  In Android, communications between apps and system services are supported by
a transaction-based Inter-Process Communication (IPC) mechanism. Binder, as the
cornerstone of this IPC mechanism, separates two communicating parties as
client and server. As with any client-server model, the server should not make
any assumption on the validity (sanity) of client-side transaction. To our
surprise, we find this principle has frequently been overlooked in the
implementation of Android system services. In this paper, we demonstrate the
prevalence and severity of this vulnerability surface and try to answer why
developers keep making this seemingly simple mistake. Specifically, we design
and implement BinderCracker, an automatic testing framework that supports
parameter-aware fuzzing and has identified more than 100 vulnerabilities in six
major versions of Android, including the latest version Android 6.0,
Marshmallow. Some of the vulnerabilities have severe security implications,
causing privileged code execution or permanent Denial-of-Service (DoS). We
analyzed the root causes of these vulnerabilities to find that most of them
exist because system service developers only considered exploitations via
public APIs. We thus highlight the deficiency of testing only on client-side
public APIs and argue for the necessity of testing and protection on the Binder
interface - the actual security boundary. Specifically, we discuss the
effectiveness and practicality of potential countermeasures, such as
precautionary testing and runtime diagnostic.
