DMCA
Detecting Passive Content Leaks and Pollution in Android Applications (2013)
| Venue: | In Proceedings of the 20th Annual Symposium on Network and Distributed System Security, NDSS ’13 |
| Citations: | 24 - 3 self |
BibTeX
@INPROCEEDINGS{Zhou13detectingpassive,
author = {Yajin Zhou and Xuxian Jiang},
title = {Detecting Passive Content Leaks and Pollution in Android Applications},
booktitle = {In Proceedings of the 20th Annual Symposium on Network and Distributed System Security, NDSS ’13},
year = {2013}
}
Share
 |
 |
 |
 |
||
OpenURL
Abstract
In this paper, we systematically study two vulnerabili-ties and their presence in existing Android applications (or “apps”). These two vulnerabilities are rooted in an unpro-tected Android component, i.e., content provider, inside vul-nerable apps. Because of the lack of necessary access con-trol enforcement, affected apps can be exploited to either passively disclose various types of private in-app data or inadvertently manipulate certain security-sensitive in-app settings or configurations that may subsequently cause se-rious system-wide side effects (e.g., blocking all incoming phone calls or SMS messages). To assess the prevalence of these two vulnerabilities, we analyze 62, 519 apps collected in February 2012 from various Android markets. Our re-sults show that among these apps, 1, 279 (2.0%) and 871 (1.4%) of them are susceptible to these two vulnerabilities, respectively. In addition, we find that 435 (0.7%) and 398 (0.6%) of them are accessible from official Google Play and some of them are extremely popular with more than 10, 000, 000 installs. The presence of a large number of vulnerable apps in popular Android markets as well as the variety of private data for leaks and manipulation reflect the severity of these two vulnerabilities. To address them, we also explore and examine possible mitigation solutions. 1
Keyphrases
android application passive content leak vulnerable apps phone call private data popular android market sm message manipulate certain security-sensitive in-app setting possible mitigation solution official google play various type se-rious system-wide side effect unpro-tected android component necessary access con-trol enforcement vul-nerable apps various android market large number re-sults show content provider private in-app data
