Detection of Side Channel Attacks Based on Data Tainting in Android Systems

Abstract

Part 4: Operating System and Firmware SecurityInternational audienceMalicious third-party applications can leak personal data stored in the Android system by exploiting side channels. TaintDroid uses a dynamic taint analysis mechanism to control the manipulation of private data by third-party apps [9]. However, TaintDroid does not propagate taint in side channels. An attacker can exploit this limitation to get private data. For example, Sarwar et al. [2] present side channel class of attacks using a medium that might be overlooked by the taint-checking mechanism to extract sensitive data in Android system. In this paper, we enhance the TaintDroid system and we propagate taint in side channels using formal policy rules. To evaluate the effectiveness of our approach, we analyzed 100 free Android applications. We found that these applications use different side channels to transfer sensitive data. We successfully detected that $$35\%$$35% of them leaked private information through side channels. Also, we detected Sarwar et al. [2] side channel attacks. Our approach generates $$9\%$$9% of false positives. The overhead given by our approach is acceptable in comparison to the one obtained by TaintDroid (9% overhead)

Watch out! Doxware on the way…

“…Original data can be transformed, for example, by writing its content in a pixel bitmap. However, TaintDroid issues warning reports if tainted data is leaked by an application, even if it was transformed since the taint is propagated through these side channels [25]. A similar tool developed by Sun et al enables a multilevel information flow tracking by utilizing registers for taint storage, having only a 15% overhead on the CPU [44].…”

“…It presents an enhancement of TaintDroid formerly developed in terms of taint storage and resource consumption [17]. Considerable research is being conducted in this field as in [19,25,50,51].…”