Leave Me Alone: App-Level Protection against Runtime Information Gathering on Android

Abstract

Stealing of sensitive information from apps is always considered to be one of the most critical threats to Android security. Recent studies show that this can happen even to the apps without explicit implementation flaws, through exploiting some design weaknesses of the operating system, e.g., shared communication channels such as Bluetooth, and side channels such as memory and network-data usages. In all these attacks, a malicious app needs to run side-by-side with the target app (the victim) to collect its runtime information. Examples include recording phone conversations from the phone app, gathering WebMD's data usages to infer the disease condition the user looks at, etc. This runtime-information-gathering (RIG) threat is realistic and serious, as demonstrated by prior research and our new findings, which reveal that the malware monitoring popular Android-based home security systems can figure out when the house is empty and the user is not looking at surveillance cameras, and even turn off the alarm delivered to her phone.To defend against this new category of attacks, we propose a novel technique that changes neither the operating system nor the target apps, and provides immediate protection as soon as an ordinary app (with only normal and dangerous permissions) is installed. This new approach, called App Guardian, thwarts a malicious app's runtime monitoring attempt by pausing all suspicious background processes when the target app (called principal) is running in the foreground, and resuming them after the app stops and its runtime environment is cleaned up. Our technique leverages a unique feature of Android, on which thirdparty apps running in the background are often considered to be disposable and can be stopped anytime with only a minor performance and utility implication. We further limit such an impact by only focusing on a small set of suspicious background apps, which are identified by their behaviors inferred from their side channels (e.g., thread names, CPU scheduling and kernel time). App Guardian is also carefully designed to choose the right moments to start and end the protection procedure, and effectively protect itself against malicious apps. Our experimental studies show that this new technique defeated all known RIG attacks, with small impacts on the utility of legitimate apps and the performance of the OS. Most importantly, the idea underlying our approach, including app-level protection, side-channel based defense and lightweight response, not only significantly raises the bar for the RIG attacks and the research on this subject but can also inspire the follow-up effort on new detection systems practically deployable in the fragmented Android ecosystem.

OS-level Side Channels without Procfs: Exploring Cross-App Information Leakage on iOS

“…An alternative approach is to monitor the use of the leaky APIs while some sensitive apps are running in the foreground. This idea has been illustrated in Android by Zhang et al [65] on Android using a non-privileged guardian app. Due to the more strict cross-app isolation on iOS, however, this task can only be accomplished by the system itself on iOS.…”

“…Lin et al [45] employed procfs to extract an app's CPU usage to detect user's key press operation on Android. Zhang et al [65] explored similar channels from procfs to fingerprint user behavior through the Android apps of IP cameras. Most recently, Diao et al [36] studied the use of global interrupt counters in procfs to infer the user's unlock patterns and foreground apps.…”

Using IM-Visor to stop untrusted IME apps from stealing sensitive keystrokes

“…It replaces the original peripheral drivers by a remote update when a user enters restricted spaces such as a federal building, and doesn't cancel the enforcement of usage policies until the user checks out. App Guardian (Zhang et al 2015) thwarts the runtime-information-gathering of malicious apps by blocking the runtime monitoring attempt. To realize this, App Guardian pauses the malicious app when sensitive app is running.…”

What Mobile Ads Know About Mobile Users

“…Zhang et al focus on side-channel leaks and propose an application-level monitor that prevents background processes from collecting privacy-sensitive information [56]. This defense does not protect against AdSDKs that openly send location data over the network, nor against mobile ads that run in the foreground.…”