Android’s permission model is designed around two fundamental guarantees: applications should obtain user consent before accessing sensitive resources, and users should be able to revoke that access. However, device manufacturers can extensively customize Android’s framework, potentially changing these guarantees in ways that are largely invisible to users.

In this talk, I will present our large-scale study of how these customizations affect Android’s access-control model. By analyzing over 5,000 firmware images, we uncover cases where Android’s standard access-control rules are altered or bypassed. These include sensitive permissions being granted without explicit user consent and access persisting even after a permission is revoked. We also investigate which applications benefit from these customizations and demonstrate on real devices how weak identity checks can allow unintended applications to obtain privileged access.

Finally, I will discuss how this work led us to explore other parts of Android’s security architecture. Our ongoing work examines lower-level access control, including SELinux, and how inconsistencies between different security layers can create unexpected paths to sensitive resources.

About Vinuri Bandara

Vinuri Bandara is a final-year PhD researcher in the Internet Analytics Group at IMDEA Networks Institute, supervised by Dr. Narseo Vallina-Rodríguez. Her research focuses on Android systems security, particularly the security implications of OEM customizations across the Android software stack, including framework-level access control and system security policies. Her work combines large-scale firmware analysis with static, dynamic, and differential analysis of OEM implementations. She is a Google PhD Fellow in Privacy, Safety, and Security, and her research has been published at venues including IEEE Transactions on Dependable and Secure Computing (TDSC), IEEE EuroS&P, PETS, ACM CCS, and IEEE SCAM. Her latest work on access-control subversions in Android has been accepted at NDSS 2027.

Este evento se impartirá en inglés