Using static analysis for automatic assessment and mitigation of unwanted and malicious activities within Android applications

Abstract

In the last decade, smartphones have gained widespread usage. Since the advent of online application stores, hundreds of thousands of applications have become instantly available to millions of smartphone users. Within the Android ecosystem, application security is governed by digital signatures and a list of coarse-grained permissions. However, this mechanism is not fine-grained enough to provide the user with a sufficient means of control of the applications' activities. Abuse of highly sensible private information such as phone numbers without users' notice is the result. We show that there is a high frequency of privacy leaks even among widely popular applications. Together with the fact that the majority of the users are not proficient in computer security, this presents a challenge to the engineers developing security solutions for the platform. Our contribution is twofold: first, we propose a service which is able to assess Android Market applications via static analysis and provide detailed, but readable reports to the user. Second, we describe a means to mitigate security and privacy threats by automated reverse-engineering and refactoring binary application packages according to the users' security preferences.

Using opcode-sequences to detect malicious Android applications

“…A dynamic approach is presented in [21] where the authors proposed a syscall monitoring approach further used to identify malicious signatures. Batyuk et al introduce in [22] a solution aiming at disassembling code and looking at malicious API use. DroidMat [10] extracts information about Intent, API calls and permissions in order to classify applications in using clustering techniques.…”

On the Static Analysis of Hybrid Mobile Apps

“…4 Our prototype allows to process Android binaries (i. e., APK files) directly. Using WALA's Java front-end, the analysis of Java source of Android apps can be supported easily as well.…”

“…There is a large body of work that uses static program analysis for finding security vulnerabilities in JavaScript-based web applications [11,16,24,26] as well as dealing with the privacy concerns of Android apps [4,13,18,20].…”

Addressing Security Issues in Latest Android Versions and Applications

“…[9] Some of the critical permissions like accessing messages, making phone call and similar permissions were given a two-step verification. The user's permission is again asked while the application requires use of critical permissions.…”