PatchDroid: Scalable Third-Party Security Patches for Android Devices

Android is currently the largest mobile platform with around 750 million devices worldwide. Unfortunately, more than 30 % of all devices contain publicly known security vulnera-bilities and, in practice, cannot be updated through normal mechanisms since they are not longer supported by the man-ufacturer and mobile operator. This failure of traditional patch distribution systems has resulted in the creation of a large population of vulnerable mobile devices. In this paper, we present PatchDroid, a system to dis-tribute and apply third-party security patches for Android. Our system is designed for device-independent patch cre-ation, and uses in-memory patching techniques to address vulnerabilities in both native and managed code. We created a fully usable prototype of PatchDroid, including a number of patches for well-known vulnerabilities in Android devices. We evaluated our system on different devices from multiple manufacturers and show that we can effectively patch se-curity vulnerabilities on Android devices without impacting performance or usability. Therefore, PatchDroid represents a realistic path towards dramatically reducing the number of exploitable Android devices in the wild. 1