Leave Me Alone: App-Level Protection against Runtime Information Gathering on Android

The pervasiveness of mobile apps in everyday life necessitates robust testing strategies to ensure quality and efficiency, especially through end-to-end usage-based tests for mobile apps' user interfaces (UIs). However, manually creating and maintaining such tests can be costly for developers. Since many apps share similar functionalities beneath diverse UIs, previous works have shown the possibility of transferring UI tests across different apps within the same domain, thereby eliminating the need for writing the tests manually. However, these methods have struggled to accommodate real-world variations, often facing limitations in scenarios where source and target apps are not very similar or fail to accurately transfer test oracles. This paper introduces an innovative technique, LLMigrate, which leverages Large Language Models (LLMs) to efficiently transfer usage-based UI tests across mobile apps. Our experimental evaluation shows LLMigrate can achieve a 97.5% success rate in automated test transfer, reducing the manual effort required to write tests from scratch by 91.1%. This represents an improvement of 9.1% in success rate and 38.2% in effort reduction compared to the best-performing prior technique, setting a new benchmark for automated test transfer.

With millions of apps competing in the market, one major issue for app developers is to get their apps discovered by intended users. iOS App Store Search Advertisement (ASA) is a mechanism that provides app developers a chance to increasing the awareness of their apps within the iOS App Store by bidding related searching keywords. However, as one of the most efficient methods to promoting apps, ASA has not been touched by our research community, to the best of our knowledge. To fill the void, in this paper, we present the first large scale explorative study on understanding iOS app store search advertising. Specifically, we have created the first dataset on ASA promotion, covering over 47K popular apps across 22 categories and over 2.8 million ASA bidding keywords during the first week of 2021. Based on this dataset, we investigate the adoption of ASA in the wild and the characteristics of the bidding keywords. Furthermore, we created a large-scale app-keyword relation graph, based on which we infer the app competitive relations. We observed two types of app competitive relations, i.e., explicit competition that the advertised apps intended to attract users who search the corresponding target apps by embedding their names into the ASA keywords, and implicit competitions that apps share a large portion of bidding keywords with others. Our efforts reveal interesting implications to stakeholders in the mobile app ecosystem, including app markets and app developers, etc. our study is the first step towards understanding and improving the in-market mobile app promotion mechanisms.

When a software implementation of a security system is considered, side channel attacks are on the spot threat. Side-channel attacks, considered in this work, are a class of physical attacks in which an adversary tries to exploit physical information leakages such as timing information, power consumption, or electromagnetic radiation to estimate security system parameters during performing security algorithms. New system architecture features, such as larger cache sizes and multicore processors, have increased the prevalence of side channels, in addition to, the availability of measurement apparatuses to an attacker. Thus, software developers must be aware of the potential for side-channel attacks and plan appropriately. In this paper, we propose a software implementation of a hashing method based on SHA3-512 hashing algorithm that can counteract the side-channel attacks. To achieve our goal, we use three techniques, first, we shuffle the dataset, salt, and process selector arrays using "Fisher Yates" algorithm. Second, we use volatile memory objects to hold critical data. Finally, we apply the thread locking technique where at most one thread can access the critical objects at a time. Experimental results show that our proposed hashing method is more secure than other related methods. Although there is a trade-off between hashing security and hashing processing time, the processing time of the proposed hashing method is still acceptable.

Mobile apps are critical in supporting the Indonesian provincial government during daily operations. Regarding their important role, these apps are the potential to become a target of malicious activity to gain access to government information. Hence, in this research, we conduct a security measurement of mobile apps affiliated with the provincial governments in Indonesia, aiming to provide a source of information for the app's developer to make further security improvements. To the best of our knowledge, this is the first study to conduct an empirical analysis related to this area, expecting to become a cornerstone for further research. In total, we found 162 mobile apps available on the Google Play Store and correlated to 31 province governments in Indonesia. We conducted standard mobile apps static analysis method, starting from metadata scraping of each provincial government-affiliated app available at the Google Play Store and measured their security based on several indicators, including access to sensitive permission, unprotected exported components, the adoption of binary protection mechanism, and the appearance of third-party tracker libraries. We found that 27.1% (44) government apps request at least two dangerous permission, over 5% of the apps embed the Advertisement library, 10% of the apps have more than five exported Activities, and 44 (25.94%) Indonesian government apps did not adopt any binary protection mechanism. Hence, these results can be tailored as a reference for the provincial government in determining the level of effectiveness and impact of an app when developing mobile-based software in the future.

