#HITB2012AMS D2T1 - Georgia Weidman - Bypassing the Android Permission Model

## Overview Georgia Weidman demonstrates that Android's permission model is so fundamentally flawed that malware developers don't need to bypass it at all—they can simply request excessive permissions that users readily accept. Rather than exploit the system, attackers can abuse the legitimate permission model, gain root access through vulnerable exploits, or craft clever attacks against app interfaces.

## Permission Model Failures Weidman begins by examining Facebook for Android, which requests an extensive set of permissions (contacts, SMS, location, accounts, storage, calls, IMEI access, etc.) despite not needing them all. She builds a simple app called "hello Android" requesting only three permissions: read contacts, read IMEI, and send SMS. This app silently steals the device's IMEI and transmits it via SMS without any user notification or entry in the sent folder, proving that users willingly grant permissions they don't understand and that apps can abuse them invisibly.

## Rooting and Droid Dream Malware Weidman discusses rooting tools (Super One Click, Z4 mod) and their legitimate use, then contrasts them with Droid Dream—the first known malware discovered in Google Play Store. Droid Dream appeared as innocent apps (bowling games, adult content) but contained copied legitimate apps while silently deploying root exploits ("Rage Against the Cage" is specifically mentioned) in the background. It asked for only four permissions, which didn't raise suspicion. Once rooted, the device's permission model completely collapses; system-level apps bypass all permission restrictions and gain complete control.

## Kernel-Level SMS Interception Weidman demonstrates kernel-level SMS hijacking using three rooted G1 phones. After gaining root, malware can install shims at the kernel/modem driver level to intercept all SMS traffic before it reaches the application layer. GSM messages are unencrypted by the time they reach the phone (only encrypted in transit via session keys), so malware can decode, analyze, and redirect messages without keys. The demo shows an attacker sending a command SMS that the victim receives, then retransmitting that message to a contact—demonstrating how to silently add devices to botnets.

## Insecure Data Storage and Reversing Weidman presents "bad file save" and "bad SMS file" apps. "Bad file save" stores the IMEI on the world-readable SD card; "bad SMS file" (with no storage permissions) reads and exfiltrates it via SMS. She demonstrates reversing Android apps using Dex2Jar and JD-GUI, showing how attackers can extract Java source code from APKs, discover exactly what data is stored where, and locate file names and function signatures in minutes.

## Intent Exploitation Weidman's final attack shows an unprivileged app (SMS intent, zero permissions) calling components in a privileged app (SMS broadcaster, send SMS permission) by constructing a malicious intent. By reverse-engineering the target app to discover its package name, component names, and parameter keys, the attacker can invoke dangerous functions without owning the required permissions.

## Mitigations Developers must: secure storage (encrypt, keep off SD card, don't make world-readable), protect dangerous interfaces with user confirmation dialogs, and use the "require permission" tag in Android manifest files. Users must update phones—but update delays from carriers mean devices remain vulnerable for months or years. Weidman notes developers often ignore security guidance because they prioritize features over safety and rarely consult Android's security documentation.