VTDroid: Value-based Tracking for Overcoming Anti-Taint-Analysis Techniques in Android Apps

Inayoshi, Hiroki; Kakei, Shohei; Takimoto, Eiji; Mouri, Koichi; Saito, Shôichi

doi:10.1145/3465481.3465759

Cited by 3 publications

(1 citation statement)

References 4 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Note that whereas the idea of the recording and reconstruction was initially realized in VTDroid [38], VTDroid was omitted from our evaluation. The decision is because VTDroid is specialized for specific flows, e.g., control dependencies and timing channels, which are not supported by the selected tools, including T-Recs.…”

Section: ) Compared Tools and Setupmentioning

confidence: 99%

Execution Recording and Reconstruction for Detecting Information Flows in Android Apps

2023

Self Cite

View full text Add to dashboard Cite

Security researchers utilize taint analyses to uncover suspicious behaviors in Android apps. Current static taint analyzers cannot handle ICC, reflection, and lifecycles dependably, increasing the result verification cost. On the other hand, current dynamic taint trackers accurately detect execution paths. However, they depend on specific Android versions and modified devices, reducing their usability and applicability. In addition, they require app exercise every time running the taint analysis. This paper presents a new dynamic taint tracker called T-Recs, tracking information flows by recording and reconstructing the app execution. First, before the taint analysis, the app's runtime data are obtained by instrumenting logging code into the app's bytecode and running the app to be independent of specific Android versions and devices. Then, T-Recs performs the taint analysis accurately with the logged data and separately from the app exercise. This paper is an extended version of our work published. Previously, T-Recs' accuracy was mainly evaluated in privacy leak detection. The results show that T-Recs outperforms compared analyzers, which are FlowDroid (w/ and w/o IC3), Amandroid, DroidSafe, and TaintDroid (w/ and w/o IntelliDroid). This paper also involves DroidRA and IccTA. This paper shows that T-Recs detects ICC-and reflection-related leaks missed by FlowDroid in popular Google Play apps. The other static analyzers fail to analyze most of the apps. These experiments also indicate an advantage of T-Recs: its users can re-execute T-Recs' taint analysis without re-exercising the app. T-Recs' app-runtime overhead and parallel execution performance were also evaluated, and the results are acceptable.

show abstract

Section: ) Compared Tools and Setupmentioning

confidence: 99%