Intel Software Guard Extension (SGX) protects the confidentiality and integrity of an unprivileged program running inside a secure enclave from a privileged attacker who has full control of the entire operating system (OS). Program execution inside this enclave is therefore referred to as shielded. Unfortunately, shielded execution does not protect programs from side-channel attacks by a privileged attacker. For instance, it has been shown that by changing page table entries of memory pages used by shielded execution, a malicious OS kernel could observe memory page accesses from the execution and hence infer a wide range of sensitive information about it. In fact, this page-fault side channel is only an instance of a category of side-channel attacks, here called privileged side-channel attacks, in which privileged attackers frequently preempt the shielded execution to obtain fine-grained side-channel observations. In this paper, we present Deja Vu, a software framework that enables a shielded execution to detect such privileged side-channel attacks. Specifically, we build into shielded execution the ability to check program execution time at the granularity of paths in its control-flow graph. To provide a trustworthy source of time measurement, Deja Vu implements a novel software reference clock that is protected by Intel Transactional Synchronization Extensions (TSX), a hardware implementation of transactional memory. Evaluations show that Deja Vu effectively detects side-channel attacks against shielded execution and against the reference clock itself.

The CPU architecture landscape is constantly evolving to optimize performance. However, this has inadvertently exposed vulnerabilities such as microarchitectural traces that can be exploited in side-channel attacks. The Branch Prediction Unit (BPU) plays a critical role in improving processor performance, but also introduces vulnerabilities to microarchitectural side-channel attacks. Despite ongoing efforts to develop defensive techniques, the continued emergence of new attack methods underscores the need for comprehensive analysis. This article aims to address this research gap by conducting a thorough investigation of BPU-based side-channel attacks. This survey presents a novel taxonomy for the systematic classification of BPU-based side-channel attacks and defenses. The attacks and defenses are categorized based on three components: manipulated unit, core technique, and disclosure method. The analysis provides a structured evaluation of the effectiveness of defense techniques against each attack technique. This study not only enhances the understanding of BPU exploitation, but also provides valuable insights for software developers and CPU designers to help them protect against evolving side-channel threats.

Side-channel attacks are a prominent threat to the security of cryptographic implementations. Differently from the traditional black-box attacks, which exploit the inputs and outputs of cryptographic schemes, side-channel attacks partially access the inner working of the scheme as well, by observing the physical leakage emitted by the device executing cryptographic algorithms. A notable example is the class of power-analysis attacks, which exploits the power consumption of the underlying device to recover the secret keys of the implemented cryptosystem. Since their first presentation in the late 1990s, the problem of securing cryptographic systems in the presence of side-channel leakages received significant attention by the cryptographic community. In particular, the theory community has concentrated its research efforts on formally modeling the side-channel leakages and on designing cryptographic schemes \textit{provably} secure in such leakage models. However, conceiving a formal model that realistically captures possible physical leakages and constructing primitives sufficiently efficient to be deployed in practice are still challenging research objectives. This research area is usually referred to as leakage-resilient cryptography. In this dissertation, we examine three main research directions. The first one focuses on the technique of masking, which is the most popular approach to counteract power-analysis attacks. In this context, our work analyzes possible methods to improve the efficiency of masked implementations, with the goal of overcoming the decrease in performance, which is a common drawback of masking. In particular, we provide new and more efficient algorithms for the computation of basic operations in two kinds of masking schemes: the Boolean masking and the Inner Product masking. The second research direction of this work addresses the problem of formalizing security requirements for hardware implementations. While provable security of software-oriented masking has been studied since the origin of leakage resilient cryptography, the more complex task of formally proving the security of hardware-oriented masking is receiving attention by the community only recently. We discuss the different challenges of this field, and we introduce a new theoretical model, the robust probing model, capturing the conditions required for securely implementing complex algorithms in practice, providing a guide to practical implementers. Finally, the last part of this work is concerned with the protection of algorithms employed in lattice-based constructions, which are studied in the field of post-quantum cryptography. While several works investigate the application of masking schemes to standard cryptosystems, for most post-quantum schemes this is still an ongoing research. We contribute to this research area, by applying the masking countermeasure to a binomial sampler which is at the base of many lattice-based cryptosystems.

