DAISY: Dynamic-Analysis-Induced Source Discovery for Sensitive Data

Third-party libraries (TPLs) as essential parts in the mobile ecosystem have become one of the most significant contributors to the huge success of Android, which facilitate the fast development of Android applications. Detecting TPLs in Android apps is also important for downstream tasks, such as malware and repackaged apps identification. To identify in-app TPLs, we need to solve several challenges, such as TPL dependency, code obfuscation, precise version representation. Unfortunately, existing TPL detection tools have been proved that they have not solved these challenges very well, let alone specify the exact TPL versions. To this end, we propose a system, named ATVHunter, which can pinpoint the precise vulnerable in-app TPL versions and provide detailed information about the vulnerabilities and TPLs. We propose a two-phase detection approach to identify specific TPL versions. Specifically, we extract the Control Flow Graphs as the coarse-grained feature to match potential TPLs in the predefined TPL database, and then extract opcode in each basic block of CFG as the fine-grained feature to identify the exact TPL versions. We build a comprehensive TPL database (189,545 unique TPLs with 3,006,676 versions) as the reference database. Meanwhile, to identify the vulnerable in-app TPL versions, we also construct a comprehensive and known vulnerable TPL database containing 1,180 CVEs and 224 security bugs. Experimental results show ATVHunter outperforms state-of-the-art TPL detection tools, achieving 90.55% precision and 88.79% recall with high efficiency, and is also resilient to widely-used obfuscation techniques and scalable for large-scale TPL detection. Furthermore, to investigate the ecosystem of the vulnerable TPLs used by apps, we exploit ATVHunter to conduct a large-scale analysis on 104,446 apps and find that 9,050 apps include vulnerable TPL versions with 53,337 vulnerabilities and 7,480 security bugs, most of which are with high risks and are not recognized by app developers.

Third-party libraries (TPLs) have become a significant part of the Android ecosystem. Developers can employ various TPLs to facilitate their app development. Unfortunately, the popularity of TPLs also brings new security issues. For example, TPLs may carry malicious or vulnerable code, which can infect popular apps to pose threats to mobile users. Furthermore, TPL detection is essential for downstream tasks, such as vulnerabilities and malware detection. Thus, various tools have been developed to identify TPLs. However, no existing work has studied these TPL detection tools in detail, and different tools focus on different applications and techniques with performance differences. A comprehensive understanding of these tools will help us make better use of them. To this end, we conduct a comprehensive empirical study to fill the gap by evaluating and comparing all publicly available TPL detection tools based on six criteria: accuracy of TPL construction, effectiveness, efficiency, accuracy of version identification, resiliency to code obfuscation, and ease of use. Besides, we enhance these open-source tools by fixing their limitations, to improve their detection ability. Finally, we build an extensible framework that integrates all existing available TPL detection tools, providing an online service for the research community. We release the evaluation dataset and enhanced tools. According to our study, we also present the essential findings and discuss promising implications to the community; e.g., 1) Most existing TPL detection techniques more or less depend on package structure to construct in-app TPL candidates. However, using package structure as the module decoupling feature is error-prone. We hence suggest future researchers using the class dependency to substitute package structure. 2) Extracted features include richer semantic information (e.g., class dependencies) can achieve better resiliency to code obfuscation. 3) Existing tools usually have a low recall; that is because previous tools ignore some features of Android apps and TPLs, such as the compilation mechanism, the new format of TPLs, TPL dependency. Most existing tools cannot effectively find partial import TPLs, obfuscated TPLs, which directly limit their capability. 4) Existing tools are complementary to each other; we can build a better tool via combining the advantages of each tool. We believe our work provides a clear picture of existing TPL detection techniques and also gives a road-map for future research.

Factors such as app stores or platform choices heavily affect functional and non-functional mobile app requirements. We surveyed 45 companies and interviewed ten experts to explore how factors that impact mobile app requirements are understood by requirements engineers in the mobile app industry. We observed the lack of knowledge in several areas. For instance, we observed that all practitioners were aware of data privacy concerns, however, they did not know that certain third-party libraries, usage aggregators, or advertising libraries also occasionally leak sensitive user data. Similarly, certain functional requirements may not be implementable in the absence of a third-party library that is either banned from an app store for policy violations or lacks features, for instance, missing desired features in ARKit library for iOS made practitioners turn to Android. We conclude that requirements engineers should have adequate technical experience with mobile app development as well as sufficient knowledge in areas such as privacy, security and law, in order to make informed decisions during requirements elicitation.

