Employing Android Security Features for Enhanced Security and Privacy Preservation

In this thesis, we examine the architecture and the security framework underlying the Android operating system. We explore existing Android end-to-end encrypted (E2EE) messaging applications and derive four categories of common issues that are applicable to these applications. We then provide an overview of the known issue of privilege escalation wherein a malicious privileged application can utilize inter-process communication techniques to send protected data to an unauthorized application on a user’s device. We demonstrate through a proof of concept how this behavior can be achieved in real applications, and we suggest potential countermeasures that can help prevent this issue. Furthermore, in the interest of diminishing the common issues that are applicable to E2EE messaging applications, we propose a new design for such applications that employs some of the principal security features offered by the Android operating system. We explain how our design can help eliminate trust-related issues associated with such applications, as well as how it can help minimize issues in other categories. Finally, we demonstrate how our proposed design can be used in practice by implementing a proof of concept.

Grantor dc:publisher

Université d'Ottawa / University of Ottawa

Year dc:date

2017

Author dc:creator

• Wakim, Mike

Contributors dc:contributor

• Adams, Carlisle

• Android
• Security
• Privacy
• Preservation
• IPC
• E2EE
• Scheme
• Encryption
• End-to-End
• Messaging

Language dc:language

en

Identifier

http://dx.doi.org/10.20381/ruor-20633

OAI identifier oai:identifier

oai:ruor.uottawa.ca:10393/36353