ANALISIS KREDENSIAL UNTUK KONFIGURASI KEAMANANAN ROM ANDROID CUSTOM
Keywords:
Analisis Kredensial, Konfigurasi Keamanan, Android, Kustomisasi Android
Abstract
Android merupakan sistem operasi berlapis, dimana setiap lapisan memiliki tugas dan tanggung jawabnya masing-masing. Berbagai pihak dalam rantai penyesuaian seperti vendor perangkat misal saja Samsung, Xiaomi, Oppo, Huawei dan lain sebagainya, operator seperti terlkomsel, smartfren, XL, dan lain sebagainya dan produsen perangkat keras dapat menyesuaikan satu atau beberapa lapisan untuk menyesuaikan perangkat untuk tujuan yang berbeda, seperti mendukung perangkat keras khusus dan menyediakan antarmuka dan layanan yang berbeda. Tujuan penelitian ini adalah untuk menyelidiki secara sistematis untuk setiap ketidakkonsistenan yang muncul sebagai hasil dari proses yang dilakukan dalam penelitian ini serta untuk menilai berbagai implikasi keamanannya. Penelitian ini menjalankan DroidDiff untuk melakukan analisis diferensial skala besar pada gambar yang di kumpulkan menggunakan metodologi analisis. DroidDiff menemukan banyak perbedaan terkait dengan fitur pilihan. Metode yang diguanakan dalam penelitian ini adalah metode lima algoritme analisis diferensial. Hasilnya, dengan membandingkan konfigurasi keamanan dari gambar serupa, perubahan keamanan penting yang bisa jadi secara tidak sengaja diperkenalkan selama penyesuaian dapat ditemukan. Hasil menunjukkan bahwa, DroidDiff dapat diguanakan vendor guna memeriksa konfigurasi berbagai fitur keamanan pada image yang diberikan. DroidDiff akan mengekstrak fitur tersebut dari gambar, dan membandingkannya dengan kumpulan konfigurasi gambar lain, selanjutnya DroidDiff akan menandai yang tidak konsisten untuk diselidiki lebih lanjut oleh vendor yang memiliki kode sumber dan perangkat untuk memeriksa efeknya. Untuk pekerjaan dimasa depan, penyempurnaan DroidDiff dalam mendeteksi ketidakkonsistenan yang berisiko secara lebih akurat sangat disarankan. Dengan meningkatkan DroidDiff akan membantu mengurangi jumlah positif palsu dan menentukan konfigurasi berisiko secara lebih akurat.
References
M. C. Grace, Y. Zhou, Z. Wang, and X. Jiang, “Systematic detection of capability leaks in stock android smartphones,” in 19th Annual Network and Distributed System Security Symposium, NDSS 2012, San Diego, California, USA, February 5-8, 2012, 2012.
L. Wu, M. Grace, Y. Zhou, C. Wu, and X. Jiang, “The impact of vendor customizations on android security,” in Proceedings of the 2013 ACM SIGSAC Conference on Computer and Communications Security, CCS ’13, (New York, NY, USA), pp. 623–634, ACM, 2013.
X. Zhou, Y. Lee, N. Zhang, M. Naveed, and X. Wang, “The peril of fragmentation: Security hazards in android device driver customizations,” in 2014 IEEE Symposium on Security and Privacy, SP 2014, Berkeley, CA, USA.
M. Mitchell, G. Tian, and Z. Wang, “Systematic audit of third-party android phones,” in Proceedings of the 4th ACM Conference on Data and Application Security and Privacy, CODASPY ’14, (New York, NY, USA), pp. 175–186, ACM, 2014.
D. R. Thomas, A. R. Beresford, and A. Rice, “Security metrics for the android ecosystem,” in Proceedings of the 5th Annual ACM CCS Workshop on Security and Privacy in Smartphones and Mobile Devices, SPSM ’15, (New York, NY, USA), pp. 87–98, ACM, 2015.
A. P. Felt, H. J. Wang, A. Moshchuk, S. Hanna, and E. Chin, “Permission re-delegation: attacks and defenses,” in Proceedings of the 20th USENIX conference on Security symposium,2011.
Y. Zhou and X. Jiang, “Detecting passive content leaks and pollution in android applications,” in 20th Annual Network and Distributed System Security Symposium, NDSS 2013, San Diego, California, USA, February 24-27, 2013,2013.
