IccTA: detecting inter-component privacy leaks in Android apps

Li Li, Alexandre Bartel, Tegawendé F. Bissyandé, Jacques Klein, Yves Le Traon, Steven Arzt, Siegfried Rasthofer, Eric Bodden, Damien Octeau, Patrick McDaniel

Research output: Chapter in Book/Report/Conference proceedingConference PaperResearchpeer-review

282 Citations (Scopus)

Abstract

Shake Them All is a popular "Wallpaper" application exceeding millions of downloads on Google Play. At installation, this application is given permission to (1) access the Internet (for updating wallpapers) and (2) use the device microphone (to change background following noise changes). With these permissions, the application could silently record user conversations and upload them remotely. To give more confidence about how Shake Them All actually processes what it records, it is necessary to build a precise analysis tool that tracks the flow of any sensitive data from its source point to any sink, especially if those are in different components. Since Android applications may leak private data carelessly or maliciously, we propose IccTA, a static taint analyzer to detect privacy leaks among components in Android applications. IccTA goes beyond state-of-the-art approaches by supporting intercomponent detection. By propagating context information among components, IccTA improves the precision of the analysis. IccTA outperforms existing tools on two benchmarks for ICC-leak detectors: DroidBench and ICC-Bench. Moreover, our approach detects 534 ICC leaks in 108 apps from MalGenome and 2,395 ICC leaks in 337 apps in a set of 15,000 Google Play apps.

Original languageEnglish
Title of host publicationProceedings - 2015 IEEE/ACM 37th IEEE International Conference on Software Engineering ICSE 2015, Volume 1
EditorsSebastian Elbaum, Gerardo Canfora
Place of PublicationPiscataway NJ USA
PublisherIEEE, Institute of Electrical and Electronics Engineers
Pages280-291
Number of pages12
Volume1
ISBN (Electronic)9781479919345
DOIs
Publication statusPublished - 2015
Externally publishedYes
EventInternational Conference on Software Engineering 2015 - Florence, Italy
Duration: 16 May 201524 May 2015
Conference number: 37th
http://2015.icse-conferences.org/

Conference

ConferenceInternational Conference on Software Engineering 2015
Abbreviated titleICSE 2015
CountryItaly
CityFlorence
Period16/05/1524/05/15
Internet address

Cite this

Li, L., Bartel, A., Bissyandé, T. F., Klein, J., Traon, Y. L., Arzt, S., Rasthofer, S., Bodden, E., Octeau, D., & McDaniel, P. (2015). IccTA: detecting inter-component privacy leaks in Android apps. In S. Elbaum, & G. Canfora (Eds.), Proceedings - 2015 IEEE/ACM 37th IEEE International Conference on Software Engineering ICSE 2015, Volume 1 (Vol. 1, pp. 280-291). [7194581] IEEE, Institute of Electrical and Electronics Engineers. https://doi.org/10.1109/ICSE.2015.48