Information flows as a permission mechanism

Shen, Feng; Vishnubhotla, Namita; Todarka, Chirag; Arora, Mohit; Dhandapani, Babu; Lehner, Eric John; Ko, Steven Y.; Ziarek, Lukasz

doi:10.1145/2642937.2643018

Cited by 43 publications

(16 citation statements)

References 32 publications

(15 reference statements)

Supporting

Mentioning

Contrasting

Order By: Relevance

“…We rejected five solutions because they lacked proper documentation, e.g., no documentation, lack of instructions to build and use tools. This elimination was necessary to eliminate human bias resulting from the effort involved in discovering how to build and use a solution, e.g., DroidLegacy [Deshotels et al, 2014], BlueSeal [Shen et al, 2014]. We rejected AppGuard [Backes SRT GmbH, 2014] because its documentation was not in English.…”

Section: Shallow Selectionmentioning

confidence: 99%

Are free Android app security analysis tools effective in detecting known vulnerabilities?

Ranganath

Mitra

2019

Empir Software Eng

View full text Add to dashboard Cite

Increasing interest in securing the Android ecosystem has spawned numerous efforts to assist app developers in building secure apps. These efforts have resulted in tools and techniques capable of detecting vulnerabilities (and malicious behaviors) in apps. However, there has been no evaluation of the effectiveness of these tools and techniques in detecting known vulnerabilities. The absence of such evaluations puts app developers at a disadvantage when choosing security analysis tools to secure their apps.In this regard, we evaluated the effectiveness of vulnerability detection tools for Android apps. We considered 64 tools and empirically evaluated 14 vulnerability detection tools (incidentally along with five malicious behavior detection tools) against 42 known unique vulnerabilities captured by Ghera benchmarks, which are composed of both vulnerable and secure apps. Of the 24 observations from the evaluation, the main observation is existing vulnerability detection tools for Android apps are very limited in their ability to detect known vulnerabilities -all of the evaluated tools together could only detect 30 of the 42 known unique vulnerabilities.More effort is required if security analysis tools are to help developers build secure apps. We hope the observations from this evaluation will help app developers choose appropriate security analysis tools and persuade tool developers and researchers to identify and address limitations in their tools and techniques. We also hope this evaluation will catalyze or spark a conversation in the software engineering and security communities to require a more rigorous and explicit evaluation of security analysis tools and techniques.

show abstract

Section: Shallow Selectionmentioning

confidence: 99%

Are free Android app security analysis tools effective in detecting known vulnerabilities?

Ranganath

Mitra

2019

Empir Software Eng

View full text Add to dashboard Cite

show abstract

“…Blue Seal is an automated infrastructure for synthesizing flow permissions. In this tool, a flow‐based extension to the Android permission mechanisms is presented called Flow Permissions.…”

Section: Related Workmentioning

confidence: 99%

VAnDroid: A framework for vulnerability analysis of Android applications using a model‐driven reverse engineering technique

2018

View full text Add to dashboard Cite

Summary Android is extensively used worldwide by mobile application developers. Android provides applications with a message passing system to communicate within and between them. Due to the risks associated with this system, it is vital to detect its unsafe operations and potential vulnerabilities. To achieve this goal, a new framework, called VAnDroid, based on Model Driven Reverse Engineering (MDRE), is presented that identifies security risks and vulnerabilities related to the Android application communication model. In the proposed framework, some security‐related information included in an Android app is automatically extracted and represented as a domain‐specific model. Then, it is used for analyzing security configurations and identifying vulnerabilities in the corresponding application. The proposed framework is implemented as an Eclipse‐based tool, which automatically identifies the Intent Spoofing and Unauthorized Intent Receipt as two attacks related to the Android application communication model. To evaluate the tool, it has been applied to several real‐world Android applications, including 20 apps from Google Play and 110 apps from the F‐Droid repository. VAnDroid is also compared with several existing analysis tools, and it is shown that it has a number of key advantages over those tools specifically regarding its high correctness, scalability, and usability in discovering vulnerabilities. The results well indicate the effectiveness and capacity of the VAnDroid as a promising approach in the field of Android security.

show abstract

“…Shen et al [10] employ a static data flow analysis technique to enrich the Android permission mechansims with information regarding detected information flow. To the best of my knowledge, their work is the only other work that compares the information flows between benign and malicious applications.…”

Section: Related Workmentioning

confidence: 99%

Mining Patterns of Sensitive Data Usage

Avdiienko¹

2015

2015 IEEE/ACM 37th IEEE International Conference on Software Engineering

View full text Add to dashboard Cite

When a user downloads an Android application from a market, she does not know much about its actual behavior. A brief description, a set of screenshots, and the list of permissions, which give a high level intuition of what the application might be doing, are all the user sees before installing and running the application on his device. These elements are not enough to decide whether the application is secure, and for sure they do not indicate whether it might violate the user's privacy by leaking some sensitive data.The goal of my thesis is to employ both static and dynamic taint analyses to gather information on how Android applications use sensitive data. The main hypothesis of this work is that malicious and benign mobile applications differ in how they use sensitive data, and consequently information flow can be used effectively to identify malware.

show abstract

Information flows as a permission mechanism

Cited by 43 publications

References 32 publications

Are free Android app security analysis tools effective in detecting known vulnerabilities?

Are free Android app security analysis tools effective in detecting known vulnerabilities?

VAnDroid: A framework for vulnerability analysis of Android applications using a model‐driven reverse engineering technique

Mining Patterns of Sensitive Data Usage

Contact Info

Product

Resources

About