Different operating systems (OS) partition sensitive areas of the OS with non sensitive parts using different methods. In the case of the world’s most popular mobile operating system, Android, sensitive areas of the operating system such as the file system is separated from other areas through a sandbox system policed by a layered permissions system.
In Android 5 and earlier versions of the operating system, the permission system is operated as a lumped system. Specifically, apps request permissions from the user as a set of permissions, and the user cannot grant permission to individual items on the list of permission request. Thus, this opens up a deep vulnerability in Android, where malware infected apps could masquerade as legitimate apps with highly sought after content such as news and social media information. Hence, by requesting for block permissions to important functions such as microphone, contacts, identity, and WiFi, malware app with useful content could infect significant fraction of devices around the world with not up-to-date Android operating system such as KitKat (Android 4.4.4). Such infection, by popular apps, of significant number of mobile devices around the world opens up the possibility of linking large number of devices into a botnet with far-reaching implications for global computer security. Specifically, besides their frequent use in botnets for breaking into online banking systems as well as conducting mass distributed denial of service attacks on cyber assets around the world, these botnets could also be used in hitherto unknown scenarios of cyber attacks.
Hence, where possible, it is always advisable to purchase mobile devices with Android versions of 5.1.1 or higher, preferably Android 6.0.1 and Android 7.1. This is in large part due to the in built ability of Android 6 to allow users to grant permission to an app for a particular function in the operating system or device. For example, a flash light app may request for access to the microphone of the device, for which it does not require. Depending on how the app is constructed for compliance with the new Android permission system, the user may or may not be able to restrict access of the flash light app, once installed, of the microphone function. This thus raise another question on how a new permission system can percolate down to every app in the Google Play Store and, by extension, the Android ecosystem. Put another way, what can be done to ensure that all apps comply with the graduated permission system in Android 6?
Practically, little could be done if cost of amending or improving an app by the developer is factored in. Specifically, most apps in mobile devices are coded by commercial companies who charges a fee for each development project. Thus, cost is always in the calculus of the developer if there is a need to comply with Android’s new permission system for Android 6 operating system. From a cost perspective, it can be understood that there will be significant barrier to broad spectrum adoption of the new permission system, even for popular news and games apps.
More importantly, given the need to allow each app to be compatible with older versions of Android such as 4.3, 4.4.4, and 5.1.1, most apps would not be able to successfully transition to the new app permission system of Android 6. Hence, while the new capability of the Android 6 permission system allow users to grant itemized permissions to individual functions of the operating system and device, inability to move most apps (except for a small proportion) in the Google Play Store to the new permission system due to compatibility problems with older versions of the operating system as well as cost of development, meant that the utility of the new permission system in safeguarding user’s privacy and data security is greatly reduced. This raises an important and fundamental question on the design of the Android operating system, how to make it more secure regardless of the app installed? One must ask: would improving the permission system of Android protect against apps which are non complaint with the optional new permission system of Android 6? The answer is likely to have little effect on the overall security of devices in the Android ecosystem. Moving forward, a redesign of the Android operating system architecture would be the best approach for improving device security in the context of making the OS less vulnerable to control by malware apps.
Category: computer security,
Tags: Android, permission system, sandbox, Google Play Store, individual permission, Marshmallow, Nougat,