Vision: Automated security validation of mobile apps at app markets

MobiSys'11 - Compilation Proceedings of the 9th Int. Conf. on Mobile Systems, Applications, and Services and Co-located Workshops - 2011 Workshop on Mobile Cloud Computing and Services, MCS'11

Volumn , Issue , 2011, Pages 21-25

  Gilbert, Peter ^a   Chun, Byung Gon ^b   Cox, Landon P ^a   Jung, Jaeyeon ^c  

^a DUKE UNIVERSITY   (United States)

^b YAHOO RESEARCH   (United States)

^c UNIVERSITY OF WASHINGTON   (United States)

Author keywords

mobile phone applications; privacy; security

Indexed keywords

MOBILE APPLICATIONS; MOBILE DEVICE SECURITY; MOBILE PHONE APPLICATIONS; SECURITY; SECURITY AND PRIVACY; SMART PHONES; TEST COVERAGE;

AUTOMATION; COMMERCE; COMPUTER SYSTEMS; MOBILE DEVICES;

CLOUD COMPUTING;

EID: 79961080173     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1145/1999732.1999740     Document Type: Conference Paper

References (28)

1. Amazon mechanical turk. www.mturk.com.
2. Android market. market.android.com.
3. Apple sued over apps privacy issues; google may be next. www.reuters.com/assets/print?aid=USTRE6BR1Y820101228.
4. iphone and android apps breach privacy. www.foxnews.com/scitech/2010/12/ 18/apps-watching/.
5. Malware infects more than 50 android apps. www.msnbc.msn.com/id/41867328/ ns/technology-and-science-security/.
6. More than 60 apps have been downloaded for every iOS device sold. http://www.asymco.com/2011/01/16/morethan-60-apps-have-been-downloaded-forevery- ios-device-sold/.
7. P3P 1.1 Specification. http://www.w3.org/TR/P3P11/.
8. Your apps are watching you. online.wsj.com/article/ SB10001424052748704694004576020083703574602.html.
9. Flashlight app sneaks tethering into app store (for now) [pulled]. www.macrumors.com, July 2010.
10. J. Burnim and K. Sen. Heuristics for scalable dynamic test generation. In TR UCB/EECS-2008-123, 2008.
11. C. Cadar, D. Dunbar, and D. R. Engler. Klee: Unassisted and automatic generation of high-coverage tests for complex systems programs. In OSDI, 2008.
12. C. Cadar, V. Ganesh, P. M. Pawlowski, D. L. Dill, and D. R. Engler. EXE: Automatically generating inputs of death. In ACM CCS, 2006.
13. G. Candea, S. Bucur, and C. Zamfir. Automated software testing as a service. In ACM SOCC, 2010.
14. V. Chipounov, V. Kuznetsov, and G. Candea. S2E: A platform for in-vivo multi-path analysis of software systems. In ASPLOS, 2011.
15. B.-G. Chun, S. Ihm, P. Maniatis, M. Naik, and A. Patti. CloneCloud: Elastic execution between mobile device and cloud. In EuroSys, 2011.
16. L. Ciortea, C. Zamfir, S. Bucur, V. Chipounov, and G. Candea. Cloud9: A software testing service. In LADIS, 2009.
17. J. Clause, W. Li, and A. Orso. Dytan: A generic dynamic taint analysis framework. In ISSTA, 2007.
18. M. Egele, C. Kruegel, E. Kirda, and G. Vigna. PiOS: Detecting privacy leaks in ios applications. In NDSS, 2011.
19. W. Enck, P. Gilbert, B.-G. Chun, L. P. Cox, J. Jung, P. McDaniel, and A. N. Sheth. TaintDroid: An information-flow tracking system for realtime privacy monitoring on smartphones. In OSDI, 2010.
20. M. G. Kang, S. McCamant, P. Poosankam, and D. Song. DTA++: Dynamic taint analysis with targeted control-flow propagation. In NDSS, 2011.
21. J. C. King. Symbolic execution and program testing. Communications of the ACM, 1976.
22. S. T. King and P. M. Chen. Backtracking intrusions. In SOSP, 2003.
23. J. Newsome and D. Song. Dynamic taint analysis: Automatic detection, analysis, and signature generation of exploit attacks on commodity software. In NDSS, 2005.
24. J. Oberheide, E. Cooke, and F. Jahanian. CloudAV: N-version antivirus in the network cloud. In USENIX Security, 2008.
25. G. Portokalidis, P. Homburg, K. Anagnostakis, and H. Bos. Paranoid android: Versatile protection for smartphones. In ACSAC, 2010.
26. K. Sen, D. Marinov, and G. Agha. CUTE: A concolic unit testing engine for c. In FSE, 2005.
27. E. Smith. iPhone applications & privacy issues: An analysis of application transmission of iPhone unique device identifiers (UDIDs). In Technical Report, 2010.
28. H. Yin, D. Song, M. Egele, C. Kruegel, and E. Kirda. Panorama: Capturing system-wide information flow for malware detection and analysis. In ACM CCS, 2007.