Boxify is a lightweight application sandbox for stock Android. Building upon application virtualization and process-based privilege separation, Boxify securely encapsulates untrusted apps in an isolated environment. In contrast to most related work on stock Android, Boxify eliminates the need to modify the code of monitored apps and thereby overcomes existing legal concerns and deployment problems that rewriting-based approaches have been facing. Boxify can be deployed as a regular Android app without firmware modifications or root privileges. For more details, please have a look at the paper.
This research is based on technology invented and developed at Backes SRT GmbH and was published in cooperation with the Center for Information Security, Privacy and Accountability (CISPA) at Saarland University.
Boxify: Full-fledged App Sandboxing for Stock Android
Michael Backes, Sven Bugiel, Christian Hammer, Oliver Schranz, Philipp von Styp-Rekowsky
In Proc. of 24th USENIX Security Symposium (USENIX Security '15), 2015
We present the first concept for full-fledged app sandboxing on stock Android. Our approach is based on application virtualization and process-based privilege separation to securely encapsulate untrusted apps in an isolated environment. In contrast to all related work on stock Android, we eliminate the necessity to modify the code of monitored apps, and thereby overcome existing legal concerns and deployment problems that rewriting-based approaches have been facing. We realize our concept as a regular Android app called Boxify that can be deployed without firmware modifications or root privileges. A systematic evaluation of Boxify demonstrates its capability to enforce established security policies without incurring a significant runtime performance overhead.
The Boxify framework will be made freely available for academic and non-commercial use by Backes SRT GmbH. For more information regarding the source code release, please have a look at their project website.
If you want to be notified when the framework is ready for release, please enter your email address below. We will not use your email address for any other purposes.