Microelectronic crypto devices contain intellectual property like secret data to be protected against side channel attack. Scan chain based attacks come under the category of side channel attack where the hackers attack a scan path through observing and comparing the relationship between intermediate hamming distances values for different test vector patterns. Hence our novel hamming model should overcome the scan based attack and should not give any correlation relationship in hamming distance by providing the similar intermediate values for all test vector patterns which are obtained through an optimal way of inserting Optimal Scan Flip Flop (OSFF) randomly to the scan path chain. Implementation of our proposed integrated circuits is written in Verilog and synthesised with XILINX Spartan III FPGA. The report is compared with Robust Scan Flip Flop (RFSS) hamming model to estimate the overhead of component minimized in OSFF.

Security in embedded systems is considered to be more important and needs to be a diagnosis for every minute. Also with the advent of the Internet of Things (IoT), security in the embedded system has reached its new peak of dimension. A Mathematically secure algorithm was formulated and runs on the cryptographic chips which are embedded in the systems, but secret keys can be at risk and even information can be retrieved by the prominent side-channel attacks. Fixed encryption keys, non-intelligent detection of side-channel attacks are some of the real-time challenges in an existing system of encryption. Following the limitations of existing systems, this research article focuses on the integration of powerful machine learning algorithms by retrieving the secret key information with countermeasures methodology using the chaotic logistic maps and includes the following contributions: (a) Preparation of Data Sets from the Power consumption traces captured from ARTIX-7 FPGA boards while running the Elliptical Curve Cryptography(ECC) on it (b) Implementation of High Speed and High Accurate Single feed-forward learning machines for the detection and classification of side-channel attacks (c) Design of Chaotic Countermeasures using 3-Dlogistic maps for attacked bits. The test_bed has been developed using the integration of FPGA along with Cortex-A57 architectures for experimentation of the proposed work and various evaluation parameters such as Accuracy, F-calls, Precision rates, sensitivity, and correlation co-efficient, entropy were calculated and analyzed. Moreover, the parameters of the proposed system which has been analyzed prove to outperform the other existing algorithms in terms of performance and detection.

Internet of Things (IoT) devices have strict energy constraints as they often operate on a battery supply. The cryptographic operations within IoT devices consume substantial energy and are vulnerable to a class of hardware attacks known as side-channel attacks. To reduce the energy consumption and defend against side-channel attacks, we propose combining adiabatic logic and Magnetic Tunnel Junctions to form our novel Energy Efficient-Adiabatic CMOS/MTJ Logic (EE-ACML). EE-ACML is shown to be both low energy and secure when compared to existing CMOS/MTJ architectures. EE-ACML reduces dynamic energy consumption with adiabatic logic, while MTJs reduce the leakage power of a circuit. To show practical functionality and energy savings, we designed one round of PRESENT-80 with the proposed EE-ACML integrated with an adiabatic clock generator. The proposed EE-ACML-based PRESENT-80 showed energy savings of 67.24% at 25 MHz and 86.5% at 100 MHz when compared with a previously proposed CMOS/MTJ circuit. Furthermore, we performed a CPA attack on our proposed design, and the key was kept secret.

A longstanding problem in computer privacy is that of data anonymization. One common approach is to present a query interface to analysts, and anonymize on a query-by-query basis. In practice, this approach often uses a standard database back end, and presents the query semantics of the database to the analyst. This paper presents a class of novel side-channel attacks that work against any query-based anonymization system that uses a standard database back end. The attacks exploit the implicit conditional logic of database runtime optimizations. They manipulate this logic to trigger timing and exception-throwing side-channels based on the contents of the data. We demonstrate the attacks on the implementation of the CHORUS Differential Privacy system released by Uber as an open source project. We obtain perfect reconstruction of millions of data values even with a Differential Privacy budget smaller than epsilon = 1.0 and no prior knowledge. The paper also presents the design of a general defense to the runtime-optimization attacks, and a concrete implementation of the defense in the latest version of Diffix. The defense works without modifications to the back end database, and operates by modifying SQL to eliminate the runtime optimization or disable the side-channels. In addition, two other attacks that exploit specific flaws in Diffix and CHORUS are reported. These have been fixed in the respective implementations.

