Risks behind Device Information Permissions in Android OS

Abstract

In the age of smartphones, people do most of their daily work using their smartphones due to significant improvement in smartphone technology. When comparing different platforms such as Windows, iOS, Android, and Blackberry, Android has captured the highest percentage of total market share [1]. Due to this tremendous growth, cybercriminals are encouraged to penetrate various mobile marketplaces with malicious applications. Most of these applications require device information permissions aiming to collect sensitive data without user's consent. This paper investigates each element of system information permissions and illustrates how cybercriminals can harm users' privacy. It presents some attack scenarios using READ_PHONE_STATE permission and the risks behind it. In addition, this paper refers to possible attacks that can be performed when additional permissions are combined with READ_PHONE_STATE permission. It also discusses a proposed solution to defeat these types of attacks.

Privacy Rating of Mobile Applications Based on Crowdsourcing and Machine Learning

“…But for large data sets, underfitting can be avoided. There are many ways to combine features, but a common method of combining features is to use the feature values of the original features to multiply each other, and the product forms a combined feature (Alshehri et al, 2017). The original features are called first-order features, and the doubled first-order features are called second-order features, where X is a feature vector.…”

Fine-grained access control method for private data in android system

“…The basis of SEAndroid is the discretionary access control, and the added MAC is used to enhance the flexibility of the system. Apart from the above works on improving the permission mechanism of Android, there are various classic works to solve a specific security problem in Android, such as privilege escalation attacks, 21–24 man-in-the-middle attacks 23,25 and inter-process communication call vulnerabilities. 26–28 To help inexperienced users manage permissions securely, some researchers proposed numerous permission management methods such as RecDroid 29 and the use of categories.…”