| Android operating system is used widely and has attracted much more attentions because of its open source characteristic.But due to the system vulnerabilities,criminals use it to improve its application permissions,collect or disclose users’ personal information illegally,and even complete control the users’ equipment.For instance,junk calls and messages have disturbed people’s normal life.What’s more,telecom fraud have cause property damage seriously,all of these attribute to information leakage.Therefore,research the testing and exploiting method of Android system vulnerabilities is of far-reaching significance,wherever in commercial value,individual information protection and property safety.This topic on the basis of studying the Android application layer security mechanism,and then propose the standard of Android security development and test.In the further study,the writer focus on the security mechanisms and the exploit buffer mechanisms in Android system level,proposes the methodological theory of exploiting vulnerabilities in the Android version between 4.1.2 and 6.0.1 and writes exploit codes.In the view of application in the Android application software market lack of one can testing vulnerabilities,a vulnerability detection tool called VTS be designed and implemented.VTS based on two methods of vulnerability detection which proposed in this paper for the theoretical basis of vulnerability detection,one is based on the vulnerability itself characteristics,and another is binary detection method based on vulnerabilities’ ID.VTS has solved the problem that using PoC methods have the shortcomings of low efficiency,big workload and poor stability.After testing exploit codes of CVE-2014-7911&CVE-2014-4322,CVE-2015-3636 and CVE-2015-1805 on 19 models which system version between 4.1.2 and 6.0.1,the writer find the combinations of those vulnerabilities can get privilege escalation on all the models in theory.However,it needs to be modified appropriately due to hard coding problems when only use single vulnerability’s exploit codes.Up to now,vulnerability detection tool VTS has add detection codes of 93 vulnerabilities,besides the certain models of Google and national OEM have been tested.Through the test,the writer find that VTS operates fluently,and the detection speed is fast.After modifying codes for target models,the Error Rate can be controlled effectively.It can meet the requirement of the domestic manufacturers to test their system’s patches released level on a regular basis and the purpose of user to understand their own equipment safety. |
