Signature generation for sensitive information leakage in android applications

Abstract

In recent years, there has been rapid growth in mobile devices such as smartphones, and a number of applications are developed specifically for the smartphone market. In particular, there are many applications that are "free" to the user, but depend on advertisement services for their revenue. Such applications include an advertisement module -a library provided by the advertisement service -that can collect a user's sensitive information and transmit it across the network. Such information is used for targeted advertisements, and user behavior statistics. Users accept this business model, but in most cases the applications do not require the user's acknowledgment in order to transmit sensitive information. Therefore, such applications' behavior becomes an invasion of privacy. In our analysis of 1,188 Android applications' network traffic and permissions, 93% of the applications we analyzed connected to multiple destinations when using the network. 61% required a permission combination that included both access to sensitive information and use of networking services. These applications have the potential to leak the user's sensitive information. Of the 107,859 HTTP packets from these applications, 23,309 (22%) contained sensitive information, such as device identification number and carrier name. In an effort to enable users to control the transmission of their private information, we propose a system which, using a novel clustering method based on the HTTP packet destination and content distances, generates signatures from the clustering result and uses them to detect sensitive information leakage from Android applications. Our system does not require an Android framework modification or any special privileges. Thus users can easily introduce our system to their devices, and manage suspicious applications' network behavior in a fine grained manner. Our system accurately detected 94% of the sensitive information leakage from the applications evaluated and produced only 5% false negative results, and less than 3% false positive results.

Studying Eventual Connectivity Issues in Android Apps

“…Network permission is the most popular permission among Android apps [42,43] which suggest that Android apps are highly dependent on internet access. This has pushed the research community to study network-related aspects of mobile apps, and in particular: (i) network traffic profiling/characterization/usage [5,6,[43][44][45][46][47][48][49][50]; (ii) security and privacy concerns, namely how private information is being manipulated and protected in apps [7,8,[51][52][53][54][55]; and (iii) network-related vulnerable scenarios which can be exploited by mischievous attackers [9,56,57]. To the best of our knowledge, our study is the first one empirically analyzing Eventual Connectivity issues in Android apps.…”

“…As a consequence, it is unknown the prevalence of those issues and their impact on the quality as perceived by users. Indeed, state-of-the-art studies are mostly devoted to (i) network traffic characterization [5,6], (ii) its security and privacy implications [7,8], and (iii) possible exploitable scenarios addressed by malicious agents [9]. Previous studies have indeed focused on cataloging bugs/crashes for mobile apps in general [10], and bugs/crashes specific to quality attributes such as performance [11][12][13][14][15], security [16][17][18], behavioral/GUI inconsistency [19][20][21][22], and energy consumption [23][24][25][26][27].…”

The Dark Side(-Channel) of Mobile Devices: A Survey on Network Traffic Analysis

“…In Table VI, we present the surveyed works that deal with PII leakage detection [23], [27], [29], [5], [41], [50], [54], [57], [58]. For each work, we summarize the targeted mobile platforms, and whether the PII leaks are simply detected or also prevented.…”

“…Kuzuno and Tonami in [27] investigate the leakage of sensitive information by the advertisement libraries embedded into free Android apps. They focus on both original and hashed identifiers unique to mobile devices (i.e., IMEI and Android ID) and SIM cards (i.e., IMSI and SIM Serial ID), as well as on the name of the cellular operator (CARRIER).…”

“…The achieved results show that it is possible to successfully fingerprint an Android app (or type of app) [16], [28], [29], [5], [43], [6], [47], [56], [61], as well as an action performed by a mobile user on her Android device [30], [39], [45], [46], [52]. In [29], [5], [41], [50], [54], [57], [58], it is reported that Android apps extensively leak the PII of mobile users, and the works in [23], [27] highlight that an important role in this phenomenon is played by the embedded ad libraries. Regarding mobile advertisement, Crussell et al in [33] prove that many Android apps trick the advertisement business model in order to let their developers illicitly earn money.…”