R. Gallo, P. Hongo, R. Dahab, L. C. Navarro, H. Kawakami, K. Galvão, G. Junqueira, and L. Ribeiro, “Security and system architecture: Comparison of android customizations,” in Proceedings of the 8th ACM Conference on Security & Privacy in Wireless and Mobile Networks,WiSec ’15,(NewYork,NY,USA), pp. 12:1–12:6, ACM, 2015.
S. Jana and V. Shmatikov, “Memento: Learning secrets from process footprints,” in Proceedings of the 2012 IEEE Symposium on Security and Privacy,SP ’12, (Washington, DC, USA), pp. 143–157, IEEE Computer Society, 2012.
X. Zhou, S. Demetriou, D. He, M. Naveed, X. Pan, X. Wang, C. A. Gunter, and
M. Dietz, S. Shekhar, Y. Pisetsky, A. Shu, and D. S. Wallach, “Quire: Lightweight provenance for smart phone operating systems,” in 20th USENIX Security Symposium, (San Francisco, CA), Aug. 2011.
Y. Zhou, X. Zhang, X. Jiang, and V. W. Freeh, “Taming information-stealing smartphone applications (on android),” in Proceedings of the 4th International Conference on Trust and Trustworthy Computing, TRUST’11, (Berlin, Heidelberg), pp. 93–107, Springer-Verlag, 2011.
P. Hornyack, S. Han, J. Jung, S. Schechter, and D. Wetherall, “These aren’t the droids you’re looking for: Retrofitting android to protect data from imperious applications,” in Proceedings of the 18th ACM Conference on Computer and Communications Security, CCS ’11, (New York, NY, USA), pp. 639–652, ACM, 2011.
M. Nauman, S. Khan, and X. Zhang, “Apex: extending android permission model and enforcement with user-defined runtime constraints,” in Proceedings of the 5th ACM Symposium on Information, Computer and Communications Security,2010.
S. Bugiel, L. Davi, A. Dmitrienko, T. Fischer, and A.-R. Sadeghi, “Xmandroid: A new android evolution to mitigate privilege escalation attacks,” tech. rep., Technische UniversitÃÂČÂâĆňt Darmstadt, 2011.
S. Bugiel, L. Davi, A. Dmitrienko, S. Heuser, A.-R. Sadeghi, and B. Shastry,
“Practical and lightweight domain isolation on android,” in Proceedings of the 1st ACM workshop on Security and privacy in smartphones and mobile devices,2011.
S. Bugiel, S. Heuser, and A.-R. Sadeghi, “Flexible and fine-grained mandatory access control on android for diverse security and privacy policies,” in Presented as part of the 22nd USENIX Security Symposium (USENIX Security 13), (Washington, D.C.), pp. 131–146, USENIX, 2013.
S. Smalley and R. Craig, “Security enhanced (SE) android: Bringing flexible MAC to android,” in 20th Annual Network and Distributed System Security Symposium, NDSS 2013, San Diego, California, USA, February 24-27, 2013,2013.
Z. Fang, W. Han, D. Li, Z. Guo, D. Guo, X. S. Wang, Z. Qian, and H. Chen, “revdroid: Code analysis of the side effects after dynamic permission revocation of android apps,” in Proceedings of the 11th ACM on Asia Conference on Computer and Communications Security, ASIA CCS ’16, (New York, NY, USA), pp. 747–758, ACM, 2016.
G. Russello, B. Crispo, E. Fernandes, and Y. Zhauniarovich, “Yaase: Yet another android security extension,” in Privacy, Security, Risk and Trust (PASSAT) and 2011 IEEE Third Inernational Conference on Social Computing (SocialCom), 2011 IEEE Third International Conference on,pp. 1033–1040, 2011.
D. Feth and C. Jung, Context-Aware, Data-Driven Policy Enforcement for Smart Mobile Devices in Business Environments,pp. 69–80. Berlin,Heidelberg: Springer Berlin Heidelberg, 2012.
P. Pearce, A. P. Felt, G. Nunez, and D. Wagner, “AdDroid: Privilege Separation for Applications and Advertisers in Android,” in Proceedings of the 7th ACM Symposium on Information, Computer and Communications Security,2012.
