Broken Relationship of Mobile User Intentions and Permission Control of Shared System Resources
Hao Wu,Zheng Qin,Xuejin Tian,Edward Sun,Fengyuan Xu,Sheng Zhong
DOI: https://doi.org/10.1109/dsc47296.2019.8937600
2019-01-01
Abstract:Android, which accounts for 76.08% of the market(1), is the most popular and widely used mobile system today. Users install various applications from different sources and for different functionalities to get all sorts of services. Since smartphones carry a large amount of private user information, their security has been widely concerned in recent years. Android uses permissions to restrict the behaviors of applications and protect system resources and user privacy, such as location, password, and contact list carried on mobile devices. The research community has previously explored a variety of methods to enhance the permission system with the help of the system context and application program. However, such methods cannot address the permission violation issues raised by resources sharing, e.g., screen sharing and clipboard sharing, which are designed for more convenient human-computer interactions. In this work, we perform several proof-of-concept attacks on resources sharing to illustrate the deficiencies in the permission control system. We believe that the cause of these issues is that the permission control system does not fully understand the user's intentions. Then, we propose a non-intrusive user-action based permission control system, which can achieve more precise permission control by mining the user's intentions when operating the device.