IccTA: Detecting Inter-Component Privacy Leaks in Android Apps

Abstract

<i>Shake Them All</i> is a popular "Wallpaper" application exceeding millions of downloads on Google Play. At installation, this application is given permission to (1) access the Internet (for updating wallpapers) and (2) use the device microphone (to change background following noise changes). With these permissions, the application could silently record user conversations and upload them remotely. To give more confidence about how <i>Shake Them All</i> actually processes what it records, it is necessary to build a precise analysis tool that tracks the flow of any sensitive data from its source point to any sink, especially if those are in different components. Since Android applications may leak private data carelessly or maliciously, we propose IccTA, a static taint analyzer to detect privacy leaks among components in Android applications. IccTA goes beyond state-of-the-art approaches by supporting inter-component detection. By propagating context information among components, IccTA improves the precision of the analysis. IccTA outperforms existing tools on two benchmarks for ICC-leak detectors: DroidBench and ICC-Bench. Moreover, our approach detects 534 ICC leaks in 108 apps from MalGenome and 2,395 ICC leaks in 337 apps in a set of 15,000 Google Play apps.

Extracted Key Phrases

10 Figures and Tables

050100201520162017
Citations per Year

166 Citations

Semantic Scholar estimates that this publication has 166 citations based on the available data.

See our FAQ for additional information.

Cite this paper

@article{Li2015IccTADI, title={IccTA: Detecting Inter-Component Privacy Leaks in Android Apps}, author={Li Li and Alexandre Bartel and Tegawend{\'e} F. Bissyand{\'e} and Jacques Klein and Yves Le Traon and Steven Arzt and Siegfried Rasthofer and Eric Bodden and Damien Octeau and Patrick D. McDaniel}, journal={2015 IEEE/ACM 37th IEEE International Conference on Software Engineering}, year={2015}, volume={1}, pages={280-291} }