S. Shekhar, M. Dietz, and D. S. Wallach, “Adsplit: Separating smartphone advertising from applications,” in Proceedings of the 21st USENIX Conference on Security Symposium, Security’12, (Berkeley, CA, USA), pp. 28–28, USENIX Association, 2012.
X. Zhang, A. Ahlawat, and W. Du, “AFrame: Isolating Advertisements from Mobile Applications in Android,” in Proceedings of the 29th Annual Computer Security Applications Conference (
58] L. Xing, X. Pan, R. Wang, K. Yuan, and X. Wang, “Upgrading your android, elevating my malware: Privilege escalation through mobile os updating,” in Proceedings of the 2014 IEEE Symposium on Security and Privacy,SP ’14, (Washington, DC, USA), pp. 393–408, IEEE Computer Society, 2014.
B. Sarma, N. Li, C. Gates, R. Potharaju, C. Nita-Rotaru, and I. Molloy, “Android Permissions: A Perspective Combining Risks and Benefits,” SACMAT,2012.
H. Peng, C. Gates, B. Sarma, N. Li, Y. Qi, R. Potharaju, C. Nita-Rotaru, and I. Molloy, “Using probabilistic generative models for ranking risks of android apps,” in Proceedings of the 2012 ACM conference on Computer and communications security, 2012.
T. Blasing, L. Batyuk, A.-D. Schmidt, S. A. Camtepe, and S. Albayrak, “An Android Application Sandbox System for Suspicious Software Detection,” MALWARE, 2010.
Y. Zhou, Z. Wang, W. Zhou, and X. Jiang, “Hey, You, Get off of My Market: Detecting Malicious Apps in Official and Alternative Android Markets,” NDSS,2012.
A.-D. Schmidt, R. Bye, H.-G. Schmidt, J.Clausen, O. Kiraz, K. A. Yuksel, S. A. Camtepe, and S. Albayrak, “Static Analysis of Executables for Collaborative Malware Detection on Android,” ICC,2009.
I. Burguera, U. Zurutuza, and S.Nadijm-Tehrani, “Crowdroid: Behavior-Based Malware Detection System for Android.,” SPSM,2011.
J. Huang, X. Zhang, L. Tan, P. Wang, and B. Liang, “Asdroid: Detecting stealthy behaviors in android applications by user interface and program behavior contradiction,” in Proceedings of the 36th International Conference on Software Engineering, ICSE 2014, (New York, NY, USA), pp. 1036–1046, ACM, 2014.
D. Arp, M. Spreitzenbarth, M. Hubner, H. Gascon, and K. Rieck, “Drebin: Effective and explainable detection of android malware in your pocket.,” in NDSS, The Internet Society, 2014.
M. Zhang, Y. Duan, H. Yin, and Z. Zhao, “Semantics-aware android malware classification using weighted contextual api dependency graphs,” in Proceedings of the 2014 ACM SIGSAC Conference on Computer and Communications Security, CCS ’14, (New York, NY, USA), pp. 1105–1116, ACM, 2014.
A. Shabtai, U. Kanonov, Y. Elovici, C. Glezer, and Y. Weiss, “Andromaly: a Behavioral Malware Detection Framework for Android Devices,” Journal of Intelligent Information Systems archive Volume 38 Issue 1,2012.
W. Enck, P. Gilbert, S. Han, V. Tendulkar, B.-G. Chun, L. P. Cox, J. Jung, P. McDaniel, and A. N. Sheth, “Taintdroid: An information-flow tracking system for realtime privacy monitoring on smartphones,” ACM Trans. Comput. Syst.,vol.32, pp. 5:1–5:29, June 2014.
G. Portokalidis, P. Homburg, K. Anagnostakis, and H. Bos, “Paranoid Android: Versatile Protection for Smartphones,” ACSAC,2010.
S. Arzt, S. Rasthofer, C. Fritz, E. Bodden, A. Bartel, J. Klein, Y. Le Traon, D. Octeau, and P. McDaniel, “Flowdroid: Precise context, flow, field, object-sensitive and lifecycle-aware taint analysis for android apps,” in Proceedings of the 35th ACM SIGPLAN Conference on Programming Language Design and Implementation, PLDI ’14, (New York, NY, USA), pp. 259–269, ACM, 2014.
