LeakMiner: Detect Information Leakage on Android with Static Taint Analysis

Yang, Zhijun; Yang, Min

doi:10.1109/wcse.2012.26

Cited by 152 publications

(82 citation statements)

References 5 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Multiple prior works use static analysis to detect intracomponent privacy leaks in Android apps [7], [22], [26], [35], [47]. AndroidLeaks [22] and LeakMiner [47] state the ability to handle the Android lifecycle including callback methods, but the two tools are not context-sensitive which precludes the precise analysis of many practical scenarios.…”

Section: Related Workmentioning

confidence: 99%

See 1 more Smart Citation

IccTA: Detecting Inter-Component Privacy Leaks in Android Apps

Bartel

Bissyandé³

et al. 2015

2015 IEEE/ACM 37th IEEE International Conference on Software Engineering

390

360

View full text Add to dashboard Cite

Abstract-Shake Them All is a popular "Wallpaper" application exceeding millions of downloads on Google Play. At installation, this application is given permission to (1) access the Internet (for updating wallpapers) and (2) use the device microphone (to change background following noise changes). With these permissions, the application could silently record user conversations and upload them remotely. To give more confidence about how Shake Them All actually processes what it records, it is necessary to build a precise analysis tool that tracks the flow of any sensitive data from its source point to any sink, especially if those are in different components.Since Android applications may leak private data carelessly or maliciously, we propose IccTA, a static taint analyzer to detect privacy leaks among components in Android applications. IccTA goes beyond state-of-the-art approaches by supporting intercomponent detection. By propagating context information among components, IccTA improves the precision of the analysis. IccTA outperforms existing tools on two benchmarks for ICC-leak detectors: DroidBench and ICC-Bench. Moreover, our approach detects 534 ICC leaks in 108 apps from MalGenome and 2,395 ICC leaks in 337 apps in a set of 15,000 Google Play apps.

show abstract

Section: Related Workmentioning

confidence: 99%

“…AndroidLeaks [22] and LeakMiner [47] state the ability to handle the Android lifecycle including callback methods, but the two tools are not context-sensitive which precludes the precise analysis of many practical scenarios. However, those tools are not able to detect ICC leaks.…”

Section: Related Workmentioning

confidence: 99%

IccTA: Detecting Inter-Component Privacy Leaks in Android Apps

Bartel

Bissyandé³

et al. 2015

2015 IEEE/ACM 37th IEEE International Conference on Software Engineering

390

360

View full text Add to dashboard Cite

show abstract

“…As these results illustrate, DroidSafe implements an analysis of unprecedented accuracy and precision. To the best of our knowledge, DroidSafe provides the first usable information-flow analysis for Android applications [7][8][9][10][11][12][13][14].…”

Section: Droidsafementioning

confidence: 99%

“…SCanDroid [11] resolves data flows between components using a limited model of Android, and conservative flow policies for API methods. LeakMiner [12] tracks flows with a context-insensitive analysis. AndroidLeaks [13] combines both context-sensitive and context insensitive analyses, but models flows through API methods with a blanket policy that reduces precision.…”

Section: Related Workmentioning

confidence: 99%

“…Static analysis frameworks attempt to analyze the application before it executes to discover all potential sensitive flows [7][8][9][10][11][12][13]. Standard issues that complicate the construction of such systems are the challenges of 1) scaling to large applications and 2) maintaining precision in the analysis such that it does not report too many flows that do not actually exist in the application.…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Information-Flow Analysis of Android Applications in DroidSafe

Gordon

Kim

Perkins

et al. 2015

Proceedings 2015 Network and Distributed System Security Symposium

333

202

View full text Add to dashboard Cite

Abstract-We present DroidSafe, a static information flow analysis tool that reports potential leaks of sensitive information in Android applications. DroidSafe combines a comprehensive, accurate, and precise model of the Android runtime with static analysis design decisions that enable the DroidSafe analyses to scale to analyze this model. This combination is enabled by accurate analysis stubs, a technique that enables the effective analysis of code whose complete semantics lies outside the scope of Java, and by a combination of analyses that together can statically resolve communication targets identified by dynamically constructed values such as strings and class designators.Our experimental results demonstrate that 1) DroidSafe achieves unprecedented precision and accuracy for Android information flow analysis (as measured on a standard previously published set of benchmark applications) and 2) DroidSafe detects all malicious information flow leaks inserted into 24 real-world Android applications by three independent, hostile Red-Team organizations. The previous state-of-the art analysis, in contrast, detects less than 10% of these malicious flows.

show abstract

Analytical Overview on Secure Information Flow in Android Systems: Protecting Private Data Used by Smartphone Applications

Graa¹

2019

Cyber‐Vigilance and Digital Trust

View full text Add to dashboard Cite

LeakMiner: Detect Information Leakage on Android with Static Taint Analysis

Cited by 152 publications

References 5 publications

IccTA: Detecting Inter-Component Privacy Leaks in Android Apps

IccTA: Detecting Inter-Component Privacy Leaks in Android Apps

Information-Flow Analysis of Android Applications in DroidSafe

Analytical Overview on Secure Information Flow in Android Systems: Protecting Private Data Used by Smartphone Applications

Contact Info

Product

Resources

About