Detection of hidden privilege escalations in android

Abstract

Android’s most widely used smartphone OS has several inter-app communication options, such as broadcast receivers, intents, content providers, and objectives. Even though the Android permission system restricts access and safeguards user data, security flaws allow malicious apps to abuse permission systems. Higher-order privilege escalation, where apps cooperate to circumvent security limitations throughout several phases, is a key vulnerability in this ecosystem. This paper presents a new method for n-order case analysis to find undetectable privilege escalations. Our approach systematically identifies multi-stage permission escalations via automated test case generation and stationary analysis. Unlike current methods emphasizing direct permission misuse, our approach analyzes escalation chains across many app interactions and uncovered 52,982 instances of fourth-order privilege escalation that went unnoticed when just first-order transitions were examined. Furthermore, our findings show an important distinction: benign programs gradually gain greater permissions through escalation chains, whereas malignant apps request excessively high upfront rights. This difference emphasizes the necessity of better permission management techniques to reduce the serious risk associated with rising higher-order privilege escalations, which are generally disregarded by current detection systems. Therefore, our method fulfills the need for a more scalable detection technique to address this challenging security concern in Android ecosystem.