server.
Research on quarantining cellphone malware has started
recently. The straightforward defense is to mirror the strategy
against PC viruses with the inception of security patches for
cellphones. However, it is challenging for users to acquire
signature files in a timely manner; besides, downloading
often causes extra charges. Some recent work propose more
active solutions, e.g., by designing algorithms to automatically identify compromised phones based on user interactions [8] and suggesting a proactive containment framework
to quarantine those suspected devices, and by designing
a collaborative virus detection/alerting system [9]. These
approaches, however, rely on network or external agents to
throttle worm spread. We believe that defense mechanisms
deployed on cellphones are more effective both in detecting
malware in a timely fashion and in preventing malicious
messages from entering wireless networks. Indeed, on this
line, a labeling technique [10] has been proposed to protect
a phone against cross-service attacks from its PDA interface.
However, it does not provide further solutions for containing
automated malware [11].
Abstract—Cellphones are increasingly becoming attractive
targets of various malware, which not only cause privacy
leakage, extra charges, and depletion of battery power, but also
introduce malicious traffic into networks. In this work, we seek
system-level solutions to handle these security threats. Specifically, we propose a mandatory access control–based defense
to blocking malware that launch attacks through creating new
processes for execution. To combat more elaborated malware
which redirect program flows of normal applications to execute
malicious code within a legitimate security domain, we further
propose using artificial intelligence (AI) techniques such as
Graphic Turing test. Through extensive experiments based on
both Symbian and Linux smartphones, we show that both
our system-level countermeasures effectively detect and block
cellphone malware with low false positives, and can be easily
deployed on existing smartphone hardware.
Keywords-Cellphone Malware; Graphic Turing Test; Mandatory Access Control;
I. I NTRODUCTION
Mobile communication systems which support both voice
and data services have become ubiquitous and indispensable.
This advantage however comes with a price — mobile
networks and terminal devices (e.g., smartphones and PDAs)
are becoming attractive targets to attackers. Especially, the
popularity of mobile services such as email and messaging,
and their dependence on common software platforms such
as Symbian and Linux, have made mobile devices ever more
vulnerable. Situation gets worse as mobile devices quickly
evolve [1]. According to F-Secure [2], currently there are
more than 350 mobile malware (or viruses) in circulation.
Examples of the most notorious threats to cellphones include
Skull [3], Cabir [4], and Mabir [5] targeting at Symbian
operating systems. The research organization IDC estimates
that by 2008 the market for mobile security software will
grow yearly by 70% [6].
In this paper, we refer to cellphone malware as malicious
codes that exploit vulnerabilities in cellphone software and
propagate in networks through popular services such as
Bluetooth and messaging (SMS/MMS) services. Cellphone
malware are devastating to both mobile users and network
infrastructures. Users of compromised cellphones could be
unconsciously charged for numerous messages delivered by
malware and their phone batteries could be quickly drained.
Other reported damages include loss of user data and privacy
and software crashes. For example, a Trojan spy named
1060-9857/09 $26.00 © 2009 IEEE
DOI 10.1109/SRDS.2009.21
Contributions: First, a comprehensive study on malware’s
attack strategies is important in designing effective countermeasures against them. Our categorization and analysis on major attack strategies reveal challenging issues to
be addressed in effective defenses. Second, we propose a
mandatory access control–based mechanism which controls
program accesses to important system resources through
enforcing a customized access control policy in the context
of cellphones. This mechanism is effective in defeating
malware which execute malicious codes in new processes.
Third, to combat automated malware which gain controls of
existing processes to execute malicious codes, we propose
a more comprehensive defense which identifies and blocks
malware using AI techniques such as Graphic Turing test
(GTT). Using MMS as an example, through challenging a
user, our approach differentiates whether a delivery of MMS
message is legitimate (user-initiated) or illegal (malwareinitiated). Moreover, this approach does not reply on known
malware signatures. Fourth, we provide real implementations
and evaluate our defenses on major smartphone platforms.
