Abstract:With millions of apps provided from official and third-party markets, Android has become one of the most active mobile platforms in recent years. These apps facilitate people's lives in a broad spectrum of ways but at the same time touch numerous users' information, raising huge privacy concerns. To prevent leaks of sensitive information, especially from legitimate apps to malicious ones, developers are encouraged to store users' sensitive data into private folders which are isolated and securely protected. But for non-sensitive data, there is no specific guideline on how to manage them, and in many cases, they are simply stored on public storage which lacks fine-grained access control and is almost open to all apps.Such storage model appears to be capable of preventing privacy leaks, as long as the sensitive data are correctly identified and kept in private folders by app developers. Unfortunately, this is not true in reality. In this paper, we carry out a thorough study over a number of Android apps to examine how the sensitive data are handled, and the results turn out to be pretty alarming: most of the apps we surveyed fail to handle the data correctly, including extremely popular apps. Among these problematic apps, some directly store the sensitive data into public storage, while others leave non-sensitive data on public storage which could give out users' private information when being combined with data from other sources. An adversary can exploit these leaks to infer users' location, friends and other information without requiring any critical permission. We refer to both types of data as "non-shared" data, and argue that Android's storage model should be refined to protect the non-shared data if they are saved to public storage. In the end, we propose several approaches to mitigate such privacy leaks.

Certified Copy? Understanding Security Risks of Wi-Fi Hotspot Based Android Data Clone Services

Taming Information-Stealing Smartphone Applications (On Android)

Systematic Detection of Capability Leaks in Stock Android Smartphones.

Detecting capability leaks in Android-based smartphones

AppShell: Making Data Protection Practical for Lost or Stolen Android Devices

Why is My Secret Leaked? Discovering Vulnerabilities in Device-to-Device File Sharing

App's Auto-Login Function Security Testing via Android OS-Level Virtualization

Security Analysis of Mobile Device-to-Device Network Applications

Appcracker: Widespread vulnerabilities in user and session authentication in mobile apps

An Empirical Study of Insecure Communication in Android Apps

SIMulation: Demystifying (insecure) Cellular Network Based One-Tap Authentication Services

Oh-Pwn-Vpn! Security Analysis Of Openvpn-Based Android Apps

An Empirical Analysis of Hazardous Uses of Android Shared Storage.

The Untold Secrets of Operational Wi-Fi Calling Services: Vulnerabilities, Attacks, and Countermeasures

Clone detection in 5G-enabled social IoT system using graph semantics and deep learning model

An Empirical Study On Android For Saving Non-Shared Data On Public Storage

Security Apps under the Looking Glass: An Empirical Analysis of Android Security Apps

NoPTPeer:Protecting Android Devices from Stealthy Spoofing and Stealing in WLANs without Privilege

Security Analysis of Top-Ranked mHealth Fitness Apps: An Empirical Study

Code Security of Mobile Backup Modules on the Android Platform

App in the Middle