MN506 System Management: Android Pileup Flaws and Security Analysis

This assignment analyzes the concept of pileup flaws in Android's Package Management Service (PMS). It discusses how these flaws can lead to privilege escalation, potentially allowing malicious applications to compromise device security. The document explains the functionality of the Android sandbox, which isolates application data and execution to enhance security. It also explores the role of the SecUp scanner, a vulnerability scanner used to detect system weaknesses, detailing its architecture and components. The assignment provides insights into the impact of pileup flaws, the benefits of sandboxing for software testing, and the architecture of security tools used to identify vulnerabilities in Android systems. The provided solution is designed to help students understand the concepts of system security in Android devices.

Running head: SYSTEM MANAGEMENT
SYSTEM MANAGEMENT
Name of the Student
Name of the University
Author Note

SYSTEM MANAGEMENT 1
Discussions
1. The escalation of privileges is only made possible due to new kind of weakness known as
pileup flaws. Under proper conditions, updating the android device can enable an attacker
to escalate the privileges of an application can carry out all kinds of harmful activities [1].
A group of researchers has recognized six pileup flaws in the android PMS and that
exposes nearly 1 Billion devices based on Google.
2. The research paper shows that it is possible to use the vulnerabilities of package
management services of android, the collection of tools in order to automate the
procedures of installing, updating, configuring and then removing the packages of
software for the devices of android [2]. The flaws of pileup permit the escalation of
privileges through the procedure of updating. The pileup flaws permit a hacker in order to
escalate, settings and signature for an application that is malicious and it can be utilised in
order to steal the data of the user
3. The application of android sandbox isolates the data of the application and the execution
of code from various other applications. A framework of application with robust
deployments of the security functionality such as permissions, cryptography and secure
IP. The permissions those are granted by user in order to restrict admittance to the
features of the system and the data of the user [3].
Sandboxing safeguards the important architecture of the organization from doubtful code
as it executes in a separate system. It also permits IT in order to test malicious code in an
environment of testing that is isolated in order to understand the way it works in a system
and detect the same attacks of malware.
4. The SecUp scanner is a vulnerability scanner that is used in order to detect the
vulnerability of a system. The architecture of the SecUp scanner consists of the user

2SYSTEM MANAGEMENT
interface, engine of scan, database of scan and the module of report [4]. The user interface
can be either GUI or CLI. The scan engines scan the installed applications and the
plugins. The scan database stores the data needed by the vulnerability scanner and the
module of report provides various reports of the lists of weaknesses.

3SYSTEM MANAGEMENT
References
[1]H. Bagheri, E. Kang, S. Malek and D. Jackson, "A formal approach for detection of
security flaws in the android permission system", Formal Aspects of Computing, vol. 30, no.
5, pp. 525-544, 2017. Available: 10.1007/s00165-017-0445-z.
[2]"Android Security Internals", Network Security, vol. 2015, no. 6, p. 4, 2015. Available:
10.1016/s1353-4858(15)30046-5.
[3]J. Philip and M. Raju, "A Formal Overview of Application Sandbox in Android and iOS
with the Need to Secure Sandbox Against Increasing Number of Malware Attack", Indian
Journal of Computer Science, vol. 4, no. 3, p. 32, 2019. Available:
10.17010/ijcs/2019/v4/i3/146164.
[4]V. Mahajan, "Web Application Vulnerability Scanner", International Journal for
Research in Applied Science and Engineering Technology, vol. 7, no. 6, pp. 386-390, 2019.
Available: 10.22214/ijraset.2019.6066.