Dynamic privacy leakage analysis of Android third-party libraries

Developers of mobile applications rely on the trust of their customers. On the one hand the requirement exists to create feature-rich and secure apps, which adhere to privacy standards to not deliberately disclose user information. On the other hand the development process must be streamlined to reduce costs. Here third-party libraries come into play. Inclusion of many, possibly nested libraries pose security risks, app-creators are often not aware of. This paper presents a way to combine free open-source tools to support developers in checking their application that it does not induce security issues by using third-party libraries. The tools FlowDroid, Frida, and mitm-proxy are used in combination in a simple and viable way to perform checks to identify privacy leaks of third-party apps. Our proposed setup and configuration empowers average app developers to preserve user privacy without being dedicated security experts and without expensive external advice.

Mobile apps are critical in supporting the Indonesian provincial government during daily operations. Regarding their important role, these apps are the potential to become a target of malicious activity to gain access to government information. Hence, in this research, we conduct a security measurement of mobile apps affiliated with the provincial governments in Indonesia, aiming to provide a source of information for the app's developer to make further security improvements. To the best of our knowledge, this is the first study to conduct an empirical analysis related to this area, expecting to become a cornerstone for further research. In total, we found 162 mobile apps available on the Google Play Store and correlated to 31 province governments in Indonesia. We conducted standard mobile apps static analysis method, starting from metadata scraping of each provincial government-affiliated app available at the Google Play Store and measured their security based on several indicators, including access to sensitive permission, unprotected exported components, the adoption of binary protection mechanism, and the appearance of third-party tracker libraries. We found that 27.1% (44) government apps request at least two dangerous permission, over 5% of the apps embed the Advertisement library, 10% of the apps have more than five exported Activities, and 44 (25.94%) Indonesian government apps did not adopt any binary protection mechanism. Hence, these results can be tailored as a reference for the provincial government in determining the level of effectiveness and impact of an app when developing mobile-based software in the future.

The adoption of blockchain technology in prevalent applications has substantially increased the use of blockchain wallets. Even though consensus, cryptography, and decentralization make blockchain data structures pretty safe, it’s still hard to protect sensitive data at endpoints because each new block of data connects to all the previous blocks in a nearly unbreakable way. Thus, we seek to improve upon data security and transaction ease. Blockchain wallet store most of the users’ sensitive data in the form - namely initial-seed, private, public keys and other sensitive asset information. In order, we propose to attain sensitive data protection using an air-gapped hardware wallet and transactional privacy by hashing the transaction with the blake3 algorithm. More precisely, the mechanism consists of a credit card-sized air- gapped hardware wallet owned only by each party. Along with the wallet, a mobile app ‘‘Crypto-Trans’’ for certificate verification is introduced which acts as an interface between the hardware wallet and the blockchain. Last but not least, the proposed wallet is compared to existing wallets on key parameters to establish its relative superiority in terms of effectiveness and efficiency.

An efficient perturbation approach for multivariate data in sensitive and reliable data mining

It is commonly assumed that “free” mobile apps come at the cost of consumer privacy and that paying for apps could offer consumers protection from behavioral advertising and long-term tracking. This work empirically evaluates the validity of this assumption by comparing the privacy practices of free apps and their paid premium versions, while also gauging consumer expectations surrounding free and paid apps. We use both static and dynamic analysis to examine 5,877 pairs of free Android apps and their paid counterparts for differences in data collection practices and privacy policies between pairs. To understand user expectations for paid apps, we conducted a 998-participant online survey and found that consumers expect paid apps to have better security and privacy behaviors. However, there is no clear evidence that paying for an app will actually guarantee protection from extensive data collection in practice. Given that the free version had at least one thirdparty library or dangerous permission, respectively, we discovered that 45% of the paid versions reused all of the same third-party libraries as their free versions, and 74% of the paid versions had all of the dangerous permissions held by the free app. Likewise, our dynamic analysis revealed that 32% of the paid apps exhibit all of the same data collection and transmission behaviors as their free counterparts. Finally, we found that 40% of apps did not have a privacy policy link in the Google Play Store and that only 3.7% of the pairs that did reflected differences between the free and paid versions.