M. I. Gordon, D. Kim, J. Perkins, L. Gilham, N. Nguyen, and M. Rinard, “Information-flow analysis of android applications in droidsafe,” 2015.
M. Zhang and H. Yin, “Appsealer: Automatic generation of vulnerability-specific patches for preventing component hijacking attacks in android applications,” in NDSS,2014.
M. Zhang and H. Yin, “Efficient, context-aware privacy leakage confinement for android applications without firmware modding,” in Proceedings of the 9th ACM Symposium on Information, Computer and Communications Security, ASIA CCS ’14, (New York, NY, USA), pp. 259–270, ACM, 2014.
K. Z. Chen, N. M. Johnson, V. D’Silva, S. Dai, K. MacNamara, T. R. Magrino, E. X. Wu, M. Rinard, and D. X. Song, “Contextual policy enforcement in android applications with permission event graphs.,” in NDSS, The Internet Society, 2013.
W. Yang, X. Xiao, B. Andow, S. Li, T. Xie, and W. Enck, “Appcontext: Differentiating malicious and benign mobile app behaviors using context,” in Proceedings of the 37th International Conference on Software Engineering - Volume 1, ICSE ’15, (Piscataway, NJ, USA), pp. 303–313, IEEE Press, 2015.
Y. Fratantonio, A. Bianchi, W. Robertson, E. Kirda, C. Kruegel, G. Vigna, S. Uc, and Barbara, “Triggerscope: Towards detecting logic bombs in android applications,” in S&P,2016.
L. K. Yan and H. Yin, “Droidscope: seamlessly reconstructing the os and dalvik semantic views for dynamic android malware analysis,” in Proceedings of the 21st USENIX conference on Security symposium,2012.
M. Spreitzenbarth, F. Freiling, F. Echtler, T. Schreck, and J. Hoffmann, “Mobile-sandbox: Having a deeper look into android applications,” in Proceedings of the 28th Annual ACM Symposium on Applied Computing,SAC ’13, (NewYork, NY, USA), pp. 1808–1815, ACM, 2013.
K. Tam, S. J. Khan, A. Fattori, and L. Cavallaro, “Copperdroid: Automatic reconstruction of android malware behaviors.,” in NDSS, The Internet Society, 2015.
M. Lindorfer, M. Neugschw, L. Weichselbaum, Y. Fratantonio, V. V. D. Veen, and C. Platzer, “Andrubis- 1,000,000 apps later: A view on current android malware behaviors,” in International Workshop on Building Analysis Datasets and Gathering Experience Returns for Security,2014.
Y. Zhang, M. Yang, B. Xu, Z. Yang, G. Gu, P. Ning, X. S. Wang, and B. Zang, “Vetting undesirable behaviors in android apps with permission use analysis,” in CCS, (New York, NY, USA), ACM, 2013.
N. Mirzaei, S. Malek, C. S. Păsăreanu, N. Esfahani, and R. Mahmood, “Testing android apps through symbolic execution,” SIGSOFT Softw. Eng. Notes,vol.37, pp. 1–5, Nov. 2012.
M. Y. Wong and D. Lie, “Intellidroid: A targeted input generator for the dynamic analysis of android malware,” in NDSS,2016.
S. Rasthofer, S. Arzt, M. Miltenberger, and E. Bodden, “Harvesting runtime values in android applications that feature anti-analysis techniques,” in NDSS,2016
L. Wu, M. Grace, Y. Zhou, C. Wu, and X. Jiang, “The impact of vendor customizations on android security,” in Proceedings of the 2013 ACM SIGSAC Conference on Computer and Communications Security, CCS ’13, (New York, NY, USA), pp. 623–634, ACM, 2013.
X. Zhou, Y. Lee, N. Zhang, M. Naveed, and X. Wang, “The peril of fragmentation: Security hazards in android device driver customizations,” in 2014 IEEE Symposium on Security and Privacy, SP 2014, Berkeley, CA, USA.
M. Mitchell, G. Tian, and Z. Wang, “Systematic audit of third-party android phones,” in Proceedings of the 4th ACM Conference on Data and Application Security and Privacy, CODASPY ’14, (New York, NY, USA), pp. 175–186, ACM, 2014.
