Cracking the Core: Hardware Vulnerabilities in Android Devices Unveiled

被引:2
作者
Munoz, Antonio [1 ]
机构
[1] Univ Malaga, Network Informat & Comp Secur Lab NICS, Malaga 29071, Spain
关键词
Android hardware vulnerabilities; mobile device security; system-on-chip (SoC) security; trusted execution environment (TEE); hardware vulnerability mitigations; side-channel attacks;
D O I
10.3390/electronics13214269
中图分类号
TP [自动化技术、计算机技术];
学科分类号
0812 ;
摘要
As Android devices become more prevalent, their security risks extend beyond software vulnerabilities to include critical hardware weaknesses. This paper provides a comprehensive and systematic review of hardware-related vulnerabilities in Android systems, which can bypass even the most sophisticated software defenses. We compile and analyze an extensive range of reported vulnerabilities, introducing a novel categorization framework to facilitate a deeper understanding of these risks, classified by affected hardware components, vulnerability type, and the potential impact on system security. The paper addresses key areas such as memory management flaws, side-channel attacks, insecure system-on-chip (SoC) resource allocation, and cryptographic vulnerabilities. In addition, it examines feasible countermeasures, including hardware-backed encryption, secure boot mechanisms, and trusted execution environments (TEEs), to mitigate the risks posed by these hardware threats. By contextualizing hardware vulnerabilities within the broader security architecture of Android devices, this review emphasizes the importance of hardware security in ensuring system integrity and resilience. The findings serve as a valuable resource for both researchers and security professionals, offering insights into the development of more robust defenses against the emerging hardware-based threats faced by Android devices.
引用
收藏
页数:26
相关论文
共 67 条
  • [1] Abdullah H., 2022, P 2 INT C INF TECHN
  • [2] Don't CWEAT It: Toward CWE Analysis Techniques in Early Stages of Hardware Design
    Ahmad, Baleegh
    Liu, Wei-Kai
    Collini, Luca
    Pearce, Hammond
    Fung, Jason M.
    Valamehr, Jonathan
    Bidmeshki, Mohammad
    Sapiecha, Piotr
    Brown, Steve
    Chakrabarty, Krishnendu
    Karri, Ramesh
    Tan, Benjamin
    [J]. 2022 IEEE/ACM INTERNATIONAL CONFERENCE ON COMPUTER AIDED DESIGN, ICCAD, 2022,
  • [3] [Anonymous], 2009, Offensive Security Exploit Database (Exploit-DB)
  • [4] Arora D., 2024, arXiv
  • [5] ARTist: The Android Runtime Instrumentation and Security Toolkit
    Backes, Michael
    Bugiel, Sven
    Schranz, Oliver
    von Styp-Rekowsky, Philipp
    Weisgerber, Sebastian
    [J]. 2017 IEEE EUROPEAN SYMPOSIUM ON SECURITY AND PRIVACY (EUROS&P), 2017, : 481 - 495
  • [6] Chamornmarn T., 2019, P 2019 IEEE 6 AS C D, P1
  • [7] IP-Tag: Tag-Based Runtime 3PIP Hardware Trojan Detection in SoC Platforms
    Chen, Kejun
    Arias, Orlando
    Guo, Xiaolong
    Deng, Qingxu
    Jin, Yier
    [J]. IEEE TRANSACTIONS ON COMPUTER-AIDED DESIGN OF INTEGRATED CIRCUITS AND SYSTEMS, 2023, 42 (01) : 68 - 81
  • [8] Christey S., 2013, Common weakness enumeration
  • [9] Computer Emergency Response Team (CERT), 1988, CERT Vulnerability Database
  • [10] cwe.mitre, CWE-1240: Use of a Cryptographic Primitive with a Risky Implementation