IccTA: detecting inter-component privacy leaks in Android apps

Li Li; Alexandre Bartel; Tegawendé F. Bissyandé; Jacques Klein; Yves Le Traon; Steven Arzt; Siegfried Rasthofer; Eric Bodden; Damien Octeau; Patrick McDaniel

doi:10.1109/ICSE.2015.48

IccTA: detecting inter-component privacy leaks in Android apps

Li Li, Alexandre Bartel, Tegawendé F. Bissyandé, Jacques Klein, Yves Le Traon, Steven Arzt, Siegfried Rasthofer, Eric Bodden, Damien Octeau, Patrick McDaniel

Research output: Chapter in Book/Report/Conference proceeding › Conference Paper › Research › peer-review

467 Citations (Scopus)

Abstract

Shake Them All is a popular "Wallpaper" application exceeding millions of downloads on Google Play. At installation, this application is given permission to (1) access the Internet (for updating wallpapers) and (2) use the device microphone (to change background following noise changes). With these permissions, the application could silently record user conversations and upload them remotely. To give more confidence about how Shake Them All actually processes what it records, it is necessary to build a precise analysis tool that tracks the flow of any sensitive data from its source point to any sink, especially if those are in different components. Since Android applications may leak private data carelessly or maliciously, we propose IccTA, a static taint analyzer to detect privacy leaks among components in Android applications. IccTA goes beyond state-of-the-art approaches by supporting intercomponent detection. By propagating context information among components, IccTA improves the precision of the analysis. IccTA outperforms existing tools on two benchmarks for ICC-leak detectors: DroidBench and ICC-Bench. Moreover, our approach detects 534 ICC leaks in 108 apps from MalGenome and 2,395 ICC leaks in 337 apps in a set of 15,000 Google Play apps.

Original language	English
Title of host publication	Proceedings - 2015 IEEE/ACM 37th IEEE International Conference on Software Engineering ICSE 2015, Volume 1
Editors	Sebastian Elbaum, Gerardo Canfora
Place of Publication	Piscataway NJ USA
Publisher	IEEE, Institute of Electrical and Electronics Engineers
Pages	280-291
Number of pages	12
Volume	1
ISBN (Electronic)	9781479919345
DOIs	https://doi.org/10.1109/ICSE.2015.48
Publication status	Published - 2015
Externally published	Yes
Event	International Conference on Software Engineering 2015 - Florence, Italy Duration: 16 May 2015 → 24 May 2015 Conference number: 37th http://2015.icse-conferences.org/ https://ieeexplore.ieee.org/xpl/conhome/7174815/proceeding?isnumber=7194545 (Proceedings)

Conference

Conference	International Conference on Software Engineering 2015
Abbreviated title	ICSE 2015
Country/Territory	Italy
City	Florence
Period	16/05/15 → 24/05/15
Internet address	http://2015.icse-conferences.org/ https://ieeexplore.ieee.org/xpl/conhome/7174815/proceeding?isnumber=7194545 (Proceedings)

Access to Document

10.1109/ICSE.2015.48

Cite this

Li, L., Bartel, A., Bissyandé, T. F., Klein, J., Traon, Y. L., Arzt, S., Rasthofer, S., Bodden, E., Octeau, D., & McDaniel, P. (2015). IccTA: detecting inter-component privacy leaks in Android apps. In S. Elbaum, & G. Canfora (Eds.), Proceedings - 2015 IEEE/ACM 37th IEEE International Conference on Software Engineering ICSE 2015, Volume 1 (Vol. 1, pp. 280-291). [7194581] IEEE, Institute of Electrical and Electronics Engineers. https://doi.org/10.1109/ICSE.2015.48

Li, Li ; Bartel, Alexandre ; Bissyandé, Tegawendé F. et al. / IccTA : detecting inter-component privacy leaks in Android apps. Proceedings - 2015 IEEE/ACM 37th IEEE International Conference on Software Engineering ICSE 2015, Volume 1. editor / Sebastian Elbaum ; Gerardo Canfora. Vol. 1 Piscataway NJ USA : IEEE, Institute of Electrical and Electronics Engineers, 2015. pp. 280-291

@inproceedings{ec8505c1aad548bf89f016849017e2e7,

title = "IccTA: detecting inter-component privacy leaks in Android apps",

abstract = "Shake Them All is a popular {"}Wallpaper{"} application exceeding millions of downloads on Google Play. At installation, this application is given permission to (1) access the Internet (for updating wallpapers) and (2) use the device microphone (to change background following noise changes). With these permissions, the application could silently record user conversations and upload them remotely. To give more confidence about how Shake Them All actually processes what it records, it is necessary to build a precise analysis tool that tracks the flow of any sensitive data from its source point to any sink, especially if those are in different components. Since Android applications may leak private data carelessly or maliciously, we propose IccTA, a static taint analyzer to detect privacy leaks among components in Android applications. IccTA goes beyond state-of-the-art approaches by supporting intercomponent detection. By propagating context information among components, IccTA improves the precision of the analysis. IccTA outperforms existing tools on two benchmarks for ICC-leak detectors: DroidBench and ICC-Bench. Moreover, our approach detects 534 ICC leaks in 108 apps from MalGenome and 2,395 ICC leaks in 337 apps in a set of 15,000 Google Play apps.",

author = "Li Li and Alexandre Bartel and Bissyand{\'e}, {Tegawend{\'e} F.} and Jacques Klein and Traon, {Yves Le} and Steven Arzt and Siegfried Rasthofer and Eric Bodden and Damien Octeau and Patrick McDaniel",

year = "2015",

doi = "10.1109/ICSE.2015.48",

language = "English",

volume = "1",

pages = "280--291",

editor = "Elbaum, {Sebastian } and Canfora, {Gerardo }",

booktitle = "Proceedings - 2015 IEEE/ACM 37th IEEE International Conference on Software Engineering ICSE 2015, Volume 1",

publisher = "IEEE, Institute of Electrical and Electronics Engineers",

address = "United States of America",

note = "International Conference on Software Engineering 2015, ICSE 2015 ; Conference date: 16-05-2015 Through 24-05-2015",

url = "http://2015.icse-conferences.org/, https://ieeexplore.ieee.org/xpl/conhome/7174815/proceeding?isnumber=7194545",

