PRAST: Using Logic Bombs to Exploit the Android Permission Model and a Module Based Solution

© 2018 IEEE. Android security implements a permission model to protect a user\u27s most sensitive data. These permissions regulate an app\u27s access to different aspects of the device, however, a fatal flaw of Android\u27s permission model is that it relies on the discretion of the user to determine which apps are granted permissions and which are not with limited assistance in their choice from the device. As a result, a specialized type of malware known as a logic bomb has affected Android devices. These logic bombs are designed to execute malicious code when activated by triggers, and can be designed to take advantage of users who poorly vet their applications or even hide themselves inside applications that appear to be benign. On Android, logic bombs usually carry out malicious intent by violating permissions, using a permission for some activity the user never intended. We have found 18 different permissions that applications can violate to carry out some form of malicious intent, and have developed an app, called HyenaDroid, to violate each of these permissions and create logic bombs. This provides evidence that the current Android security revolving around permissions is in need of either an update to the permissions model, or an additional system to assist the user with navigating the Android permissions model. Our research also proposes such a system, PRAST. PRAST is designed as a modular system, combining a level of efficiency that can be run during the download on an Android device, along with the effectiveness and accuracy of external analysis systems

Acute stroke management in the local general hospital.

Background and Purpose —The majority of stroke patients are treated in local general hospitals. Despite this fact, little is known about stroke care in these institutions. We sought to investigate the status quo of acute stroke management in nonspecialized facilities with limited equipment and resources. Methods —Four general hospitals located in smaller cities of a rural area in Germany participated in this study. The 4 hospitals were similar in structure and technical equipment; none had a CT scanner in-house. We reviewed the medical records of every stroke patient hospitalized in 1 of the 4 hospitals within a period of 8 weeks within 1 year. Results —We collected data of a total of 95 patients at all 4 hospitals. The frequency of diagnostic tests was low: at least 1 CT scan was obtained in only 36.8% of all cases, whereas diagnostic methods available in-house were used more frequently, such as Doppler ultrasound (49.0%), echocardiography (42.3%), and 24-hour ECG registration (48.4%). Each hospital had a different therapeutic approach. Main therapeutic options were the use of pentoxyfilline (0% to 90.5%), osmodiuretics (0% to 90%), piracetam (0% to 93.3%), and hydroxyethylstarch (4.8% to 30%). Medication for long-term secondary prevention was given to 69.8% of all patients. Conclusions —This study provides one of the few data samples reflecting stroke care in smaller general hospitals. The findings demonstrate a partially suboptimal level of care in these institutions. To achieve future improvements, extended human and technical resources as well as research for stroke care should not be restricted to academic stroke centers. </jats:p