Messaging Beyond Texts with Real-time Image Suggestions

Kim, Joon-Gyum; Gong, Taesik; Han, Kyungsik; Kim, Juho; Ko, JeongGil; Lee, Sung-Ju

doi:10.1145/3379503.3403553

Cited by 7 publications

(1 citation statement)

References 44 publications

(43 reference statements)

Supporting

Mentioning

Contrasting

Order By: Relevance

“…High privacy cost. We observed that one app (i.e., Phishing Eyes) sends users' incoming/outgoing call numbers, SMS texts, voice calls, or installed app lists to its server, each of which is privacy-sensitive information [21,72,73]. We believe that the existing approach of sending privacy-sensitive information demands a high privacy cost, rendering this approach impractical.…”

Section: Existing Defense Appsmentioning

confidence: 99%

HearMeOut

Kim

et al. 2022

Proceedings of the 20th Annual International Conference on Mobile Systems, Applications and Services

Self Cite

View full text Add to dashboard Cite

In South Korea, voice phishing has been proliferating with the advent of voice phishing apps: the number of annual victims had risen to 34,527 in 2020, representing financial losses of approximately 598 million USD. However, the voice phishing functionalities that these abusive apps implement are largely understudied. To this end, we analyze 1,017 voice phishing apps and reveal new phishing functionalities: outgoing call redirection, call screen overlay, and fake call voice. We find that call redirection that changes the intended recipients of victims' outgoing calls plays a critical role in facilitating voice phishing; our user study shows that 87% of the participants did not notice that their intended recipients were changed when call redirection occurred. We further investigate implementations of these fatal functionalities to distinguish their malicious behaviors from their corresponding behaviors in benign apps. We then propose HearMeOut, an Android system-level service that detects phishing behaviors that phishing apps conduct in runtime and blocks the detected behaviors. HearMeOut achieves high accuracy with no false positives or negatives in classifying phishing behaviors while exhibiting an unnoticeable latency of 0.36 ms on average. Our user study demonstrates that HearMeOut is able to prevent 100% of participants from being phished by providing active warnings. Our work facilitates a better understanding of recent voice phishing and proposes practical mitigation with recommendations for Android system changes. CCS CONCEPTS• Security and privacy → Mobile and wireless security; Malware and its mitigation; Intrusion/anomaly detection and malware mitigation; Domain-specific security and privacy architectures.

show abstract

Section: Existing Defense Appsmentioning

confidence: 99%