Evaluating the privacy of Android mobile applications under forensic analysis

Ntantogian, Christoforos; Apostolopoulos, Dimitris; Marinakis, Giannis; Xenakis, Christos

doi:10.1016/j.cose.2014.01.004

Cited by 32 publications

(15 citation statements)

References 6 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…We contrast this with Ntantogian et al [20], who spent three months to evaluate 390 cases for 13 applications.…”

Section: E Servermentioning

confidence: 67%

“…There have been several studies on Android, comparably dumping memory to look for sensitive data [2], [17], [1], [20], [37]. However, all of these approaches required a manual approach to capture and search the relevant memory images.…”

Section: B Test Frameworkmentioning

confidence: 99%

“…Furthermore, if the effects being measures are probabilistic in nature, multiple runs will be necessary, further burdening the data collection and analysis process. Ntantogian et al [20], for example, studied application lifecycle issues with credential usage, taking three months to examine 390 test-cases for thirteen applications.…”

Section: B Test Frameworkmentioning

confidence: 99%

See 2 more Smart Citations

Removing Secrets from Android's TLS

Lee¹,

Wallach

2018

Proceedings 2018 Network and Distributed System Security Symposium

View full text Add to dashboard Cite

Abstract-Cryptographic libraries that implement Transport Layer Security (TLS) have a responsibility to delete cryptographic keys once they're no longer in use. Any key that's left in memory can potentially be recovered through the actions of an attacker, up to and including the physical capture and forensic analysis of a device's memory. This paper describes an analysis of the TLS library stack used in recent Android distributions, combining a C language core (BoringSSL) with multiple layers of Java code (Conscrypt, OkHttp, and Java Secure Sockets). We first conducted a black-box analysis of virtual machine images, allowing us to discover keys that might remain recoverable. After identifying several such keys, we subsequently pinpointed undesirable interactions across these layers, where the higherlevel use of BoringSSL's reference counting features, from Java code, prevented BoringSSL from cleaning up its keys. This interaction poses a threat to all Android applications built on standard HTTPS libraries, exposing master secrets to memory disclosure attacks. We found all versions we investigated from Android 4 to the latest Android 8 are vulnerable, showing that this problem has been long overlooked. The Android Chrome application is proven to be particularly problematic. We suggest modest changes to the Android codebase to mitigate these issues, and have reported these to Google to help them patch the vulnerability in future Android systems.

show abstract

“…We contrast this with Ntantogian et al [20], who spent three months to evaluate 390 cases for 13 applications.…”

Section: E Servermentioning

confidence: 67%

Section: B Test Frameworkmentioning

confidence: 99%

See 1 more Smart Citation

Removing Secrets from Android's TLS

Lee¹,

Wallach

2018

Proceedings 2018 Network and Distributed System Security Symposium

View full text Add to dashboard Cite

show abstract

“…In the last few years, there are some analysis researches on Android volatile memory. Ntantogian [12] has proved that it is possible to extract authentication credentials of user like user username and password of mobile application from the volatile memory of rooted Android devices. Andersen [13] propose a method to retrieve the encryption key of Luks from the volatile memory of Android mobile phone.…”

Section: B Android Volatile Memory Analysismentioning

confidence: 99%

Forensic Analysis of Cloud Storage on Android Volatile Memory

2017

May 22-24, 2017 Kuala Lumpur (Malaysia) ICLTET-2017, ACBES-2017

View full text Add to dashboard Cite

Abstract-With the popularity of smart phones, criminal activity involving smart phones has become a common phenomenon, especially committing a crime with Cloud Data Storage . i . e . Cloud Storage aids in the manipulating of illicit data, and avoid the scrutiny of law enforcement and national security agencies. This paper attempts to investigate the identification and acquisition of data in the volatile memory of smart phone compared to traditional combination of computer technology and network technology. First of all, we will make an experiment between Baidu Cloud and 360 Cloud that are both Cloud storage application software embedded in Android phones. Secondly, some information associated with Cloud Storage applications that are remained in the Android volatile memory and their regularity and characteristic are recognized through our analysis. Finally, a new automatic Cloud Storage forensic tool through volatile memory of Android phone was designed by us. This tool is able to assist forensic investigators retrieve cloud storage application related evidence from memory dump.

show abstract

“…Apart from personal computers, sensitive information was also recovered from the volatile memory of Android devices using two different methods. More specifically, in the first method [12] the authors used the Linux Memory Extractor (LiME) kernel module [13] and a physical Samsung i9000 phone to dump the Android memory, whereas in the second technique [14] the Android emulator was used alongside with Dalvik Debug Monitor Server (DDMS) to acquire the memory data. In both cases, critical and secure applications, such as mobile banking and password managers, were examined and authentication credentials were recovered in plain text from the dumped memory.…”

Section: Related Workmentioning

confidence: 99%

Protecting Sensitive Information in the Volatile Memory from Disclosure Attacks

Malliaros

Ntantogian

Xenakis

2016

2016 11th International Conference on Availability, Reliability and Security (ARES)

Self Cite

View full text Add to dashboard Cite

Abstract-The protection of the volatile memory data is an issue of crucial importance, since authentication credentials and cryptographic keys remain in the volatile memory. For this reason, the volatile memory has become a prime target for memory scrapers, which specifically target the volatile memory, in order to steal sensitive information, such as credit card numbers. This paper investigates security measures, to protect sensitive information in the volatile memory from disclosure attacks. Experimental analysis is performed to investigate whether the operating systems (Windows or Linux) perform data zeroization in the volatile memory. Results show that Windows kernel zeroize data after a process termination, while the Linux kernel does not. Next, we examine functions and software techniques in C/C++ programming language that can be used by developers to modify at process runtime the contents of the allocated blocks in the volatile memory. We have identified that only the Windows operating system provide a specific function named SecureZeroMemory that can reliably zeroize data. Finally, driven by the fact that malware scrapers primarily target web browsers, we examine whether it is feasible to extract authentication credentials from the volatile memory allocated by web browsers. The presented results show that in most cases we can successfully recover user authentication credentials from all the web browsers except when the user has closed the tab that used to access the website.

show abstract

Evaluating the privacy of Android mobile applications under forensic analysis

Cited by 32 publications

References 6 publications

Removing Secrets from Android's TLS

Removing Secrets from Android's TLS

Forensic Analysis of Cloud Storage on Android Volatile Memory

Protecting Sensitive Information in the Volatile Memory from Disclosure Attacks

Contact Info

Product

Resources

About