Trusted Systems Group

Projects

Current Projects

Android Middleware Analysis

The Android middleware has been a popular target for security extensions over the last few years. For instance, context-aware policies, DRM-like solution, developer-centric policies, or generic mandatory access control infrastructures have been brought forward, just to name a few. However, almost no consideration has been given on how to analyze or security test the large, highly complex code base of the Android middleware. In this project, we advance the state-of-the-art of analysis and security testing to enable various security- and privacy-focused investigations, such as permission mapping (Backes et al. 2016), fuzzing, or placement of access control hooks.

Security state of Android ecosystem

While the majority of Android security research has focused on the platform, market operators, and end-users as primary security principals, the Android ecosystem consists of many more stakeholders that have a (sometimes significant) influence on the security state of the overall ecosystem. (Acar et al. 2016) In this project, we investigate and quantify this influence of third-party stakeholders (Backes, Bugiel, and Derr 2016; Derr et al. 2017; Oltrogge et al. 2018) and propose new techniques and workflows that improve the overall security state of the Android ecosystem (Huang et al. 2017).

The LibScout tool as part of this research has been made publicly available at github.

Past Projects

Android Security Framework

Android Security Framework (ASF) is a generic, extensible security framework for Android that enables the development and integration of a wide spectrum of security models in form of code-based security modules. The design of ASF reflects lessons learned from the literature on established security frameworks (such as Linux Security Modules or the BSD MAC Framework) and intertwines them with the particular requirements and challenges from the design of Android’s software stack. ASF provides a novel security API that supports authors of Android security extensions in developing their modules. This overcomes the current unsatisfactory situation to provide security solutions as separate patches to the Android software stack or to embed them into Android’s mainline codebase. As a result, ASF provides different practical benefits such as a higher degree of acceptance, adaptation, and maintenance of security solutions than previously possible on Android. We present a prototypical implementation of ASF and demonstrate its effectiveness and efficiency by modularizing different security models from related work, such as context-aware access control, inlined reference monitoring, and type enforcement.

Source code, example security modules, and documentation can be retrieved from the project website.

Publications

Peer-reviewed publications with contributions by members of the Trusted Systems Group:

Conference Articles

2018

  • Oltrogge, Marten, Erik Derr, Christian Stransky, Yasemin Acar, Sascha Fahl, Christian Rossow, Giancarlo Pellegrino, Sven Bugiel, and Michael Backes. 2018. “The Rise of the Citizen Developer: Assessing the Security Impact of Online App Generators.” In 39th IEEE Symposium on Security and Privacy (SP ’18) [to Appear]. IEEE.

2017

  • Derr, Erik, Sven Bugiel, Sascha Fahl, Yasemin Acar, and Michael Backes. 2017. “Keep Me Updated: An Empirical Study of Third-Party Library Updatability on Android.” In 24th ACM Conference on Computer and Communication Security (CCS’17). ACM.
  • Huang, Jie, Oliver Schranz, Sven Bugiel, and Michael Backes. 2017. “The ART of App Compartmentalization: Compiler-Based Library Privilege Separation on Stock Android.” In 24th ACM Conference on Computer and Communication Security (CCS’17). ACM.
  • Backes, Michael, Sven Bugiel, Philipp von Styp-Rekowsky, and Marvin Wißfeld. 2017. “Seamless In-App Ad Blocking on Stock Android.” In Mobile Security Technologies (MOST) 2017 Workshop. IEEE.
  • Backes, Michael, Sven Bugiel, Oliver Schranz, Philipp von Styp-Rekowsky, and Sebastian Weisgerber. 2017. “ARTist: The Android Runtime Instrumentation and Security Toolkit.” In 2nd IEEE European Symposium on Security and Privacy (EuroS&P’17). IEEE.

2016

  • Backes, Michael, Sven Bugiel, and Erik Derr. 2016. “Reliable Third-Party Library Detection in Android and Its Security Applications.” In 23rd ACM Conference on Computer and Communications Security (CCS’16). ACM.
  • Backes, Michael, Sven Bugiel, Erik Derr, Patrick McDaniel, Damien Octeau, and Sebastian Weisgerber. 2016. “On Demystifying the Android Application Framework: Re-Visiting Android Permission Specification Analysis.” In 26th USENIX Security Symposium (USENIX Security ’16). USENIX.
  • Backes, Michael, Sven Bugiel, Erik Derr, Sebastian Gerling, and Christian Hammer. 2016. “R-Droid: Leveraging Android App Analysis with Static Slice Optimization.” In 11th ACM Asia Conference on Computer and Communications Security (ASIACCS ’16). ACM.
  • Acar, Yasemin, Michael Backes, Sven Bugiel, Sascha Fahl, Patrick McDaniel, and Matthew Smith. 2016. “SoK: Lessons Learned From Android Security Research For Appified Software Platforms.” In 37th IEEE Symposium on Security and Privacy (SP ’16). IEEE.

