| Title | Prevention of Data Leakage due to Implicit Information Flows in Android Applications |
| Publication Type | Conference Paper |
| Year of Publication | 2019 |
| Authors | Inayoshi, Hiroki, Kakei, Shohei, Takimoto, Eiji, Mouri, Koichi, Saito, Shoichi |
| Conference Name | 2019 14th Asia Joint Conference on Information Security (AsiaJCIS) |
| Keywords | android, Android (operating system), Android applications, composability, data leakage, data privacy, DTA technique, dynamic taint analysis, dynamic taint analysis technique, explicit information, IIF detection technique, IIF tricks, IIF-accompanied attacks, IIF-contained information, IIFs, implicit information flow, implicit information flows, Instruments, Metrics, mobile computing, performance evaluation, privacy, privacy policy enforcement, pubcrawl, Runtime, security, security of data, Servers, Smalien enforced privacy policy, taint analysis |
| Abstract | Dynamic Taint Analysis (DTA) technique has been developed for analysis and understanding behavior of Android applications and privacy policy enforcement. Meanwhile, implicit information flows (IIFs) are major concern of security researchers because IIFs can evade DTA technique easily and give attackers an advantage over the researchers. Some researchers suggested approaches to the issue and developed analysis systems supporting privacy policy enforcement against IIF-accompanied attacks; however, there is still no effective technique of comprehensive analysis and privacy policy enforcement against IIF-accompanied attacks. In this paper, we propose an IIF detection technique to enforce privacy policy against IIF-accompanied attacks in Android applications. We developed a new analysis tool, called Smalien, that can discover data leakage caused by IIF-contained information flows as well as explicit information flows. We demonstrated practicability of Smalien by applying it to 16 IIF tricks from ScrubDroid and two IIF tricks from DroidBench. Smalien enforced privacy policy successfully against all the tricks except one trick because the trick loads code dynamically from a remote server at runtime, and Smalien cannot analyze any code outside of a target application. The results show that our approach can be a solution to the current attacker-superior situation. |
| DOI | 10.1109/AsiaJCIS.2019.00005 |
| Citation Key | inayoshi_prevention_2019 |
Prevention of Data Leakage due to Implicit Information Flows in Android Applications