Experimental results including benchmark and performance
83
data demonstrate that our solutions are light-weight and
effective in blocking various malware.
cases, these code may even invoke certain system calls to
cause crashes. Compared with strategy I, this attack method
is more elaborated and automated hence more challenging
because it keeps the security context of the hijacked process
while executing the malicious code and does not rely on
user operations to propagate.
Outline: The rest of the paper is organized as follows. In
Section II, we provide an overview of our defenses: an
access control–based scheme and a GTT-based scheme. We
present design and implementation details of the defenses in
Section III and evaluate their effectiveness and performance
through experiments in Section IV. We introduce related
work in Section V and conclude in Section VI.
II. OVERVIEW OF THE C OUNTERMEASURES
We assume that a malware launches attacks from
application-level software, i.e., it could compromise phone
applications such as email and MMS/SMS messaging, etc.
However, it cannot break the kernel. Kernel level attacks
such as rootkits have not been found on cellphones [2].
We also notice that a few techniques can be adopted to
prevent malware’s kernel-hacking in cellphones, for example, integrity measurement architecture (IMA) [13], [14]
helps identify falsifications on kernel code, virtual machine
techniques [15] helps isolate kernel-level attacks from a legal
OS. Kernel protection is out of the scope of this paper.
We design a mandatory access control (MAC)-based
protection scheme to defeat malware which launch attacks
through creating new malicious processes (attack strategy
I). To combat more elaborated malware which redirect
program flows of normal applications (e.g., messaging and
emailing) to execute malicious code within a legitimate
security domain (attack strategy II), we adopt AI techniques
such as Graphic Turing test (GTT) as the countermeasure.
Note that this approach addresses both forms of attacks.
A. Malware’s Attack Strategies
From a software perspective, we study two basic forms
of attack strategies adopted by cellphone malware. The key
difference between these two is whether a malware creates
a new process to launch its attack.
Attack strategy I: In this case, a malware always creates
a new process to execute its malicious code, and to compromise the cellphone. User operations are usually required
in this case, e.g., a user installs a downloaded software, or
opens a received message. The newly created process has
its own descriptor, which describes address space, execution
state, and security attributes (i.e., security context 1 ). This
security context is different from that of the parent process
which invokes it. Due to simplicity, this strategy is widely
adopted by most existing malware. Symbian and Windows
Mobile users cannot change the kernel; Symbian programs
register themselves within a platform and make system
calls within framework APIs (provided by vendors) to use
system services. Realizing this, cellphone malware launch
attacks through legally installed applications. For example,
Mabir [5] includes its malicious code in an SIS installation
file 2 and attaches it to an infection vector (e.g., an MMS
message). Once a recipient activates this SIS file, a malicious
program is installed and executed, incurring damages to the
phone. For instance, a program invokes messaging APIs to
deliver numerous malicious messages, or steal user private
information and send to a malicious server.
A. Access Control–based Protection
We first anatomize the MMS/SMS messaging, a major
infection vector for malware. To deliver a message to the
recipient, a messaging process invokes a sequence of key
system calls to access important system resources (e.g.,
file, socket, and modem device) and access related system services. Using a Linux-based phone (e.g., Motorola
A1200 and E680) as an example, to search for the email
address or phone number of the recipient, a messaging
process named mmsclient invokes open(“address book”,
O RDONLY) to access the contact list in the phone address book; to deliver a SMS/MMS message, mmsclient
calls fd=open(“/dev/ttyS0”, O RDWR) to open the modem
device 3 (i.e., serial device ttyS0) and invokes write(fd,
message, length) to send a composed message message to
the modem, which eventually processes the message and
transmits it to the air interface; to send an email messaging
through Wi-Fi interface, a process named smtpclient invokes socket(AF INET, SOCK STREAM) to create a stream
socket through which it communicates with an SMTP server.
