Unsafe exposure analysis of mobile in-app advertisements

WiSec'12 - Proceedings of the 5th ACM Conference on Security and Privacy in Wireless and Mobile Networks

Volumn , Issue , 2012, Pages 101-112

  Grace, Michael ^a   Zhou, Wu ^a   Jiang, Xuxian ^a   Sadeghi, Ahmad Reza ^b  

^a North Carolina State University   (United States)

^b DARMSTADT UNIVERSITY OF TECHNOLOGY   (Germany)

Author keywords

In app advertisement; Privacy; Smartphone

Indexed keywords

END USERS; EXPLOSIVE GROWTH; EXPOSURE ANALYSIS; IN-APP ADVERTISEMENT; INTERNET SOURCES; PHONE NUMBER; POTENTIAL RISKS; PRIVACY AND SECURITY; PRIVATE INFORMATION; SECURITY RISKS; SENSITIVE INFORMATIONS; SYMBIOTIC RELATIONSHIP; UNTRUSTED CODE;

DATA PRIVACY; INTERNET; ROBOTS; SIGNAL ENCODING; SMARTPHONES;

LIBRARIES;

EID: 84860660623     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1145/2185448.2185464     Document Type: Conference Paper

References (33)

1. Android Permission Protection Levels. http://developer.android.com/ reference/android/R.styleable.html#AndroidManifestPermission-protectionLevel.
2. Android Security and Permissions. http://developer.android.com/guide/ topics/security/security.html.
3. Baksmali: A Disassembler for Android's Dex Format. http://code.google. com/p/smali/.
4. Dalvik. http://sites.google.com/site/io/dalvik-vm-internals/.
5. Distmo Report: April, 2011 and May, 2011. http://www.distimo.com/ publications.
6. Gartner Says Sales of Mobile Devices in Second Quarter of 2011 Grew 16.5 Percent Year-on-Year. http://www.gartner.com/it/page.jsp?id=1764714.
7. A. R. Beresford, A. Rice, N. Skehin, and R. Sohan. MockDroid: Trading Privacy for Application Functionality on Smartphones. In Proceedings of the Twelfth Workshop on Mobile Computing Systems & Applications, HotMobile'11, May 2011.
8. L. Bindschaedler, M. Jadliwala, I. Bilogrevic, I. Aad, P. Ginzboorg, V. Niemi, and J.-P. Hubaux. Track Me If You Can: On the Effectiveness of Context-based Identifier Changes in Deployed Mobile Networks. In Proceedings of the 19th Annual Network and Distributed System Security Symposium, NDSS'12, February 2012.
9. S. Bugiel, L. Davi, A. Dmitrienko, T. Fischer, A.-R. Sadeghi, and B. Shastry. Towards Taming Privilege-Escalation Attacks on Android. In Proceedings of the 19th Annual Network and Distributed System Security Symposium, NDSS'12, February 2012.
10. S. Bugiel, L. Davi, A. Dmitrienko, S. Heuser, A.-R. Sadeghi, and B. Shastry. Practical and Lightweight Domain Isolation on Android. In Proceedings of the 1st Workshop on Security and Privacy in Smartphones and Mobile Devices, CCS-SPSM'11, 2011.
11. M. Dietz, S. Shekhar, Y. Pisetsky, A. Shu, and D. S. Wallach. QUIRE: Lightweight Provenance for Smart Phone Operating Systems. In Proceedings of the 20th USENIX Security Symposium, August 2011.
12. M. Egele, C. Kruegel, E. Kirda, and G. Vigna. PiOS: Detecting Privacy Leaks in iOS Applications. In Proceedings of the 18th Annual Network and Distributed System Security Symposium, NDSS'11, February 2011.
13. W. Enck, P. Gilbert, B.-G. Chun, L. P. Cox, J. Jung, P. McDaniel, and A. N. Sheth. TaintDroid: An Information-Flow Tracking System for Realtime Privacy Monitoring on Smartphones. In Proceedings of the 9th USENIX Symposium on Operating Systems Design and Implementation, OSDI'10, pages 1-6, February 2010.
14. W. Enck, D. Octeau, P. McDaniel, and S. Chaudhuri. A Study of Android Application Security. In Proceedings of the 20th USENIX Security Symposium, August 2011.
15. W. Enck, M. Ongtang, and P. McDaniel. On Lightweight Mobile Phone Application Certification. In Proceedings of the 16th ACM Conference on Computer and Communications Security, CCS'09, pages 235-245, October 2009.
