No Pardon for the Interruption: New Inference Attacks on Android Through Interrupt Timing Analysis

Diao, Wenrui; Liu, Xiangyu; Zhou, Li; Zhang, Kehuan

doi:10.1109/sp.2016.32

Cited by 50 publications

(72 citation statements)

References 23 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Side channels on Android mobile devices have been extensively studied in the past [31], [36], [42], [45], [66], [67], however, little or even no attention has been paid to iOS crossapp side channels. In this section, we first briefly introduce the cross-app isolation on iOS.…”

Section: Background: Ios Cross-app Isolationmentioning

confidence: 99%

“…Prior studies that analyze side-channel data traces for inference attacks typically only utilize one data trace to perform the attacks [32], [36], [41], [48], [50], [53]. In these attacks, a single side-channel trace is typically sufficient for the intended attack goals.…”

Section: Attack 1: Classifying User Activitiesmentioning

confidence: 99%

“…Zhang et al [65] explored similar channels from procfs to fingerprint user behavior through the Android apps of IP cameras. Most recently, Diao et al [36] studied the use of global interrupt counters in procfs to infer the user's unlock patterns and foreground apps.…”

Section: Related Workmentioning

confidence: 99%

“…Security of such mobile systems has been widely studied in the past decade, mostly in the context of Android [31], [36], [42], [45], [66], [67], with some limited effort on iOS [34], [37]. Of particular interest here are a series of side-channel attacks, which empower an untrusted third-party app (e.g., free games) to infer private user information by monitoring the execution of OS services or trusted apps (e.g., banking apps).…”

Section: Introductionmentioning

confidence: 99%

“…So far, this line of research has only been conducted on Android, with numerous studies [31], [36], [42], [45], [64], [67] showing that the OS and its underlying Linux kernel fail to properly control the information leaks from seemingly harmless sourcesprocfs, a pseudo filesystem available on UNIX-like operating systems (including Android) to export some kernel statistics (e.g., virtual and physical memory, CPU and network usage) to the user space. These statistics can be classified into two categories: per-process statistics and global statistics.…”

Section: Introductionmentioning

confidence: 99%

See 4 more Smart Citations

OS-level Side Channels without Procfs: Exploring Cross-App Information Leakage on iOS

Zhang¹,

Wang²,

Bai³

et al. 2018

Proceedings 2018 Network and Distributed System Security Symposium

View full text Add to dashboard Cite

Abstract-It has been demonstrated in numerous previous studies that Android and its underlying Linux operating systems do not properly isolate mobile apps to prevent cross-app sidechannel attacks. Cross-app information leakage enables malicious Android apps to infer sensitive user data (e.g., passwords), or private user information (e.g., identity or location) without requiring specific permissions. Nevertheless, no prior work has ever studied these side-channel attacks on iOS-based mobile devices. One reason is that iOS does not implement procfsthe most popular side-channel attack vector; hence the previously known attacks are not feasible.In this paper, we present the first study of OS-level sidechannel attacks on iOS. Specifically, we identified several new side-channel attack vectors (i.e., iOS APIs that enable cross-app information leakage); developed machine learning frameworks (i.e., classification and pattern matching) that combine multiple attack vectors to improve the accuracy of the inference attacks; demonstrated three categories of attacks that exploit these vectors and frameworks to exfiltrate sensitive user information. We have reported our findings to Apple and proposed mitigations to the attacks. Apple has incorporated some of our suggested countermeasures into iOS 11 and MacOS High Sierra 10.13 and later versions.

show abstract