Authors:
Michele Guerra
;
Roberto Milanese
;
Rocco Oliveto
and
Fausto Fasano
Affiliation:
University of Molise, Italy
Keyword(s):
Security, Privacy, Application Security, App Permission, Android, Dynamic Analysis, Android Permission Model.
Abstract:
Over the years, there has been an explosion in the app market offering users a wide range of functionalities especially since modern devices are equipped with many hardware resources such as cameras, GPS, and so on. Unfortunately, this is sometimes associated to indiscriminate access to sensitive data. This exposes users to security and privacy risks because, although resource usage requires explicit user authorization, once permission is granted, a mobile application is usually free to access the corresponding resource until the permission is expressly revoked or the app is uninstalled. In this work, we introduce RPCDroid, a dynamic analysis tool for run-time tracking of the behavior (UI events and used permissions) of Android mobile applications that use device resources requiring dangerous permissions. We assessed the effectiveness of the tool to identify usage contexts, discriminating between different kinds of access to the same sensitive resource. We executed RPCDroid on a set
of popular applications obtaining evidence that, in many cases, mobile applications access to the same resource though different user interactions.
(More)