Abstract:
Android Rooting refers to making the target application perform privileged operations (as root user) by exploiting system vulnerabilities or flashing devices. Some user might root their devices to customize devices or run the Apps that require root privileges. Unfortunately, rooting a device will introduce some serious security risks. Attackers' application can perform malicious actions by requesting root privileges, such as installing malicious application stealthy, stealing user sensitive data and tempering the application. Considering the security risks, Android platform vendor (Google) and some sensitive applications developers don't want the device to be rooted. Consequently, Google developed Root detection mechanisms in platform level. However, the security of these Root detection mechanisms is still unclear. To analyze the evadable ability of their detection by sophisticated Root methods, the reverse engineering techniques were employed to investigate the security of the Root detection mechanism. Analyzing the implementation of some popular Root detection mechanisms, the weakness was found based on the Root technical principle. Some attack experiments were carried out to demonstrate a number of Root detection mechanisms. Results show that, the Root detection mechanism developed by Google possesses a high security risk, and the proposed Root methods can evade the attacks successfully. And this work implies that the security of the current Root detection mechanisms should be further improved.