Honey, I Shrunk Your App Security: The State of Android App Hardening

Abstract

The continued popularity of smartphones has led companies from all business sectors to use them for security-sensitive tasks like two-factor authentication. Android, however, suffers from a fragmented landscape of devices and versions, which leaves many devices unpatched by their manufacturers. This security gap has created a vital market of commercial solutions for Runtime Application Self-Protection (RASP) to harden apps and ensure their integrity even on compromised devices. In this paper, we assess the RASP market for Android by providing an overview of the available products and their features. Furthermore, we describe an in-depth case study for a leading RASP product—namely Promon Shield—which is being used by approximately 100 companies to protect over 100 million end users worldwide. We demonstrate two attacks against Promon Shield: The first removes the entire protection scheme statically from an app, while the second disables all security measures dynamically at runtime.

Mehr zum Titel

Titel	Honey, I Shrunk Your App Security: The State of Android App Hardening
Medien	DIMVA 2018: Detection of Intrusions and Malware, and Vulnerability Assessment
Verlag	Springer International Publishing
ISBN	978-3-319-93410-5
Verfasser	Vincent Haupert, Dominik Maier, Nicolas Schneider, Julian Krisch, Prof. Dr. Tilo Müller
Seiten	S. 69-91
Veröffentlichungsdatum	08.06.2018
Zitation	Haupert, Vincent; Maier, Dominik; Schneider, Nicolas; Krisch, Julian; Müller, Tilo (2018): Honey, I Shrunk Your App Security: The State of Android App Hardening. DIMVA 2018: Detection of Intrusions and Malware, and Vulnerability Assessment, S. 69-91.