2015

  • Backes, Michael, Sven Bugiel, Christian Hammer, Oliver Schranz, and Philipp von Styp-Rekowsky. 2015. “Boxify: Full-Fledged App Sandboxing for Stock Android.” In 24th USENIX Security Symposium (USENIX Security ’15). USENIX.

2014

  • Backes, Michael, Sven Bugiel, and Sebastian Gerling. 2014. “Scippa: System-Centric IPC Provenance on Android.” In 30th Annual Computer Security Applications Conference (ACSAC’14). ACM.
  • Backes, Michael, Sven Bugiel, Sebastian Gerling, and Philipp von Styp-Rekowsky. 2014. “Android Security Framework: Extensible Multi-Layered Access Control on Android.” In 30th Annual Computer Security Applications Conference (ACSAC’14). ACM.

2013

  • Bugiel, Sven, Stephan Heuser, and Ahmad-Reza Sadeghi. 2013. “Flexible and Fine-Grained Mandatory Access Control on Android for Diverse Security and Privacy Policies.” In 22nd USENIX Security Symposium (USENIX Security ’13). USENIX.
  • Bleikertz, Sören, Sven Bugiel, Hugo Ideler, Stefan Nürnberger, and Ahmad-Reza Sadeghi. 2013. “Client-Controlled Cryptography-as-a-Service in the Cloud.” In 11th International Conference on Applied Cryptography and Network Security (ACNS’13). Springer.

2012

  • Brasser, Franz Ferdinand, Sven Bugiel, Atanas Filyanov, Ahmad-Reza Sadeghi, and Steffen Schulz. 2012. “Softer Smartcards: Usable Cryptographic Tokens with Secure Execution.” In Financial Cryptography and Data Security (FC). LNCS. Springer.
  • Bugiel, Sven, Lucas Davi, Alexandra Dmitrienko, Thomas Fischer, Ahmad-Reza Sadeghi, and Bhargava Shastry. 2012. “Towards Taming Privilege-Escalation Attacks on Android.” In 19th Annual Network & Distributed System Security Symposium (NDSS’12).

2011

  • Bugiel, Sven, Thomas Pöppelmann, Stefan Nürnberger, Ahmad-Reza Sadeghi, and Thomas Schneider. 2011. “AmazonIA: When Elasticity Snaps Back.” In 18th ACM Conference on Computer and Communications Security (CCS’11). ACM.
  • Bugiel, Sven, Lucas Davi, Alexandra Dmitrienko, Stephan Heuser, Ahmad-Reza Sadeghi, and Bhargava Shastry. 2011. “Practical and Lightweight Domain Isolation on Android.” In 1st ACM CCS Workshop on Security and Privacy in Mobile Devices (SPSM’11). ACM.
  • Bugiel, Sven, Stefan Nürnberger, Ahmad-Reza Sadeghi, and Thomas Schneider. 2011. “Twin Clouds: Secure Cloud Computing with Low Latency.” In Communications and Multimedia Security Conference (CMS’11). Springer.
  • Bugiel, Sven, Lucas Davi, and Steffen Schulz. 2011. “Scalable Trust Establishment with Software Reputation .” In Workshop on Scalable Trusted Computing (STC’11). ACM.

2010

  • Bugiel, Sven, Alexandra Dmitrienko, Kari Kostiainen, Ahmad-Reza Sadeghi, and Marcel Winandy. 2010. “TruWalletM: Secure Web Authentication on Mobile Platforms.” In 2nd Conference on Trusted Systems (INTRUST’10).
  • Bugiel, Sven, and Jan-Erik Ekberg. 2010. “Implementing an Application-Specific Credential Platform Using Late-Launched Mobile Trusted Module.” In 5th Annual Workshop on Scalable Trusted Computing (STC’10). ACM.

2009

  • Ekberg, Jan-Erik, and Sven Bugiel. 2009. “Trust in a Small Package: Minimized MRTM Software Implementation for Mobile Secure Environments.” In 4th Annual Workshop on Scalable Trusted Computing (STC’09). ACM.