NDLI: WeChecker: efficient and precise detection of privilege escalation vulnerabilities in Android apps

Please wait, while we are loading the content...

Lockpicking physical layer key exchange: weak adversary models invite the thief

DroidJust: automated functionality-aware privacy leakage analysis for Android applications

DroidEagle: seamless detection of visually similar Android apps

Injection attacks on 802.11n MAC frame aggregation

SHIELD: a data verification framework for participatory sensing systems

A framework for evaluating pseudonym strategies in vehicular ad-hoc networks

Harvesting developer credentials in Android apps

Applying the protection goals for privacy engineering to mobile devices

UWB rapid-bit-exchange system for distance bounding

CICC: a fine-grained, semantic-aware, and transparent approach to preventing permission leaks for Android permission managers

AppWatcher: unveiling the underground market of trading mobile app reviews

A practical investigation of identity theft vulnerabilities in Eduroam

Liveness verifications for citizen journalism videos

Device-to-identity linking attack using targeted wi-fi geolocation spoofing

TextLogger: inferring longer inputs on touch screen using motion sensors

NFCGate: an NFC relay application for Android

HB+DB, mitigating man-in-the-middle attacks against HB+ with distance bounding

A measurement study of tracking in paid mobile applications

Securacy: an empirical investigation of Android applications' network usage, privacy and security

Danger is my middle name: experimenting with SSL vulnerabilities in Android apps

How far removed are you?: scalable privacy-preserving estimation of social path length with Social PaL

CAPS: context-aware privacy scheme for VANET safety applications

WeChecker: efficient and precise detection of privilege escalation vulnerabilities in Android apps

A hybrid approach for mobile security threat analysis

Freedom of speech: thwarting jammers via a probabilistic approach

How talkative is your mobile device?: an experimental study of Wi-Fi probe requests

Security and system architecture: comparison of Android customizations

Is your commute driving you crazy?: a study of misbehavior in vehicular platoons

Security by mobility in location and track verification

Study of compliance of Android location APIs with Geopriv

SpotShare and nearbyPeople: applications of the Social PaL framework

Physical layer location privacy issue in wireless small cell networks

SVM-based malware detection for Android applications

Device analyzer: a privacy-aware platform to support research on the Android ecosystem

WeChecker: efficient and precise detection of privilege escalation vulnerabilities in Android apps

Content Provider	ACM Digital Library
Author	Yiu, S. M. Xie, Zhongwei Wang, Jingxuan Cui, Xingmin Hui, Lucas C. K. Zeng, Tian
Abstract	Due to the rapid increase of Android apps and their wide usage to handle personal data, a precise and large-scaling checker is in need to validate the apps' permission flow before they are listed on the market. Several tools have been proposed to detect sensitive data leaks in Android apps. But these tools are not applicable to large-scale analysis since they fail to deal with the arbitrary execution orders of different event handlers smartly. Event handlers are invoked by the framework based on the system state, therefore we cannot pre-determine their order of execution. Besides, since all exported components can be invoked by an external app, the execution orders of these components are also arbitrary. A naive way to simulate these two types of arbitrary execution orders yields a permutation of all event handlers in an app. The time complexity is O(n!) where n is the number of event handlers in an app. This leads to a high analysis overhead when n is big. To give an illustration, CHEX [10] found 50.73 entry points of 44 unique class types in an app on average. In this paper we propose an improved static taint analysis to deal with the challenge brought by the arbitrary execution orders without sacrificing the high precision. Our analysis does not need to make permutations and achieves a polynomial time complexity. We also propose to unify the array and map access with object reference by propagating access paths to reduce the number of false positives due to field-insensitivity and over approximation of array access and map access. We implement a tool, WeChecker, to detect privilege escalation vulnerabilities [7] in Android apps. WeChecker achieves 96% precision and 96% recall in the state-of-the-art test suite DriodBench (for compairson, the precision and recall of FlowDroid [1] are 86% and 93%, respectively). The evaluation of WeChecker on real apps shows that it is efficient (average analysis time of each app: 29.985s) and fits for large-scale checking.
Starting Page	1
Ending Page	12
Page Count	12
File Format	PDF
ISBN	9781450336239
DOI	10.1145/2766498.2766509
Language	English
Publisher	Association for Computing Machinery (ACM)
Publisher Date	2015-06-22
Publisher Place	New York
Access Restriction	Subscribed
Subject Keyword	Control flow Data flow checking Taint analysis Privilege escalation attack Android
Content Type	Text
Resource Type	Article

Sl.	Authority	Responsibilities	Communication Details
1	Ministry of Education (GoI), Department of Higher Education	Sanctioning Authority	https://www.education.gov.in/ict-initiatives
2	Indian Institute of Technology Kharagpur	Host Institute of the Project: The host institute of the project is responsible for providing infrastructure support and hosting the project	https://www.iitkgp.ac.in
3	National Digital Library of India Office, Indian Institute of Technology Kharagpur	The administrative and infrastructural headquarters of the project	Dr. B. Sutradhar bsutra@ndl.gov.in
4	Project PI / Joint PI	Principal Investigator and Joint Principal Investigators of the project	Dr. B. Sutradhar bsutra@ndl.gov.in Prof. Saswat Chakrabarti will be added soon
5	Website/Portal (Helpdesk)	Queries regarding NDLI and its services	support@ndl.gov.in
6	Contents and Copyright Issues	Queries related to content curation and copyright issues	content@ndl.gov.in
7	National Digital Library of India Club (NDLI Club)	Queries related to NDLI Club formation, support, user awareness program, seminar/symposium, collaboration, social media, promotion, and outreach	clubsupport@ndl.gov.in
8	Digital Preservation Centre (DPC)	Assistance with digitizing and archiving copyright-free printed books	dpc@ndl.gov.in
9	IDR Setup or Support	Queries related to establishment and support of Institutional Digital Repository (IDR) and IDR workshops	idr@ndl.gov.in

DroidChecker: analyzing android applications for capability leak

FlowDroid: precise context, flow, field, object-sensitive and lifecycle-aware taint analysis for Android apps

POSTER: A new framework against privilege escalation attacks on android

Scalable and precise taint analysis for Android

DroidAlarm: an all-sided static analysis tool for Android privilege-escalation malware

Detecting privacy leaks in Android Apps

STUDY OF PRIVILEGE ESCALATION ATTACK ON ANDROID AND ITS COUNTERMEASURES

Damien octeau (penn state university) patrick mcdaniel (penn state university) highly precise taint analysis for android application (2013).

Precise, General, and Efficient Data-flow Analysis for Security Vetting of Android Apps

WeChecker: efficient and precise detection of privilege escalation vulnerabilities in Android apps

Similar Documents

DroidChecker: analyzing android applications for capability leak

FlowDroid: precise context, flow, field, object-sensitive and lifecycle-aware taint analysis for Android apps

POSTER: A new framework against privilege escalation attacks on android

Scalable and precise taint analysis for Android

DroidAlarm: an all-sided static analysis tool for Android privilege-escalation malware

Detecting privacy leaks in Android Apps

STUDY OF PRIVILEGE ESCALATION ATTACK ON ANDROID AND ITS COUNTERMEASURES

Damien octeau (penn state university) patrick mcdaniel (penn state university) highly precise taint analysis for android application (2013).

Precise, General, and Efficient Data-flow Analysis for Security Vetting of Android Apps

WeChecker: efficient and precise detection of privilege escalation vulnerabilities in Android apps