2023/12/13 Council Agenda Packet

Rootkits on Smart Phones: Attacks, Implications and Opportur o n ❑ Jeffrey Bickford Ryan Ol=aret Arati Baligat Vinod Ganapathy Liv o rode Department of Computer Science, Rutgers University ABSTRACT Smart phones are increasingly being equipped with operating sys- tems that compare in complexity with those on desktop comput- ers. This trend makes smart phone operating systems vulnerable to many of the same threats as desktop operating systems. In this paper, we focus on the threat posed by smart phone rootk- its. Rootkits are malware that stealthily modify operating system code and data to achieve malicious goals, and have long been a problem for desktops. We use three example rootkits to show that smart phones are just as vulnerable to rootkits as desktop operating systems. However, the ubiquity of smart phones and the unique interfaces that they expose, such as voice, GPS and battery, make the social consequences of rootkits particularly devastating. We conclude the paper by identifying the challenges that need to be addressed to effectively detect rootkits on smart phones. Categories and Subject Descriptors: C.2.0 [Computer -communication networks] : General —Security and Protection; D.4.6 [Operating Systems]: Security and Protection Invasive soft- ware (e.g., viruses, worms, Trojan horses) General Terms: Experimentation, Security Keywords: rootkits, smart phones 1. INTRODUCTION Over the last several years, the decreasing cost of advanced com- puting and communication hardware has allowed mobile phones to evolve into general-purpose computing platforms. Over 115 mil- lion such smart phones were sold worldwide in 2007 M. These phones are equipped with a rich set of hardware interfaces and application programs that let users interact better with the cyber and the physical worlds. For example, smart phones are often pre -installed with a number of applications, including clients for location -based services and general-purpose web browsers. These applications utilize hardware features such as GPS and enhanced network access via 3G or r WimaTc . To support the increasing com- plexity of software and hardware on smart -phones, smart phone operating systems have similarly evolved. Modern smart phones typically run complex operating 'systems, such as Linux, Windows Mobile, Android and Symbian OS, which comprise tens of millions of lines of code. `This work was supported in part by NSF grants CNS-0831268, CNS- 0915394, CNS-0931992, a grant from the US Army-RDECOM CERDEC, and a Rutgers University Computing Coordination Council grant. t Current affiliation: BAE Systems, Wayne, NJ. *Current of iation: W1NLAB, Rutgers University. Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. To copy otherwise, to republish, to post on servers or to redistribute to lists, requires prior specific permission and/or a fee. HotMobile'10, February 22-23, 2010, Annapolis, Maryland, USA. Copyright (3 2010 ACM 978-1-4503-0005-6/10/02 ...$10.00. The increasing complexity of smart phones has also increased their vulnerability to attacks. Recent years have witnessed the emer- gence of mobile malware, which are viruses and worms that infect smart phones. For instance, F-Secure reported an almost 400% increase in mobile malware within a two year period from 2005- 2007 [17]. Mobile malware typically use many of the same attack vectors as do malware for traditional computing infrastructures, but often spread via interfaces and services unique to smart phones, in- cluding Bluetooth, SMS and MMS. The Cabir worm, for instance, exploited a vulnerability in the Bluetooth interface and replicated itself to other Bluetooth enabled phones. Recent research has also explored the security implications of connecting smart phones to the Internet: Enck et al. [14] demonstrated attacks that could com= promise open interfaces for SMS (e.g., web sites that allow users to send SMS messages) to cripple large portions of a cellular network. In this paper, we show that smart phones are just as vulnerable as desktop operating systems to kernel -level rootkits (or simply, rootk- its). Rootkits are malware that achieve their malicious goals by in- fecting the operating system. For example, rootkits may be used to hide malicious user space files and processes, install Trojan horses, and disable firewalls and virus scanners. Rootkits can achieve their malicious goals stealthily because they affect the operating system, which is typically considered the trusted computing base. Conse- quently, they can retain longer term control over infected machines. Stealth techniques adopted by rootkits have become popular among malware writers, with a study by MacAfee reporting a nearly 600% increase in rootkits in the three-year period from 2004-2006 [9]. The fact that smart phones are vulnerable to rootkits should not be particularly surprising. However, smart phone rootldts can ac- cess a number of unique interfaces and information that are not normally available on desktop computers. These include GPS, the battery, and voice and messaging. As we demonstrate via three attacks (in Section 3), such interfaces provide rootkits with new attack vectors to compromise privacy and security of end users. Moreover, phones are personal devices and contain numerous ap- plications that store sensitive information about their users. For example, smart phones contain contact information and SMS con- versations for people that a user normally converses with. Such information is potentially of value to attackers, and is often not available on desktop machines. Similarly, employees with com- pany phones could potentially store confidential commercial infor- mation in emails located on their smart phones. With 3G and 4G access becoming increasingly ubiquitous, smart phone users have easy access to the Internet and email. As a result, there is a sharp increase in the number of services and applications available for smart phones. In 2008, Bank of America reported that they service over four million mobile banking sessions every month. They also reported that there are over one million unique users using their mobile banking services[20]. Online retailers such as Amazon.com provide mobile websites and mobile applications, so that users can purchase items from their smart phones. Smart phone rootkits can therefore compromise privacy and security in novel ways, while also being extremely difficult to detect. Detecting and recovering from rootkits is challenging, even on desktop systems. Because rootkits affect the operating system, any 1