D. R. Thomas, A. R. Beresford, and A. Rice, “Security metrics for the android ecosystem,” in Proceedings of the 5th Annual ACM CCS Workshop on Security and Privacy in Smartphones and Mobile Devices, SPSM ’15, (New York, NY, USA), pp. 87–98, ACM, 2015.
A. P. Felt, H. J. Wang, A. Moshchuk, S. Hanna, and E. Chin, “Permission re-delegation: attacks and defenses,” in Proceedings of the 20th USENIX conference on Security symposium,2011.
Y. Zhou and X. Jiang, “Detecting passive content leaks and pollution in android applications,” in 20th Annual Network and Distributed System Security Symposium, NDSS 2013, San Diego, California, USA, February 24-27, 2013,2013.
R. Gallo, P. Hongo, R. Dahab, L. C. Navarro, H. Kawakami, K. Galvão, G. Junqueira, and L. Ribeiro, “Security and system architecture: Comparison of android customizations,” in Proceedings of the 8th ACM Conference on Security & Privacy in Wireless and Mobile Networks,WiSec ’15,(NewYork,NY,USA), pp. 12:1–12:6, ACM, 2015.
S. Jana and V. Shmatikov, “Memento: Learning secrets from process footprints,” in Proceedings of the 2012 IEEE Symposium on Security and Privacy,SP ’12, (Washington, DC, USA), pp. 143–157, IEEE Computer Society, 2012.
X. Zhou, S. Demetriou, D. He, M. Naveed, X. Pan, X. Wang, C. A. Gunter, and
M. Dietz, S. Shekhar, Y. Pisetsky, A. Shu, and D. S. Wallach, “Quire: Lightweight provenance for smart phone operating systems,” in 20th USENIX Security Symposium, (San Francisco, CA), Aug. 2011.
Y. Zhou, X. Zhang, X. Jiang, and V. W. Freeh, “Taming information-stealing smartphone applications (on android),” in Proceedings of the 4th International Conference on Trust and Trustworthy Computing, TRUST’11, (Berlin, Heidelberg), pp. 93–107, Springer-Verlag, 2011.
P. Hornyack, S. Han, J. Jung, S. Schechter, and D. Wetherall, “These aren’t the droids you’re looking for: Retrofitting android to protect data from imperious applications,” in Proceedings of the 18th ACM Conference on Computer and Communications Security, CCS ’11, (New York, NY, USA), pp. 639–652, ACM, 2011.
M. Nauman, S. Khan, and X. Zhang, “Apex: extending android permission model and enforcement with user-defined runtime constraints,” in Proceedings of the 5th ACM Symposium on Information, Computer and Communications Security,2010.
S. Bugiel, L. Davi, A. Dmitrienko, T. Fischer, and A.-R. Sadeghi, “Xmandroid: A new android evolution to mitigate privilege escalation attacks,” tech. rep., Technische UniversitÃÂČÂâĆňt Darmstadt, 2011.
S. Bugiel, L. Davi, A. Dmitrienko, S. Heuser, A.-R. Sadeghi, and B. Shastry,
“Practical and lightweight domain isolation on android,” in Proceedings of the 1st ACM workshop on Security and privacy in smartphones and mobile devices,2011.
S. Bugiel, S. Heuser, and A.-R. Sadeghi, “Flexible and fine-grained mandatory access control on android for diverse security and privacy policies,” in Presented as part of the 22nd USENIX Security Symposium (USENIX Security 13), (Washington, D.C.), pp. 131–146, USENIX, 2013.
S. Smalley and R. Craig, “Security enhanced (SE) android: Bringing flexible MAC to android,” in 20th Annual Network and Distributed System Security Symposium, NDSS 2013, San Diego, California, USA, February 24-27, 2013,2013.
Z. Fang, W. Han, D. Li, Z. Guo, D. Guo, X. S. Wang, Z. Qian, and H. Chen, “revdroid: Code analysis of the side effects after dynamic permission revocation of android apps,” in Proceedings of the 11th ACM on Asia Conference on Computer and Communications Security, ASIA CCS ’16, (New York, NY, USA), pp. 747–758, ACM, 2016.
