Detection of illegal control flow in Android System: Protecting private data used by Smartphone Apps - Archive ouverte HAL Accéder directement au contenu
Communication Dans Un Congrès Année : 2014

Detection of illegal control flow in Android System: Protecting private data used by Smartphone Apps

Résumé

Today, security is a requirement for smartphone operating systems that are used to store and handle sensitive information. How- ever, smartphone users usually download third-party applications that can leak personal data without user authorization. For this reason, the dynamic taint analysis mechanism is used to control the manipulation of private data by third-party apps [9]. But this technique does not detect control flows. In particular, untrusted applications can circumvent An- droid system and get privacy sensitive information through control flows. In this paper, we propose a hybrid approach that combines static and dynamic analysis to propagate taint along control dependencies in An- droid system. To evaluate the effectiveness of our approach, we analyse 27 free Android applications. We found that 14 of these applications use control flows to transfer sensitive data. We successfully detect that 8 of them leaked private information. Our approach creates 19% performance overhead that is due to the propagation of taint in the control flow. By using our approach, it becomes possible to detect leakage of personal data through control flows.
Fichier principal
Vignette du fichier
Article.pdf (259.5 Ko) Télécharger le fichier
Origine : Fichiers produits par l'(les) auteur(s)
Loading...

Dates et versions

hal-01214033 , version 1 (09-10-2015)

Identifiants

Citer

Mariem Graa, Nora Cuppens-Bouhlahia, Frédéric Cuppens, Ana Cavalli. Detection of illegal control flow in Android System: Protecting private data used by Smartphone Apps. FPS 2014 : the 7th International Symposium on Foundations & Practice of Security, Nov 2014, Montréal, Canada. pp.337 - 346, ⟨10.1007/978-3-319-17040-4_22⟩. ⟨hal-01214033⟩
287 Consultations
170 Téléchargements

Altmetric

Partager

Gmail Facebook X LinkedIn More