Logging is a common practice in software engineering. Prior research has investigated the characteristics of logging practices in system software (e.g., web servers or databases) as well as desktop applications. However, despite the popularity of mobile apps, little is known about their logging practices. In this paper, we sought to study logging practices in mobile apps. In particular, we conduct a case study on 1,444 open source Android apps in the F-Droid repository. Through a quantitative study, we find that although mobile app logging is less pervasive than server and desktop applications, logging is leveraged in almost all studied apps. However, we find that there exist considerable differences between the logging practices of mobile apps and the logging practices in server and desktop applications observed by prior studies. In order to further understand such differences, we conduct a firehouse email interview and a qualitative annotation on the rationale of using logs in mobile app development. By comparing the logging level of each logging statement with developers’ rationale of using the logs, we find that all too often (35.4%), the chosen logging level and the rationale are inconsistent. Such inconsistency may prevent the useful runtime information to be recorded or may generate unnecessary logs that may cause performance overhead. Finally, to understand the magnitude of such performance overhead, we conduct a performance evaluation between generating all the logs and not generating any logs in eight mobile apps. In general, we observe a statistically significant performance overhead based on various performance metrics (response time, CPU and battery consumption). In addition, we find that if the performance overhead of logging is significantly observed in an app, disabling the unnecessary logs indeed provides a statistically significant performance improvement. Our results show the need for a systematic guidance and automated tool support to assist in mobile logging practices.

Virtualization platforms allow multiple operating systems to run on the same hardware. One of their central goal is to provide strong isolation between guest operating systems, unfortunately, they are often vulnerable to practical side-channel attacks. Cache attacks are a common class of side-channel attacks that use the cache as a side channel. We formalize an idealized model of virtualization that features the cache and the Translation Look aside Buffer (TLB), and that provides an abstract treatment of cache-based side-channels. We then use the model for reasoning about cache-based attacks and countermeasures, and for proving that isolation between guest operating systems can be enforced by flushing the cache upon context switch. In addition, we show that virtualized platforms are transparent, i.e. a guest operating system cannot distinguish whether it executes alone or together with other guest operating systems on the platform. The models and proofs have been machine-checked in the Coqproof assistant.

Micro-architectural side-channel attacks are major threats to the most mathematically sophisticated encryption algorithms. In spite of the fact that there exist several defense techniques, the overhead of implementing the countermeasures remains a matter of concern. A promising strategy is to develop online detection and prevention methods for these attacks. Though some recent studies have devised online prevention mechanisms for some categories of these attacks, still other classes remain undetected. Moreover, to detect these side-channel attacks with minimal False Positives is a challenging effort because of the similarity of their behavior with computationally intensive applications. This article presents a generalized machine learning--based multi-layer detection technique that targets these micro-architectural side-channel attacks, while not restricting its attention only on a single category of attacks. The proposed mechanism gathers low-level system information by profiling performance counter events using Linux perf tool and then applies machine learning techniques to analyze the data. A novel approach using time-series analysis of the data is implemented to find out the correlation of the execution trace of the attack process with the secret key of encryption, which helps in dealing with False-Positives and unknown attacks. This article also provides a detailed theoretical analysis of the detection mechanism of the proposed model along with its security analysis. The experimental results show that the proposed method is superior to the state-of-the-art reported techniques with high detection accuracy, low False Positives, and low implementation overhead while being able to detect before the completion of the attack.

This paper introduces a new cryptographic primitive called a private resource allocator (PRA) that can be used to allocate resources (e.g., network bandwidth, CPUs) to a set of clients without revealing to the clients whether any other clients received resources. We give several constructions of PRAs that provide guarantees ranging from information-theoretic to differential privacy. PRAs are useful in preventing a new class of attacks that we call allocation-based side-channel attacks. These attacks can be used, for example, to break the privacy guarantees of anonymous messaging systems that were designed specifically to defend against side-channel and traffic analysis attacks. Our implementation of PRAs in Alpenhorn, which is a recent anonymous messaging system, shows that PRAs increase the network resources required to start a conversation by up to 16× (can be made as low as 4× in some cases), but add no overhead once the conversation has been established.