Abstract:Dynamic taint analysis (DTA), as a mainstream information flow tracking technique, has been widely used in mobile security. On the Android platform, the existing DTA approaches are typically implemented by instrumenting the Dalvik virtual machine (DVM) interpreter or the Android emulator with taint enforcement code. The most prominent problem of the interpreter-based approaches is that they cannot work in the new Android RunTime (ART) environment introduced since the 5.0 release. For the emulator-based approaches, the most prominent problem is that they cannot be deployed on real devices. In addition, almost all the existing Android DTA approaches only concern the explicit information flow caused by data dependence, while completely ignore the impact of implicit information flow caused by control dependence. These problems limit their adoption in the latest Android system and make them ineffective in detecting the state-of-the-art malware whose privacy-breaching behaviors are inactivated in the analyzed environment (e.g., the emulator) or conducted via implicit information flow. In this paper, we present TaintMan, an ART-compatible DTA framework that can be deployed on unmodified and non-rooted Android devices. In TaintMan, the taint enforcement code is statically instrumented into both the target application and the system class libraries to track data flow and common control flow. A specially designed execution environment reconstruction technique, named reference hijacking, is proposed to force the target application to reference the instrumented system class libraries. By enforcing on-demand instrumentation and on-demand tracking, the performance overhead is significantly reduced. We have developed TaintMan and deployed it on two popular stock smartphones (HTC One S equipped with Android-4.0 and Motorola MOTO G equipped with Android-5.0). The evaluation with malware samples and real-world applications shows that TaintMan can effectively detect privacy leakage behaviors with an acceptable performance overhead.

FlowWalker: A Fast and Precise Off-Line Taint Analysis Framework

A practical off-line taint analysis framework and its application in reverse engineering of file format

OFFDTAN: A New Approach of Offline Dynamic Taint Analysis for Binaries

Dytaint: the Implementation of a Novel Lightweight 3-State Dynamic Taint Analysis Framework for X86 Binary Programs.

P-DATA: A Task-Level Parallel Framework for Dependency-Aware Value Flow Taint Analysis

FastDroid: Efficient Taint Analysis for Android Applications

An Efficient Approach for Taint Analysis of Android Applications

Design and Implementation of an Efficient Container Tag Dynamic Taint Analysis

WhirlingFuzzwork: a taint-analysis-based API in-memory fuzzing framework

HardTaint: Production-Run Dynamic Taint Analysis via Selective Hardware Tracing

Coarse-grained Dynamic Taint Analysis for Defeating Control and Non-control Data Attacks

Taint Analysis Method Based on Offline Indices of Instruction Trace

TaintMan: an ART-Compatible Dynamic Taint Analysis Framework on Unmodified and Non-Rooted Android Devices

DepTaint

Android Static Taint Analysis Based on Multi Branch Search Association

Constructing a Hybrid Taint Analysis Framework for Diagnosing Attacks on Binary Programs

Control Flow Obfuscation with Information Flow Tracking

Scaling static taint analysis to industrial SOA applications: a case study at Alibaba

TaintART: A Practical Multi-level Information-Flow Tracking System for Android RunTime.

Transparent and Efficient CFI Enforcement with Intel Processor Trace

Analyst-Oriented Taint Analysis by Taint Path Slicing and Aggregation