These system calls are critical monitoring and authentication
points in kernel, because malware’s final goal is to invoke
system calls as a normal process does and gain accesses
Attack strategy II: In this case, a malware does not create
a new process in the phone. Instead, it redirects the program
flow of a legitimate application (e.g., messaging process)
to execute its malicious code within a legitimate security
context. Such attacks mostly happen in cellphones with
open-source platform OS and application frameworks, e.g.,
Linux-based smartphones. An automated malware adopts
this strategy through exploiting software vulnerabilities such
as stack buffer-overrun [12] in a cellphone software to
‘hijack’ its normal program flow and launch attacks. Note
that the malicious code to be executed after the malware
gains control of the program counter may exist in the original
program’s address space so that it is legal to OS. In some
1 For example in Linux, a process’s security context typically consists of identity,
role, and type/domain of the process.
2 The format of an user-initiated installation file to distribute Symbian applications.
3 Modem device is a separate phone unit, which contains radio frequency (RF) and
base-band components, low-level coding-decoding software and protocol stacks.
84
to important system resources and launch attacks. Therefore, our goal with access control-based protection is to
distinguish malicious processes from normal ones and give
different permissions to them at these checking points.
We adopt a defense model that is similar to Security
Enhanced Linux (SELinux) [16] to achieve strong protection
in cellphones. SELinux employs Linux Security Modules
(LSM) inside kernel to implement MAC policies, which assign different permissions to different processes based upon
the least privilege principle. Specifically, SELinux associates
security labels (contexts) of the form user:role:type to all
subjects (processes) and objects (files/directories, programs,
sockets, etc.). Within a security context, the type attribute
represents the type of a subject or an object, e.g., sshd t
and syslogd t. Instead of directly associating a user with
types, SELinux associates a user with a set of roles and a
role with a set of types. The role simplifies the management
of users. This means that access control in SELinux is
primarily enforced via a so-called Type-Enforcement [17]
policy model.
to authenticate an ongoing process and identify malware
behaviors. Specifically, our countermeasure involves executing a Graphic Turing test (GTT) before a phone message
framework eventually delivers a message to the air interface of the phone. GTT has a nice feature that a human
being can always pass a Turing test while an automated
malware cannot. In this case, even if an elaborated malware
compromises the application-layer interface of the keypad
driver, it is still unable to figure out the correct answer of a
GTT challenge. This countermeasure can identify malware
adopting both forms of attack strategies, because it does not
simply verify the security context of an ongoing process;
instead, it differentiates a malicious message originator from
a normal user through authenticating their genuine natures.
This approach also helps detect a wider variety of malware,
including new malware that are unknown to security vendors
(e.g., zero-day or polymorphic ones).
Although our GTT-based defense requires user operations
during message deliveries, the rate of normal MMS/MMS
messaging (on the order of 0∼10.07 messages/hour [18])
is unlikely to be very frequent due to the limited resources
of dedicated signaling channels, e.g., Stand-alone Dedicated
Control Channels (SDCCHs) configured for SMS messaging
in GSM [19] Base Stations. Moreover GTT takes only
several seconds, which can be ignored when considering
the time a user spends to compose a message. Note that a
user is motivated to take GTT because she wants to prevent
cellphone from sending numerous malicious messages which
cause privacy leakage, extremely high service charges, and
quick depletion of battery power Under certain circumstances, a user may choose to launch GTT on her cellphone
using a random-challenging mode, in which the messaging
framework of the phone randomly (e.g., with a probability
of 10%) executes GTTs to authenticate message initiators.
This is especially useful when the user needs to deliver a
large amount of messages, for example, during holidays
or birthdays. Note that also it does not provide perfect
prevention, random-challenges are still very effective in detecting malware which tend to generate numerous malicious
messages. We argue that one desire property of malware is
stealthy to bypass IDS. With our technique, such malware
will be eventually captured even if it transmits at a low rate.
After that, the user can disinfect this phone by installing a
security patch or sending it for professional maintenance.
