Dark Hazard: Learning-based, Large-Scale Discovery of Hidden Sensitive Operations in Android Apps

Pan, Xiaorui; Wang, Xueqiang; Duan, Yue; Yin, Heng

doi:10.14722/ndss.2017.23265

Cited by 53 publications

(77 citation statements)

References 12 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…We opted to develop a lightweight analysis approach that scales well and is sufficiently robust, similar to the approach used in [27]. Alternative techniques apply machine learning [31,35,38,44], black box differential analysis [9], or traffic signatures [7].…”

Section: Android App Analysismentioning

confidence: 99%

MAPS: Scaling Privacy Compliance Analysis to a Million Apps

Zimmeck

Story

Smullen

et al. 2019

Proceedings on Privacy Enhancing Technologies

132

141

View full text Add to dashboard Cite

The app economy is largely reliant on data collection as its primary revenue model. To comply with legal requirements, app developers are often obligated to notify users of their privacy practices in privacy policies. However, prior research has suggested that many developers are not accurately disclosing their apps’ privacy practices. Evaluating discrepancies between apps’ code and privacy policies enables the identification of potential compliance issues. In this study, we introduce the Mobile App Privacy System (MAPS) for conducting an extensive privacy census of Android apps. We designed a pipeline for retrieving and analyzing large app populations based on code analysis and machine learning techniques. In its first application, we conduct a privacy evaluation for a set of 1,035,853 Android apps from the Google Play Store. We find broad evidence of potential non-compliance. Many apps do not have a privacy policy to begin with. Policies that do exist are often silent on the practices performed by apps. For example, 12.1% of apps have at least one location-related potential compliance issue. We hope that our extensive analysis will motivate app stores, government regulators, and app developers to more effectively review apps for potential compliance issues.

show abstract

Section: Android App Analysismentioning

confidence: 99%

MAPS: Scaling Privacy Compliance Analysis to a Million Apps

Zimmeck

Story

Smullen

et al. 2019

Proceedings on Privacy Enhancing Technologies

132

141

View full text Add to dashboard Cite

show abstract

“…We use real Android devices instead of emulated ones to avoid scenarios where apps and third-party libraries detect the analysis environment and modify their behavior accordingly. It has been shown that emulators are easy to fingerprint [47], [57], a fact that is exploited for example by ad libraries to only show ads and leak data when executed on a real device [46].…”

Section: Test Environmentmentioning

confidence: 99%

Bug Fixes, Improvements, ... and Privacy Leaks - A Longitudinal Study of PII Leaks Across Android App Versions

Ren

Lindorfer

Dubois

et al. 2018

Proceedings 2018 Network and Distributed System Security Symposium

View full text Add to dashboard Cite

Abstract-Is mobile privacy getting better or worse over time? In this paper, we address this question by studying privacy leaks from historical and current versions of 512 popular Android apps, covering 7,665 app releases over 8 years of app version history. Through automated and scripted interaction with apps and analysis of the network traffic they generate on real mobile devices, we identify how privacy changes over time for individual apps and in aggregate. We find several trends that include increased collection of personally identifiable information (PII) across app versions, slow adoption of HTTPS to secure the information sent to other parties, and a large number of third parties being able to link user activity and locations across apps. Interestingly, while privacy is getting worse in aggregate, we find that the privacy risk of individual apps varies greatly over time, and a substantial fraction of apps see little change or even improvement in privacy. Given these trends, we propose metrics for quantifying privacy risk and for providing this risk assessment proactively to help users balance the risks and benefits of installing new versions of apps.

show abstract

“…TriggerScope [26] relies on symbolic execution to detect suspicious triggering conditions of Android apps and check whether the path from the condition leads to a sensitive API. HsoMiner [43] classifies hidden sensitive operations on Android with a set of evasion-specific features. Recently, a report [50] discussed a Chameleon-like malware from Google Play: a multi-stage Android app that hides its malicious activities (i.e., phishing bank service) behind its legitimate-looking UI.…”

Section: Related Workmentioning

confidence: 99%

Understanding Illicit UI in iOS apps Through Hidden UI Analysis

Lee

Wang

Liao

2019

IEEE Trans. Dependable and Secure Comput.

Self Cite

View full text Add to dashboard Cite

In Chameleon apps, benign UIs are displayed during Apple App vetting while their hidden potentially-harmful illicit UIs (PHI-UI) are revealed once they reached App Store. In this paper, we report the first systematic study on iOS Chameleon apps, which sheds light on a largely overlooked threat that the illicit activities are launched solely based on UI. Our research employed CHAMELEON-HUNTER, a new static analysis approach that determines the suspiciousness of a PHI-UI leveraging the semantic features generated from iOS app UI and metadata. The approach is based on the observation that PHI-UI not only is structurally hidden but also has notable semantic inconsistency with the benign UI. Our evaluation shows that CHAMELEON-HUNTER is highly effective, achieving 92.6% precision and 94.7% recall. From 28K Apple App Store apps, we found 142 new Chameleon apps, which were confirmed and promptly removed by Apple. Our work reveals that Chameleon apps can easily bypass the App store vetting and conduct a set of suspicious activities including collecting users' private information, swindling money with fake monetary services, and leading the user to a pirated app store.

show abstract

Dark Hazard: Learning-based, Large-Scale Discovery of Hidden Sensitive Operations in Android Apps

Cited by 53 publications

References 12 publications

MAPS: Scaling Privacy Compliance Analysis to a Million Apps

MAPS: Scaling Privacy Compliance Analysis to a Million Apps

Bug Fixes, Improvements, ... and Privacy Leaks - A Longitudinal Study of PII Leaks Across Android App Versions

Understanding Illicit UI in iOS apps Through Hidden UI Analysis

Contact Info

Product

Resources

About