Abstract:A long-standing challenge in analyzing information leaks within mobile apps is to automatically identify the code operating on sensitive data. With all existing solutions relying on System APIs (e.g., IMEI, GPS location) or features of user interfaces (UI), the content from app servers, like user’s Facebook profile, payment history, fall through the crack. Finding such content is important given the fact that most apps today are web applications, whose critical data are often on the server side. In the meantime, operations on the data within mobile apps are often hard to capture, since all server-side information is delivered to the app in the same way, sensitive or not. A unique observation of our research is that in modern apps, a program is essentially a semantics-rich documentation carrying meaningful program elements such as method names, variables and constants that reveal the sensitive data involved, even when the program is under moderate obfuscation. Leveraging this observation, we develop a novel semantics-driven solution for automatic discovery of sensitive user data, including those from the server side. Our approach utilizes natural language processing (NLP) to automatically locate the program elements (variables, methods, etc.) of interest, and then performs a learning-based program structure analysis to accurately identify those indeed carrying sensitive content. Using this new technique, we analyzed 445,668 popular apps, an unprecedented scale for this type of research. Our work brings to light the pervasiveness of information leaks, and the channels through which the leaks happen, including unintentional over-sharing across libraries and aggressive data acquisition behaviors. Further we found that many high-profile apps and libraries are involved in such leaks. Our findings contribute to a better understanding of the privacy risk in mobile apps and also highlight the importance of data protection in today’s software composition.

Taintmini: Detecting Flow of Sensitive Data in Mini-Programs with Static Taint Analysis.

Wemint:Tainting Sensitive Data Leaks in WeChat Mini-Programs

Do as You Say: Consistency Detection of Data Practice in Program Code and Privacy Policy in Mini-App

TaintStream: Fine-Grained Taint Tracking for Big Data Platforms Through Dynamic Code Translation

Taming Information-Stealing Smartphone Applications (On Android)

MiniScope: Automated UI Exploration and Privacy Inconsistency Detection of MiniApps via Two-phase Iterative Hybrid Analysis

NDroid: Toward Tracking Information Flows Across Multiple Android Contexts.

Utilizing Large LanguageModels to Detect Privacy Leaks in Mini-App Code

On the Usage-scenario-based Data Minimization in Mini Programs.

TaintDroid

TaintART: A Practical Multi-level Information-Flow Tracking System for Android RunTime.

LeakMiner: Detect Information Leakage on Android with Static Taint Analysis

User-aware Privacy Control Via Extended Static-Information-flow Analysis

Identifying Cross-User Privacy Leakage in Mobile Mini-Apps at a Large Scale

TaintSQL: Dynamically Tracking Fine-Grained Implicit Flows for SQL Statements

DETECTION OF ANDROID PRIVACY LEAK BASED ON DYNAMIC TAINT ANALYSIS

Finding Clues for Your Secrets: Semantics-Driven, Learning-Based Privacy Discovery in Mobile Apps

Don't Leak Your Keys: Understanding, Measuring, and Exploiting the AppSecret Leaks in Mini-Programs

A Small Leak Will Sink Many Ships: Vulnerabilities Related to Mini Programs Permissions

SpyAware: Investigating the Privacy Leakage Signatures in App Execution Traces

Scaling static taint analysis to industrial SOA applications: a case study at Alibaba