Overall, the random-challenging strategy nicely deals with
a tradeoff between user convenience and cellphone security.
B. GTT-based Protection
Using messaging malware as an example, to identify and
throttle malware within a cellphone device, we first need to
differentiate a malware-initiated messaging process from a
normal user-initiated messaging process. This is relatively
easy when a malware creates an unauthorized process to invoke system calls or messaging APIs to execute its malicious
program, because this malicious process has its new security
context which can be identified according to some predefined
security policies. However, in the case when a malware
launches attacks through hijacking the program flow of a
registered application, it becomes a challenging task because
the malicious process retains the security context of the
registered application, which is still legitimate.
To detect such malware behavior, one approach is to
use content-based filtering. For example, messages that are
delivered with .SIS attachments and attractive titles are more
suspicious than others. However, this often results in nonneglectable false positives and false negatives, as we experience in the context of email spam filtering. Moreover, this
involves running complex machine learning tools, which do
not fit for cellphones that are usually resource-constrained.
Another approach is to let a user manually confirm every
message that is leaving her phone. Specifically, when sending a message to the air interface, the messaging framework
asks the user to choose YES/NO using either keypad or
touch-screen to confirm the message delivery. This of course
helps block some simple attacks. However, more elaborated
malware could compromise the application-layer interface
of the keypad/touch-screen driver and inject a false input to
circumvent this simple protection.
We adopt artificial intelligence (AI) techniques to address
this challenging issue. Our idea is to rely on AI techniques
III. D EPLOYMENT OF THE C OUNTERMEASURES
A. Access control–based Protection
1) Achieving Access Control on Smartphones: Here we
explain in details4 how this scheme works in Qtopia phone
4 Our technical report [20] shows the complete flow of applying access
control on key system resources to contain cellphone malware.
85
edition 4.2 [21], the major application platform for Linuxbased phones such as Motorola A1200, Sony Mylo, and
many others [22]. Recall that our strategy is to authenticate and authorize accesses to key resources such as user
address book, modem devices, and Wi-Fi interfaces on
a mobile device. Therefore, we focus our control on the
system calls that are invoked towards these resources, such
as open(”address book”, O RDONLY), open(“/dev/ttyS0”,
O RDWR), and write(fd, message, length). Fortunately,
hooks have been defined by LSM in most places where we
want to control system file openings and device accesses.
Therefore, the main tasks in this scheme are to (1) define
SELinux policy rules to specify process and object types
and permissions to access critical system resources, (2) label
corresponding programs to specific types thus enabling their
legitimate permissions, and (3) limit type transitions via
program invocations from any other type to those allowed
to access protected resources. We explain these steps below.
The fundamental goal of our access control–based scheme
is to only allow legitimate accesses to key resources while
denying others. The key problem is to identify what kind of
privileges are required for each program, such as to satisfy
the least privilege principle. One feature of SELinux policy
is that all allow rules in a policy.conf are positive; that is,
a single rule always adds some permissions to a subject
type. Therefore, to prevent any illegal subject type from
having unexpected permissions, we define “private” types
of our target resource objects such that they are only visible
to subject types in the same domain. Here by domain we
mean all trusted subjects that are allowed to access a target
object. For example, in the Qtopia platform, Qt applications
and plugins (e.g., qtmail and qtmms) are typically trusted
to the address book object. Thus permissions from them
to read/write user address book are allowed, while those
permissions from other subjects are denied. To provide private object types, we leverage the recent SELinux Loadable
Policy Module (LPM) mechanism, which offers a flexible
way to create self-contained policy modules that are linked
to an existing policy. Private object types can be defined in
an LPM such that they can only be accessed by subject types
defined in the same module, which provides a flexible and
safe mechanism to define desired permissions for subjects.
If a subject type needs to access object types defined in
another module, an LPM can define public object types that
can be accessed by external su…
Purchase answer to see full
attachment