G. Russello, B. Crispo, E. Fernandes, and Y. Zhauniarovich, “Yaase: Yet another android security extension,” in Privacy, Security, Risk and Trust (PASSAT) and 2011 IEEE Third Inernational Conference on Social Computing (SocialCom), 2011 IEEE Third International Conference on,pp. 1033–1040, 2011.
D. Feth and C. Jung, Context-Aware, Data-Driven Policy Enforcement for Smart Mobile Devices in Business Environments,pp. 69–80. Berlin,Heidelberg: Springer Berlin Heidelberg, 2012.
P. Pearce, A. P. Felt, G. Nunez, and D. Wagner, “AdDroid: Privilege Separation for Applications and Advertisers in Android,” in Proceedings of the 7th ACM Symposium on Information, Computer and Communications Security,2012.
S. Shekhar, M. Dietz, and D. S. Wallach, “Adsplit: Separating smartphone advertising from applications,” in Proceedings of the 21st USENIX Conference on Security Symposium, Security’12, (Berkeley, CA, USA), pp. 28–28, USENIX Association, 2012.
X. Zhang, A. Ahlawat, and W. Du, “AFrame: Isolating Advertisements from Mobile Applications in Android,” in Proceedings of the 29th Annual Computer Security Applications Conference (
58] L. Xing, X. Pan, R. Wang, K. Yuan, and X. Wang, “Upgrading your android, elevating my malware: Privilege escalation through mobile os updating,” in Proceedings of the 2014 IEEE Symposium on Security and Privacy,SP ’14, (Washington, DC, USA), pp. 393–408, IEEE Computer Society, 2014.
B. Sarma, N. Li, C. Gates, R. Potharaju, C. Nita-Rotaru, and I. Molloy, “Android Permissions: A Perspective Combining Risks and Benefits,” SACMAT,2012.
H. Peng, C. Gates, B. Sarma, N. Li, Y. Qi, R. Potharaju, C. Nita-Rotaru, and I. Molloy, “Using probabilistic generative models for ranking risks of android apps,” in Proceedings of the 2012 ACM conference on Computer and communications security, 2012.
T. Blasing, L. Batyuk, A.-D. Schmidt, S. A. Camtepe, and S. Albayrak, “An Android Application Sandbox System for Suspicious Software Detection,” MALWARE, 2010.
Y. Zhou, Z. Wang, W. Zhou, and X. Jiang, “Hey, You, Get off of My Market: Detecting Malicious Apps in Official and Alternative Android Markets,” NDSS,2012.
A.-D. Schmidt, R. Bye, H.-G. Schmidt, J.Clausen, O. Kiraz, K. A. Yuksel, S. A. Camtepe, and S. Albayrak, “Static Analysis of Executables for Collaborative Malware Detection on Android,” ICC,2009.
I. Burguera, U. Zurutuza, and S.Nadijm-Tehrani, “Crowdroid: Behavior-Based Malware Detection System for Android.,” SPSM,2011.
J. Huang, X. Zhang, L. Tan, P. Wang, and B. Liang, “Asdroid: Detecting stealthy behaviors in android applications by user interface and program behavior contradiction,” in Proceedings of the 36th International Conference on Software Engineering, ICSE 2014, (New York, NY, USA), pp. 1036–1046, ACM, 2014.
D. Arp, M. Spreitzenbarth, M. Hubner, H. Gascon, and K. Rieck, “Drebin: Effective and explainable detection of android malware in your pocket.,” in NDSS, The Internet Society, 2014.
M. Zhang, Y. Duan, H. Yin, and Z. Zhao, “Semantics-aware android malware classification using weighted contextual api dependency graphs,” in Proceedings of the 2014 ACM SIGSAC Conference on Computer and Communications Security, CCS ’14, (New York, NY, USA), pp. 1105–1116, ACM, 2014.
A. Shabtai, U. Kanonov, Y. Elovici, C. Glezer, and Y. Weiss, “Andromaly: a Behavioral Malware Detection Framework for Android Devices,” Journal of Intelligent Information Systems archive Volume 38 Issue 1,2012.
W. Enck, P. Gilbert, S. Han, V. Tendulkar, B.-G. Chun, L. P. Cox, J. Jung, P. McDaniel, and A. N. Sheth, “Taintdroid: An information-flow tracking system for realtime privacy monitoring on smartphones,” ACM Trans. Comput. Syst.,vol.32, pp. 5:1–5:29, June 2014.
