一句话：基于 6261 个固件镜像与 602 个 CVE 的大规模测量，揭示 Android 固件生态的补丁延迟、缺失与预装应用漏洞。
Android 凭借开放性占据超过 85% 的市场份额，但定制与碎片化也带来严重安全风险。已有工作多聚焦于分析工具设计或固件的单个侧面，缺乏对整个固件生态的大规模全景认识。本文构建 AndScanner 框架，自动化完成 ROM 爬取、解析、补丁分析与预装应用分析，并对来自 153 个厂商的 6,261 个固件镜像与 602 个 Android 相关 CVE 展开综合测量，围绕漏洞、补丁、安全更新和预装应用等研究问题进行分析。结果显示补丁延迟与缺失问题普遍存在，分别影响 24.2% 与 6.1% 的镜像；多款手机的最新镜像仍包含存在已公开漏洞的预装应用。作者进一步通过案例研究剖析成因，并借助框架发现 38 个可转化为真实攻击的新漏洞，其中 32 个已获 CVE/CNVD 编号。
Android is the most popular smartphone platform with over 85% market share. Its success is built on openness, and phone vendors can utilize the Android source code to make products with unique software/hardware features. On the other hand, the fragmentation and customization of Android also bring many security risks that have attracted the attention of researchers. Many efforts were put in to investigate the security of customized Android firmware. However, most of the previous work focuses on designing efficient analysis tools or analyzing particular aspects of the firmware. There still lacks a panoramic view of Android firmware ecosystem security and the corresponding understandings based on large-scale firmware datasets. In this work, we made a large-scale comprehensive measurement of the Android firmware ecosystem security. Our study is based on 6,261 firmware images from 153 vendors and 602 Android-related CVEs, which is the largest Android firmware dataset ever used for security measurements. In particular, our study followed a series of research questions, covering vulnerabilities, patches, security updates, and pre-installed apps. To automate the analysis process, we designed a framework, AndScanner, to complete ROM crawling, ROM parsing, patch analysis, and app analysis. Through massive data analysis and case explorations, several interesting findings are obtained. For example, the patch delay and missing issues are widespread in Android images, say 24.2% and 6.1% of all images, respectively. The latest images of several phones still contain vulnerable pre-installed apps, and even the corresponding vulnerabilities have been publicly disclosed. In addition to data measurements, we also explore the causes behind these security threats through case studies and demonstrate that the discovered security threats can be converted into exploitable vulnerabilities via 38 newfound vulnerabilities by our framework, 32 of which have been assigned CVE/CNVD numbers. This study provides much new knowledge of the Android firmware ecosystem with deep understanding of software engineering security practices.
@inproceedings{HouDWLLYGLND22,
title = {Large-scale security measurements on the android firmware ecosystem},
author = {Qinsheng Hou and Wenrui Diao and Yanhao Wang and Xiaofeng Liu and Song Liu and Lingyun Ying and Shanqing Guo and Yuanzhi Li and Meining Nie and Haixin Duan},
booktitle = {ICSE},
year = {2022},
doi = {10.1145/3510003.3510072}
}