Abstract:Due to the rapid increase of Android apps and their wide usage to handle personal data, a precise and large-scaling checker is in need to validate the apps' permission flow before they are listed on the market. Several tools have been proposed to detect sensitive data leaks in Android apps. But these tools are not applicable to large-scale analysis since they fail to deal with the arbitrary execution orders of different event handlers smartly. Event handlers are invoked by the framework based on the system state, therefore we cannot pre-determine their order of execution. Besides, since all exported components can be invoked by an external app, the execution orders of these components are also arbitrary. A naive way to simulate these two types of arbitrary execution orders yields a permutation of all event handlers in an app. The time complexity is O(n!) where n is the number of event handlers in an app. This leads to a high analysis overhead when n is big. To give an illustration, CHEX [10] found 50.73 entry points of 44 unique class types in an app on average. In this paper we propose an improved static taint analysis to deal with the challenge brought by the arbitrary execution orders without sacrificing the high precision. Our analysis does not need to make permutations and achieves a polynomial time complexity. We also propose to unify the array and map access with object reference by propagating access paths to reduce the number of false positives due to field-insensitivity and over approximation of array access and map access. We implement a tool, WeChecker, to detect privilege escalation vulnerabilities [7] in Android apps. WeChecker achieves 96% precision and 96% recall in the state-of-the-art test suite DriodBench (for compairson, the precision and recall of FlowDroid [1] are 86% and 93%, respectively). The evaluation of WeChecker on real apps shows that it is efficient (average analysis time of each app: 29.985s) and fits for large-scale checking.

Apples and Oranges: Detecting Least-Privilege Violators with Peer Group Analysis

SPA: Inviting Your Friends to Help Set Android Apps.

Detecting Privilege Escalation Attacks through Instrumenting Web Application Source Code.

Privilege Escalation Detecting in Android Applications.

On the Importance of Performing App Analysis Within Peer Groups

Implementing the principle of least administrative privilege on operating systems: challenges and perspectives

Making Least Privilege The Low-Hanging Fruit In Clouds

WeChecker: efficient and precise detection of privilege escalation vulnerabilities in Android apps.

Enforcing the principle of least privilege with a state-based privilege control model

AppScalpel: Combining Static Analysis and Outlier Detection to Identify and Prune Undesirable Usage of Sensitive Data in Android Applications

Program Behavior Analysis and Clustering using Performance Counters

"If You Can't Beat them, Join them": A Usability Approach to Interdependent Privacy in Cloud Apps

Exposed! A case study on the vulnerability-proneness of Google Play Apps

MiniChecker: Detecting Data Privacy Risk of Abusive Permission Request Behavior in Mini-Programs

User-aware Privacy Control Via Extended Static-Information-flow Analysis

Detection of App Collusion Potential Using Logic Programming

Technology of detection for privilege escalation attack on Android

Malicious Crowdsourcing Worker Detection Using Privacy-Aware Group Queries.

AppHolmes: Detecting and Characterizing App Collusion among Third-Party Android Markets.

Method of Android Applications Permission Detection Based on Static Dataflow Analysis

Peer-group Behaviour Analytics of Windows Authentications Events Using Hierarchical Bayesian Modelling