Master Thesis Proposal

1 Problem Statement

Google Mobile Services (GMS) provide essential functionality across the Android ecosystem, supporting privileged features such as location services, push notifications, account management, and integration with Google applications. Their extensive privileges and broad deployment make them an interesting target for security research. However, GMS components are heavily obfuscated and largely undocumented, making it difficult to determine what sensitive functionality they expose and how they handle users’ private information. Investigating their internal behavior can provide valuable insights into the security and privacy of the services running on millions of Android devices every day.

2 Project Plan

1. Literature and Specification Review: The student will study Android platform threat model and previous work on reverse engineering and Android security and privacy.
2. Reverse Engineering: The student will reverse engineer the GMS ona rooted Android smartphone, targeting interesting features (e.g., Earthquake Alert, Wallet, and Health).
3. Attacks and Vulnerabilities: The student will propose attacks on GMS enabled by the vulnerabilities found via reverse engineering (e.g., unauthenticated access to a privileged API).
4. Evaluation and Mitigation: The student will evaluate the GMS attackson multiple real-world Android devices, demonstrating their impact and feasibility, and propose countermeasures to fix them.

3 Ideal Background

You are interested in Android security. This project builds upon research conducted by the supervisor, Marco Casagrande. You will have a chance to test your skills, add an impactful project to your CV, and gain experience with mobile security and reverse engineering. Relevant Skills. Proficiency in programming and scripting languages, such as Python and Java. Basic knowledge of security and privacy, wireless networks, and Android. Optionally, experience with GMS and instrumentation.

4 Thesis Supervisor

Marco Casagrande is a postdoc in cybersecurity at Orebro University. He specializes in Android security and reverse engineering and is passionate about hands-on, hacking-oriented research. In addition to his academic publications, he has been invited to speak at prominent security conferences, including Black Hat USA, DEF CON, and Hardwear.io. He is actively involved in vulnerability research and has reported security issues to technology companies and industry organizations.