Abstract:Dynamic taint analysis (DTA), as a mainstream information flow tracking technique, has been widely used in mobile security. On the Android platform, the existing DTA approaches are typically implemented by instrumenting the Dalvik virtual machine (DVM) interpreter or the Android emulator with taint enforcement code. The most prominent problem of the interpreter-based approaches is that they cannot work in the new Android RunTime (ART) environment introduced since the 5.0 release. For the emulator-based approaches, the most prominent problem is that they cannot be deployed on real devices. In addition, almost all the existing Android DTA approaches only concern the explicit information flow caused by data dependence, while completely ignore the impact of implicit information flow caused by control dependence. These problems limit their adoption in the latest Android system and make them ineffective in detecting the state-of-the-art malware whose privacy-breaching behaviors are inactivated in the analyzed environment (e.g., the emulator) or conducted via implicit information flow. In this paper, we present TaintMan, an ART-compatible DTA framework that can be deployed on unmodified and non-rooted Android devices. In TaintMan, the taint enforcement code is statically instrumented into both the target application and the system class libraries to track data flow and common control flow. A specially designed execution environment reconstruction technique, named reference hijacking, is proposed to force the target application to reference the instrumented system class libraries. By enforcing on-demand instrumentation and on-demand tracking, the performance overhead is significantly reduced. We have developed TaintMan and deployed it on two popular stock smartphones (HTC One S equipped with Android-4.0 and Motorola MOTO G equipped with Android-5.0). The evaluation with malware samples and real-world applications shows that TaintMan can effectively detect privacy leakage behaviors with an acceptable performance overhead.

DETECTION OF ANDROID PRIVACY LEAK BASED ON DYNAMIC TAINT ANALYSIS

Dynamic Detection of Android Privacy Leakage based on Permission Analysis

A Privacy Leakage Detection System for Android

AUTOMATICALLY DETECTING PRIVACY LEAKS OF ANDROID APPLICATIONS

TaintMan: an ART-Compatible Dynamic Taint Analysis Framework on Unmodified and Non-Rooted Android Devices

Detecting Passive Content Leaks and Pollution in Android Applications.

NDroid: Toward Tracking Information Flows Across Multiple Android Contexts.

Taming Information-Stealing Smartphone Applications (On Android)

Privacy data leakage detection for Android application

LeakMiner: Detect Information Leakage on Android with Static Taint Analysis

Execution Enhanced Static Detection of Android Privacy Leakage Hidden by Dynamic Class Loading

TaintDroid

TaintART: A Practical Multi-level Information-Flow Tracking System for Android RunTime.

Dynamic Privacy Protection Model Based on Android Permissions

Automatic Privacy Leakage Detection for Massive Android Apps Via a Novel Hybrid Approach.

Practical Static Analysis of Detecting Intent-Based Permission Leakage in Android Application

A Privacy Stealing Detection Method Based on Behavior-Chain for Android Applications

AppIntent: analyzing sensitive data transmission in android for privacy leakage detection.

SpyAware: Investigating the Privacy Leakage Signatures in App Execution Traces

A Privacy Enforcement Framework for Android Systems Using Symbolic Execution-Based Instrumentation

Android's Sensitive Data Leakage Detection Based on API Monitoring