}

Li, L, Bartel, A, Bissyandé, TF, Klein, J, Traon, YL, Arzt, S, Rasthofer, S, Bodden, E, Octeau, D & McDaniel, P 2015, IccTA: detecting inter-component privacy leaks in Android apps. in S Elbaum & G Canfora (eds), Proceedings - 2015 IEEE/ACM 37th IEEE International Conference on Software Engineering ICSE 2015, Volume 1. vol. 1, 7194581, IEEE, Institute of Electrical and Electronics Engineers, Piscataway NJ USA, pp. 280-291, International Conference on Software Engineering 2015, Florence, Italy, 16/05/15. https://doi.org/10.1109/ICSE.2015.48

IccTA : detecting inter-component privacy leaks in Android apps. / Li, Li; Bartel, Alexandre; Bissyandé, Tegawendé F. et al.

Proceedings - 2015 IEEE/ACM 37th IEEE International Conference on Software Engineering ICSE 2015, Volume 1. ed. / Sebastian Elbaum; Gerardo Canfora. Vol. 1 Piscataway NJ USA : IEEE, Institute of Electrical and Electronics Engineers, 2015. p. 280-291 7194581.

Research output: Chapter in Book/Report/Conference proceeding › Conference Paper › Research › peer-review

TY - GEN

T1 - IccTA

T2 - International Conference on Software Engineering 2015

AU - Li, Li

AU - Bartel, Alexandre

AU - Bissyandé, Tegawendé F.

AU - Klein, Jacques

AU - Traon, Yves Le

AU - Arzt, Steven

AU - Rasthofer, Siegfried

AU - Bodden, Eric

AU - Octeau, Damien

AU - McDaniel, Patrick

N1 - Conference code: 37th

PY - 2015

Y1 - 2015

N2 - Shake Them All is a popular "Wallpaper" application exceeding millions of downloads on Google Play. At installation, this application is given permission to (1) access the Internet (for updating wallpapers) and (2) use the device microphone (to change background following noise changes). With these permissions, the application could silently record user conversations and upload them remotely. To give more confidence about how Shake Them All actually processes what it records, it is necessary to build a precise analysis tool that tracks the flow of any sensitive data from its source point to any sink, especially if those are in different components. Since Android applications may leak private data carelessly or maliciously, we propose IccTA, a static taint analyzer to detect privacy leaks among components in Android applications. IccTA goes beyond state-of-the-art approaches by supporting intercomponent detection. By propagating context information among components, IccTA improves the precision of the analysis. IccTA outperforms existing tools on two benchmarks for ICC-leak detectors: DroidBench and ICC-Bench. Moreover, our approach detects 534 ICC leaks in 108 apps from MalGenome and 2,395 ICC leaks in 337 apps in a set of 15,000 Google Play apps.

AB - Shake Them All is a popular "Wallpaper" application exceeding millions of downloads on Google Play. At installation, this application is given permission to (1) access the Internet (for updating wallpapers) and (2) use the device microphone (to change background following noise changes). With these permissions, the application could silently record user conversations and upload them remotely. To give more confidence about how Shake Them All actually processes what it records, it is necessary to build a precise analysis tool that tracks the flow of any sensitive data from its source point to any sink, especially if those are in different components. Since Android applications may leak private data carelessly or maliciously, we propose IccTA, a static taint analyzer to detect privacy leaks among components in Android applications. IccTA goes beyond state-of-the-art approaches by supporting intercomponent detection. By propagating context information among components, IccTA improves the precision of the analysis. IccTA outperforms existing tools on two benchmarks for ICC-leak detectors: DroidBench and ICC-Bench. Moreover, our approach detects 534 ICC leaks in 108 apps from MalGenome and 2,395 ICC leaks in 337 apps in a set of 15,000 Google Play apps.

UR - http://www.scopus.com/inward/record.url?scp=84943159826&partnerID=8YFLogxK

U2 - 10.1109/ICSE.2015.48

DO - 10.1109/ICSE.2015.48

M3 - Conference Paper

AN - SCOPUS:84943159826

VL - 1

SP - 280

EP - 291

BT - Proceedings - 2015 IEEE/ACM 37th IEEE International Conference on Software Engineering ICSE 2015, Volume 1

A2 - Elbaum, Sebastian

A2 - Canfora, Gerardo

PB - IEEE, Institute of Electrical and Electronics Engineers

CY - Piscataway NJ USA

Y2 - 16 May 2015 through 24 May 2015

ER -

Li L, Bartel A, Bissyandé TF, Klein J, Traon YL, Arzt S et al. IccTA: detecting inter-component privacy leaks in Android apps. In Elbaum S, Canfora G, editors, Proceedings - 2015 IEEE/ACM 37th IEEE International Conference on Software Engineering ICSE 2015, Volume 1. Vol. 1. Piscataway NJ USA: IEEE, Institute of Electrical and Electronics Engineers. 2015. p. 280-291. 7194581 https://doi.org/10.1109/ICSE.2015.48

IccTA: detecting inter-component privacy leaks in Android apps

Abstract

Conference

Access to Document

Other files and links

Cite this