16. A. P. Felt, E. Chin, S. Hanna, D. Song, and D. Wagner. Android Permissions Demysti.ed. In Proceedings of the 18th ACM Conference on Computer and Communications Security, CCS'11, October 2011.
17. A. P. Felt, E. Chin, S. Hanna, D. Song, and D. Wagner. Android Permissions Demystified. In Proceedings of the 18th ACM Conference on Computer and Communications Security (CCS'11), October 2011.
18. A. P. Felt, H. Wang, A. Moschuk, S. Hanna, and E. Chin. Permission Re-Delegation: Attacks and Defenses. In Proceedings of the 20th USENIX Security Symposium, August 2011.
19. A. P. Fuchs, A. Chaudhuri, and J. S. Foster. SCanDroid: Automated Security Certification of Android Applications. http://www.cs.umd.edu/~avik/ papers/scandroidascaa.pdf.
20. M. Grace, Y. Zhou, Z. Wang, and X. Jiang. Systematic Detection of Capability Leaks in Stock Android Smartphones. In Proceedings of the 19th Annual Network and Distributed System Security Symposium, NDSS'12, February 2012.
21. S. Guha, B. Cheng, and P. Francis. Privad: Practical Privacy in Online Advertising. In Proceedings of the 8th USENIX Conference on Networked Systems Design and Implementation, NSDI'11, March 2011.
22. H. Haddadi, P. Hui, and I. Brown. MobiAd: Private and Scalable Mobile Advertising. In Proceedings of the 5th ACM International Workshop on Mobility in the Evolving Internet Architecture, MobiArch'10, pages 33-38, September 2010.
23. N. Hardy. The Confused Deputy, or Why Capabilities Might Have Been Invented. In ACM Operating Systems Review, volume 22, pages 36-38, 1988.
24. P. Hornyack, S. Han, J. Jung, S. Schechter, and D. Wetherall. "These Aren't the Droids You're Looking For": Retrofitting Android to Protect Data from Imperious Applications. In Proceedings of the 18th ACM Conference on Computer and Communications Security (CCS'11), October 2011.
25. IDC. Android Rises, Symbian 3 and Windows Phone 7 Launch as Worldwide Smartphone Shipments Increase 87.2% Year Over Year. http://www.idc.com/about/ viewpressrelease.jsp? containerId=prUS22689111.
26. C. Marforio, F. Aurélien, and S. Č apkun. Application collusion attack on the permission-based security model and its implications for modern smartphone systems. Technical Report 724, ETH Zurich, April 2011.
27. M. Nauman, S. Khan, and X. Zhang. Apex: Extending Android Permission Model and Enforcement with User-Defined Runtime Constraints. In Proceedings of the 5th ACM Symposium on Information, Computer and Communications Security, pages 328-332, April 2010.
28. M. Ongtang, S. E. McLaughlin, W. Enck, and P. D. McDaniel. Semantically Rich Application-Centric Security in Android. In Proceedings of the 25th Annual Computer Security Applications Conference, ACSAC'09, pages 340-349, December 2009.
29. R. A. Popa, A. J. Blumberg, H. Balakrishnan, and F. H. Li. Privacy and Accountability for Location-Based Aggregate Statistics. In Proceedings of the 18th ACM Conference on Computer and Communications Security (CCS'11), October 2011.
30. A. Reznichenko, S. Guha, and P. Francis. Auctions in Do-Not-Track Compliant Internet Advertising. In Proceedings of the 18th ACM Conference on Computer and Communications Security (CCS'11), October 2011.
31. R. Schlegel, K. Zhang, X. Zhou, M. Intwala, A. Kapadia, and X. Wang. Soundcomber: A Stealthy and Context-Aware Sound Trojan for Smartphones. In Proceedings of the 18th Annual Network and Distributed System Security Symposium, NDSS'11, pages 17-33, February 2011.
32. V. Toubiana, H. Nissenbaum, A. Narayanan, S. Barocas, and D. Boneh. Adnostic: Privacy Preserving Targeted Advertising. In Proceedings of the 17th Annual Network and Distributed System Security Symposium, NDSS'10, February 2010.
33. Y. Zhou, X. Zhang, X. Jiang, and V. Freeh. Taming Information-Stealing Smartphone Applications (on Android). In Proceedings of the 4th International Conference on Trust and Trustworthy Computing, TRUST'11, June 2011.