Resolving the Predicament of Android Custom Permissions

Tuncay, Guliz Seray; Demetriou, Soteris; Ganju, Karan; Gunter, Carl A.

doi:10.14722/ndss.2018.23210

Cited by 36 publications

(24 citation statements)

References 11 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…We are aiming to identify disclosed use of permissions and APIs [36] instead of detecting maliciously hidden information flows and service invocations. In this context Tuncay et al [58] found that the coexistence of certain app permissions can lead to unintentional loss of privacy. Our focus also differs from the goal of tools like DroidSafe [22] and ISA [25].…”

Section: Android App Analysismentioning

confidence: 99%

MAPS: Scaling Privacy Compliance Analysis to a Million Apps

Zimmeck

Story

Smullen

et al. 2019

Proceedings on Privacy Enhancing Technologies

124

159

View full text Add to dashboard Cite

The app economy is largely reliant on data collection as its primary revenue model. To comply with legal requirements, app developers are often obligated to notify users of their privacy practices in privacy policies. However, prior research has suggested that many developers are not accurately disclosing their apps’ privacy practices. Evaluating discrepancies between apps’ code and privacy policies enables the identification of potential compliance issues. In this study, we introduce the Mobile App Privacy System (MAPS) for conducting an extensive privacy census of Android apps. We designed a pipeline for retrieving and analyzing large app populations based on code analysis and machine learning techniques. In its first application, we conduct a privacy evaluation for a set of 1,035,853 Android apps from the Google Play Store. We find broad evidence of potential non-compliance. Many apps do not have a privacy policy to begin with. Policies that do exist are often silent on the practices performed by apps. For example, 12.1% of apps have at least one location-related potential compliance issue. We hope that our extensive analysis will motivate app stores, government regulators, and app developers to more effectively review apps for potential compliance issues.

show abstract

Section: Android App Analysismentioning

confidence: 99%

MAPS: Scaling Privacy Compliance Analysis to a Million Apps

Zimmeck

Story

Smullen

et al. 2019

Proceedings on Privacy Enhancing Technologies

124

159

View full text Add to dashboard Cite

show abstract

“…A considerable portion of these focused on application permissions since they are important with respect to both privacy and security [23], [24], [25]. Custom permissions were also studied [26]. We note that when applications are pre-installed, users do not have a change to grant or deny dangerous application permissions [27] as they normally can do.…”

Section: Related Workmentioning

confidence: 99%

Should Users Trust Their Android Devices? A Scoring System for Assessing Security and Privacy Risks of Pre-Installed Applications

Ozbay¹,

Biçakcı²

2022

Preprint

View full text Add to dashboard Cite

Most users have no idea that their Android devices are equipped with many pre-installed applications which have the capability of tracking and monitoring them. Although applications coming pre-installed pose a great danger to user security and privacy, they have received little attention so far among researchers in the field. In this study, we collect a dataset comprising such applications and make it publicly available.Using this dataset, we analyze tracker SDKs, manifest files and the use of cloud services and report our results. We also conduct a user survey to understand concerns and perceptions of users. Last but not least, we present a scoring system which assigns scores for smart phones consolidating our findings based on certain criteria. Users could give their own trust decisions based on the available concise information about the security and privacy impacts of applications pre-installed on their devices.

show abstract

“…Except system permissions, Android apps also adopts some custom permissions. These permissions allow apps to access some particular apps [6]. Before Android 6.0, when installing an Apk, the android operating system will prompt the user that the permissions of the Apk will need to install and display it in a list.…”

Section: Plos Onementioning

confidence: 99%

“…Android permissions play an important role in protecting the security of Android apps [6,7]. Research shows that more than >70% of Android apps request permissions they don't need [1].…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

A detection method for android application security based on TF-IDF and machine learning

et al. 2020

View full text Add to dashboard Cite

Android is the most widely used mobile operating system (OS). A large number of thirdparty Android application (app) markets have emerged. The absence of third-party market regulation has prompted research institutions to propose different malware detection techniques. However, due to improvements of malware itself and Android system, it is difficult to design a detection method that can efficiently and effectively detect malicious apps for a long time. Meanwhile, adopting more features will increase the complexity of the model and the computational cost of the system. Permissions play a vital role in the security of the Android apps. Term Frequency-Inverse Document Frequency (TF-IDF) is used to assess the importance of a word for a file set in a corpus. The static analysis method does not need to run the app. It can efficiently and accurately extract the permissions from an app. Based on this cognition and perspective, in this paper, a new static detection method based on TF-IDF and Machine Learning is proposed. The system permissions are extracted in Android application package's (Apk's) manifest file. TF-IDF algorithm is used to calculate the permission value (PV) of each permission and the sensitivity value of apk (SVOA) of each app. The SVOA and the number of the used permissions are learned and tested by machine learning. 6070 benign apps and 9419 malware are used to evaluate the proposed approach. The experiment results show that only use dangerous permissions or the number of used permissions can't accurately distinguish whether an app is malicious or benign. For malware detection, the proposed approach achieve up to 99.5% accuracy and the learning and training time only needs 0.05s. For malware families detection, the accuracy is 99.6%. The results indicate that the method for unknown/new sample's detection accuracy is 92.71%. Compared against other stateof-the-art approaches, the proposed approach is more effective by detecting malware and malware families.

show abstract

Resolving the Predicament of Android Custom Permissions

Cited by 36 publications

References 11 publications

MAPS: Scaling Privacy Compliance Analysis to a Million Apps

MAPS: Scaling Privacy Compliance Analysis to a Million Apps

Should Users Trust Their Android Devices? A Scoring System for Assessing Security and Privacy Risks of Pre-Installed Applications

A detection method for android application security based on TF-IDF and machine learning

Contact Info

Product

Resources

About