arXiv subjects

Kang G. Shin

Publications and source records attributed to Kang G. Shin.

39 records · Page 3Linked to original sources

arXiv2016

BinderCracker: Assessing the Robustness of Android System Services

In Android, communications between apps and system services are supported by a transaction-based Inter-Process Communication (IPC) mechanism. Binder, as the cornerstone of this IPC mechanism, separates two communicating parties as client and server. As with any client-server model, the server should not make any assumption on the validity (sanity) of client-side transaction. To our surprise, we find this principle has frequently been overlooked in the implementation of Android system services. In this paper, we demonstrate the prevalence and severity of this vulnerability surface and try to answer why developers keep making this seemingly simple mistake. Specifically, we design and implement BinderCracker, an automatic testing framework that supports parameter-aware fuzzing and has identified more than 100 vulnerabilities in six major versions of Android, including the latest version Android 6.0, Marshmallow. Some of the vulnerabilities have severe security implications, causing privileged code execution or permanent Denial-of-Service (DoS). We analyzed the root causes of these vulnerabilities to find that most of them exist because system service developers only considered exploitations via public APIs. We thus highlight the deficiency of testing only on client-side public APIs and argue for the necessity of testing and protection on the Binder interface - the actual security boundary. Specifically, we discuss the effectiveness and practicality of potential countermeasures, such as precautionary testing and runtime diagnostic.

cs.CR↗

arXiv2013

Plan Development using Local Probabilistic Models

Approximate models of world state transitions are necessary when building plans for complex systems operating in dynamic environments. External event probabilities can depend on state feature values as well as time spent in that particular state. We assign temporally -dependent probability functions to state transitions. These functions are used to locally compute state probabilities, which are then used to select highly probable goal paths and eliminate improbable states. This probabilistic model has been implemented in the Cooperative Intelligent Real-time Control Architecture (CIRCA), which combines an AI planner with a separate real-time system such that plans are developed, scheduled, and executed with real-time guarantees. We present flight simulation tests that demonstrate how our probabilistic model may improve CIRCA performance.

cs.AI↗

arXiv2011

Attack Prevention for Collaborative Spectrum Sensing in Cognitive Radio Networks

Collaborative spectrum sensing can significantly improve the detection performance of secondary unlicensed users (SUs). However, the performance of collaborative sensing is vulnerable to sensing data falsification attacks, where malicious SUs (attackers) submit manipulated sensing reports to mislead the fusion center's decision on spectrum occupancy. Moreover, attackers may not follow the fusion center's decision regarding their spectrum access. This paper considers a challenging attack scenario where multiple rational attackers overhear all honest SUs' sensing reports and cooperatively maximize attackers' aggregate spectrum utilization. We show that, without attack-prevention mechanisms, honest SUs are unable to transmit over the licensed spectrum, and they may further be penalized by the primary user for collisions due to attackers' aggressive transmissions. To prevent such attacks, we propose two novel attack-prevention mechanisms with direct and indirect punishments. The key idea is to identify collisions to the primary user that should not happen if all SUs follow the fusion center's decision. Unlike prior work, the proposed simple mechanisms do not require the fusion center to identify and exclude attackers. The direct punishment can effectively prevent all attackers from behaving maliciously. The indirect punishment is easier to implement and can prevent attacks when the attackers care enough about their long-term reward.

cs.CR↗