Once Root Always a Threat: Analyzing the Security Threats of Android Permission System

Android permission system enforces access control to those privacy-related resources in Android phones. Unfortunately, the permission system could be bypassed when the phone is rooted. On a rooted phone, processes can run with root privilege and can arbitrarily access any resources without permission. Many people are willing to root their Android phones to uninstall pre-installed applications, flash third party ROMs, backup their phones and so on. People use rootkit tools to root their phones. The mainstream rootkit tools in China are provided by some well-known security vendors. Besides root, these vendors also provide the one-click-unroot function to unroot a phone. The unroot process gives users a feeling that their phones will roll back to the original safe state. In this paper, we present the security threats analysis of permission system on phones rooted once and unrooted later. On these phones, two categories of attacks: tampering data files attack and tampering code files attack are carried out. Also, the attacks’ detection rate, damage degree, influence range, and survivability in the real word are analyzed. Analysis result shows even under Antivirus’ monitoring, these attacks towards permission system can still be carried out and survive after the phone is unrooted. Therefore, the permission system faces a long-term compromise. The potential defense solutions are also discussed.