Data leakage is a critical threat to app developers because apps use and reserve a variety of sensitive data collected from users. While using third-party SDK is a common way to build apps, some accessed data may not be perceived by app developers. Therefore, the use of third-party SDKs may cause data leakage. This work proposes a platform named "WaRning-Awareness Platform" (WRAP). WRAP records profiles of SDKs, and reveals sensitive data accessed by SDKs. To demonstrate the data leakage caused by third-party SDKs, this work conducts a case study with various categories of Android apps. The result of our case study indicates that if app developers do not pay attention to the accessed data, the data would be leaked.

A Lot of documents in many organizations from companies to governments are shared on on-premise storage or clouds. And some of those documents may contain sensitive information such as names, social security numbers, addresses and so on. Especially a large amount of sensitive information written in Korean have been leaked nowadays. It can be severe problems to not only individuals but also many organizations. Therefore, for information protection, data loss prevention (DLP) has been needed. DLP systems based on pattern matching were popular in the past. But they have a difficulty handling new type of sensitive data whenever they come. To handle this problem, sensitive data identification with NER is proposed as a useful method of DLP system. By using NER, we can classify the words in a document into categories which consist of name, location and so on. These categories are considered as sensitive information. This approach shows good performance identifying information in unstructured data(e.g. sentences) which have contextual information whereas it has a weakness identifying sensitive information in structured data (e.g. personal names in cells of the table). Actually, a large amount of sensitive information is organized in structured data and the form of structured data varies depending on the document. Furthermore, it also has difficulties identifying data written in Korean because of its characteristics. We proposed a primary preventive measure of DLP by identifying sensitive data in tables of Korean documents combining text generation and NER models regardless of the form of tables and masking them as to share documents without disclosing sensitive information.

Lack of supervision and management of many Android third-party application markets has led to a growing number of malware on android platforms. This causes a serious privacy threat to the user’s sensitive information. To solve this problem, in this paper, a new hybrid features analysis method aiming at Android malware detection is proposed, which obtains a hybrid feature vector by extracting the information of permission requests, API calls and runtime behaviors. The characteristic of this work is the use of machine learning classification algorithms to detect malicious software. In addition, the feature selection algorithm is used to further optimize the extracted information to remove some useless features. Our experiments are based on real-world Apps, and use five different classification algorithms to detect the malware. The experiment results show that our proposed hybrid feature extraction method can improve the accuracy rate of Android malware detection compared with using static methods alone.

Edge computing has emerged as a promising paradigm for delay-sensitive and context-aware IoT data analytics, through migrating data processing from the cloud to the edge of the network. However, traditional solutions adopting homomorphic encryption to achieve data protection and aggregation at edge servers are infeasible because of their heavy computational overhead. How to preserve data privacy while guaranteeing data utility in edge computing becomes an extremely important problem for IoT data analytics. In this article, we propose a local differential privacy obfuscation (LDPO) framework for IoT data analytics to aggregate and distill the IoT data at the edge without disclosing users' sensitive data. We first introduce the architecture and benefits of the LDPO framework, followed by some technical challenges in guaranteeing its performance. Then we present a preliminary implementation of the LDPO framework, and validate its performance in terms of privacy preservation level and data utility using real-world apps and datasets. Some future directions are finally envisioned for further research.

In 2013, the global mobile app market was estimated at over US$50 billion and is expected to grow to $150 billion in the next two years. In this paper, we build a structural econometric model to quantify the vibrant platform competition between mobile (smartphone and tablet) apps on the Apple iOS and Google Android platforms and estimate consumer preferences toward different mobile app characteristics. We find that app demand increases with the in-app purchase option wherein a user can complete transactions within the app. On the contrary, app demand decreases with the in-app advertisement option where consumers are shown ads while they are engaging with the app. The direct effects on app revenue from the inclusion of an in-app purchase option and an in-app advertisement option are equivalent to offering a 28% price discount and increasing the price by 8%, respectively. We also find that a price discount strategy results in a greater increase of app demand in Google Play compared with Apple App Store, and app developers can maximize their revenue by providing a 50% discount on their paid apps. Using the estimated demand function, we find that mobile apps have enhanced consumer surplus by approximately $33.6 billion annually in the United States, and we discuss various implications for mobile marketing analytics, app pricing, and app design strategies.This paper was accepted by Alok Gupta, special issue on business analytics.

FDA’s Streamlined Health App Approval: Better for Patients or Companies?