Cyber-Vigilance and Digital Trust

4Analytical Overview on Secure Information Flow in Android Systems: Protecting Private Data Used by Smartphone Applications

Malicious third-party applications can leak personal data stored in the Android system by exploiting control dependencies. The information flow tracking mechanism allows us to protect sensitive data. It is based on the data tainting technique used to control the manipulation of private data. In this chapter, we study and discuss the different mechanisms used to protect sensitive data in the Android systems. These mechanisms cannot detect control flows. This can cause an under-tainting problem and therefore a failure to detect a leak of sensitive information. We propose a formal and technical approach based on data tainting mechanisms combining dynamic and static analysis to handle control flow in java and native apps code and to solve the under-tainting problem in the Android systems. We show that our approach can resist code obfuscation attacks in control flow statements that exploit taint propagation to leak sensitive information. We propagate taint in timing, memory cache and GPU channels as well as in meta data (file and clipboard length) to detect software side channel attacks that try to bypass detection mechanisms based on dynamic taint analysis.

4.1. Introduction

Android devices account for 80.7% of the global smartphone sales in most markets in the world (Gartner 2016). To make smartphones more fun and useful, users generally download third-party ...