Application-based user and telecom targeted attacks on android-based smartphones :applicability, detection and mitigation -

Abstract

Android is currently the world’s most popular smartphone platform with more than 60percent market share. From the security perspective, Android has had significant challenges despite the efforts of the Android designers to provide a secure environment for applications development. In this thesis, we present numerous attacks targeting the messaging framework of the Android system. Our focus is on SMS, USSD, and the evolution of their associated security in Android and accordingly, the development of related attacks. Also, we shed light on the Android elements that are responsible for these attacks. In particular, we study some messaging design decisions, which resulted in a set of vulnerabilities in the Android operating system, and we demonstrate how malware applications can be built to take advantage of these vulnerabilities. The permission subsystem, the broadcast receiver subsystem, and the message-sending mechanism contribute to forming a haven for SMS malware by granting them absolute control over sending, receiving, and hiding SMS messages. Since many operators worldwide provide services that allow users to transfer credits-units through SMS, we built an application that abuses this service by transferring credits from users illegally. This enables the malware to drain the balance of the attacked user and has the potential to cause damage to a large number of users as well as telecom operators. We also present an SMS-based Android botnet. Since all mobile phones have SMS services as a feature, we use SMS as the medium of propagation of Command and Control messages between the botnet controller and the victim devices. We demonstrate how this application and the associated botnet could have a drastic impact on SMS voting, Premium SMS services, and credit transfer. Finally, we present the architecture of an anomaly-based intrusion detection system (IDS) that promises to thwart SMS messaging attacks. The IDS tries to capture unsolicited SMS sending attempts by malicious apps. Our IDS testing shows a detection