G. Portokalidis, P. Homburg, K. Anagnostakis, and H. Bos, “Paranoid Android: Versatile Protection for Smartphones,” ACSAC,2010.
S. Arzt, S. Rasthofer, C. Fritz, E. Bodden, A. Bartel, J. Klein, Y. Le Traon, D. Octeau, and P. McDaniel, “Flowdroid: Precise context, flow, field, object-sensitive and lifecycle-aware taint analysis for android apps,” in Proceedings of the 35th ACM SIGPLAN Conference on Programming Language Design and Implementation, PLDI ’14, (New York, NY, USA), pp. 259–269, ACM, 2014.
M. I. Gordon, D. Kim, J. Perkins, L. Gilham, N. Nguyen, and M. Rinard, “Information-flow analysis of android applications in droidsafe,” 2015.
M. Zhang and H. Yin, “Appsealer: Automatic generation of vulnerability-specific patches for preventing component hijacking attacks in android applications,” in NDSS,2014.
M. Zhang and H. Yin, “Efficient, context-aware privacy leakage confinement for android applications without firmware modding,” in Proceedings of the 9th ACM Symposium on Information, Computer and Communications Security, ASIA CCS ’14, (New York, NY, USA), pp. 259–270, ACM, 2014.
K. Z. Chen, N. M. Johnson, V. D’Silva, S. Dai, K. MacNamara, T. R. Magrino, E. X. Wu, M. Rinard, and D. X. Song, “Contextual policy enforcement in android applications with permission event graphs.,” in NDSS, The Internet Society, 2013.
W. Yang, X. Xiao, B. Andow, S. Li, T. Xie, and W. Enck, “Appcontext: Differentiating malicious and benign mobile app behaviors using context,” in Proceedings of the 37th International Conference on Software Engineering - Volume 1, ICSE ’15, (Piscataway, NJ, USA), pp. 303–313, IEEE Press, 2015.
Y. Fratantonio, A. Bianchi, W. Robertson, E. Kirda, C. Kruegel, G. Vigna, S. Uc, and Barbara, “Triggerscope: Towards detecting logic bombs in android applications,” in S&P,2016.
L. K. Yan and H. Yin, “Droidscope: seamlessly reconstructing the os and dalvik semantic views for dynamic android malware analysis,” in Proceedings of the 21st USENIX conference on Security symposium,2012.
M. Spreitzenbarth, F. Freiling, F. Echtler, T. Schreck, and J. Hoffmann, “Mobile-sandbox: Having a deeper look into android applications,” in Proceedings of the 28th Annual ACM Symposium on Applied Computing,SAC ’13, (NewYork, NY, USA), pp. 1808–1815, ACM, 2013.
K. Tam, S. J. Khan, A. Fattori, and L. Cavallaro, “Copperdroid: Automatic reconstruction of android malware behaviors.,” in NDSS, The Internet Society, 2015.
M. Lindorfer, M. Neugschw, L. Weichselbaum, Y. Fratantonio, V. V. D. Veen, and C. Platzer, “Andrubis- 1,000,000 apps later: A view on current android malware behaviors,” in International Workshop on Building Analysis Datasets and Gathering Experience Returns for Security,2014.
Y. Zhang, M. Yang, B. Xu, Z. Yang, G. Gu, P. Ning, X. S. Wang, and B. Zang, “Vetting undesirable behaviors in android apps with permission use analysis,” in CCS, (New York, NY, USA), ACM, 2013.
N. Mirzaei, S. Malek, C. S. Păsăreanu, N. Esfahani, and R. Mahmood, “Testing android apps through symbolic execution,” SIGSOFT Softw. Eng. Notes,vol.37, pp. 1–5, Nov. 2012.
M. Y. Wong and D. Lie, “Intellidroid: A targeted input generator for the dynamic analysis of android malware,” in NDSS,2016.
S. Rasthofer, S. Arzt, M. Miltenberger, and E. Bodden, “Harvesting runtime values in android applications that feature anti-analysis techniques,” in NDSS,2016
Published
2023-05-19
Section
Articles
.png)
