论文标题
表征传感器在Android应用中泄漏
Characterizing Sensor Leaks in Android Apps
论文作者
论文摘要
虽然在实现高级功能方面非常有价值，但攻击者可能会滥用手机传感器，以在Android应用程序中实施恶意活动，这是许多最先进的研究在实验上所证明的。因此，迫切需要调节移动传感器的使用情况，以防止他们被恶意攻击者剥削。然而，尽管已经在实现这一目标（即检测Android应用程序中的隐私泄漏）方面做出了各种努力，但我们尚未找到自动检测Android应用中传感器泄漏的方法。为了填补空白，我们设计并实施了一种新型的原型工具Seeker，该工具扩展了著名的FlowDroid工具，以检测Android应用中基于传感器的数据泄漏。 Seeker直接在Android应用程序的字节码上进行以传感器为中心的静态污染分析，不仅报告传感器触发的隐私泄漏，而且还报告了泄漏所涉及的传感器类型。使用40,000多个现实世界Android应用程序的实验结果表明，Seeker有效地检测Android应用中的传感器泄漏，而恶意应用程序比良性应用程序更感兴趣地对泄漏传感器数据感兴趣。
While extremely valuable to achieve advanced functions, mobile phone sensors can be abused by attackers to implement malicious activities in Android apps, as experimentally demonstrated by many state-of-the-art studies. There is hence a strong need to regulate the usage of mobile sensors so as to keep them from being exploited by malicious attackers. However, despite the fact that various efforts have been put in achieving this, i.e., detecting privacy leaks in Android apps, we have not yet found approaches to automatically detect sensor leaks in Android apps. To fill the gap, we designed and implemented a novel prototype tool, SEEKER, that extends the famous FlowDroid tool to detect sensor-based data leaks in Android apps. SEEKER conducts sensor-focused static taint analyses directly on the Android apps' bytecode and reports not only sensor-triggered privacy leaks but also the sensor types involved in the leaks. Experimental results using over 40,000 real-world Android apps show that SEEKER is effective in detecting sensor leaks in Android apps, and malicious apps are more interested in leaking sensor data than benign apps.
