What the app is that? Deception and countermeasures in the android user interface

Proceedings - IEEE Symposium on Security and Privacy

Volumn 2015-July, Issue , 2015, Pages 931-948

  Bianchi, Antonio ^a   Corbetta, Jacopo ^a   Invernizzi, Luca ^a   Fratantonio, Yanick ^a   Kruegel, Christopher ^a   Vigna, Giovanni ^a  

^a University of California   (United States)

Author keywords

mobile security; static analysis; usable security

Indexed keywords

ANDROID (OPERATING SYSTEM); GRAPHICAL USER INTERFACES; NETWORK SECURITY; STATIC ANALYSIS;

ANDROID PLATFORMS; ATTACK VECTOR; HUMAN SUBJECTS; MOBILE APPLICATIONS; SENSITIVE INFORMATIONS; STATE EXPLORATION; USABLE SECURITY; VISUAL APPEARANCE;

MOBILE SECURITY;

EID: 84945177387     PISSN: 10816011     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/SP.2015.62     Document Type: Conference Paper

References (44)

1. comScore, "The U.S. Mobile App Report," http://www.comscore.com/I nsights/Presentations-and-Whitepapers/2014/The-US-Mobile-App-Rep ort, 2014.
2. ESET, "Trends for 2013," http://www.eset.com/us/resources/white-pap ers/Trends for 2013 preview.pdf.
3. M. Niemietz and J. Schwenk, "UI Redressing Attacks on Android Devices," Black Hat Abu Dhabi, 2012.
4. T. Luo, X. Jin, A. Ananthanarayanan, and W. Du, "Touchjacking Attacks on Web in Android, iOS, and Windows Phone," in Proceedings of the 5th International Conference on Foundations and Practice of Security (FPS). Berlin, Heidelberg: Springer-Verlag, 2012, pp. 227-243.
5. A. P. Felt and D. Wagner, "Phishing on mobile devices," Web 2.0 Security and Privacy, 2011.
6. Q. A. Chen, Z. Qian, and Z. M. Mao, "Peeking into Your App Without Actually Seeing It: UI State Inference and Novel Android Attacks," in Proceedings of the 23rd USENIX Security Symposium. Berkeley, CA, USA: USENIX Association, 2014, pp. 1037-1052.
7. Bank of America, "SiteKey Security," https://www.bankofamerica.co m/privacy/online-mobile-banking-privacy/sitekey.go.
8. Yahoo, "Yahoo Personalized Sign-In Seal," https://protect.login.yaho o.com.
9. E. Fernandes, Q. A. Chen, G. Essl, J. A. Halderman, Z. M. Mao, and A. Prakash, "TIVOs: Trusted Visual I/O Paths for Android," University of Michigan CSE Technical Report CSE-TR-586-14, 2014.
10. TrendLabs, "Tapjacking: An Untapped Threat in Android," http://blog.trendmicro.com/trendlabs-security-intelligence/tapjacki ng-an-untapped-threat-in-android/, December 2012.
11. TrendLabs, "Bypassing Android Permissions: What You Need to Know," http://blog.trendmicro.com/trendlabs-security-intelligence/bypa ssing-android-permissions-what-you-need-to-know/, November 2012.
12. S. Jana and V. Shmatikov, "Memento: Learning Secrets from Process Footprints," in Proceedings of the IEEE Symposium on Security and Privacy (SP), May 2012, pp. 143-157.
13. S. Hanna, L. Huang, E. Wu, S. Li, C. Chen, and D. Song, "Juxtapp: A Scalable System for Detecting Code Reuse Among Android Applications," in Proceedings of the 9th International Conference on Detection of Intrusions and Malware, and Vulnerability Assessment (DIMVA). Berlin, Heidelberg: Springer-Verlag, 2012, pp. 62-81.
14. W. Zhou, Y Zhou, X. Jiang, and P. Ning, "Detecting Repackaged Smartphone Applications in Third-party Android Marketplaces," in Proceedings of the Second ACM Conference on Data and Application Security and Privacy (CODASPY). New York, NY, USA: ACM, 2012, pp. 317-326.
15. W. Zhou, X. Zhang, and X. Jiang, "Applnk: Watermarking Android Apps for Repackaging Deterrence," in Proceedings of the 8th ACM SIGSAC Symposium on Information, Computer and Communications Security (ASIA CCS). New York, NY, USA: ACM, 2013, pp. 1-12.
16. P. De Ryck, N. Nikiforakis, L. Desmet, and W. Joosen, "TabShots: Client-side Detection of Tabnabbing Attacks," in Proceedings of the 8th ACM SIGSAC Symposium on Information, Computer and Communications Security (ASIA CCS). New York, NY, USA: ACM, 2013, pp. 447-456.
17. Google, "Using Immersive Full-Screen Mode," https://developer, android.com/training/system-ui/immersive.html.
18. M. Egele, D. Brumley, Y Fratantonio, and C. Kruegel, "An Empirical Study of Cryptographic Misuse in Android Applications," in Proceedings of the 2013 ACM SIGSAC Conference on Computer and Communications Security (CCS). New York, NY, USA: ACM, 2013, pp. 73-84.
19. A. Desnos and G. Gueguen, "Android: From reversing to decompilation," Black Hat Abu Dhabi, 2011.
20. M. Weiser, "Program slicing," in Proceedings of the 5th international conference on Software engineering. IEEE Press, 1981, pp. 439-449.
21. R. Pandita, X. Xiao, W. Yang, W Enck, and T. Xie, "WHYPER: Towards Automating Risk Assessment of Mobile Applications," in Proceedings of the 22nd USENIX Security Symposium. Berkeley, CA, USA: USENIX Association, 2013, pp. 527-542.
22. Y Zhou and X. Jiang, "Dissecting Android Malware: Characterization and Evolution," in Proceedings of the IEEE Symposium on Security and Privacy (SP), May 2012, pp. 95-109.
23. R. Unuchek, "The Android Trojan Svpeng Now Capable of Mobile Phishing," http://securelist.com/blog/research/57301/the-android-troja n-svpeng-now-capable-of-mobile-phishing/, November 2013.
24. CA/Browser Forum, "Guidelines For The Issuance And Management Of Extended Validation Certificates," https://cabforum.org/wp-content/uploads/Guidelines-vl-4-3.pdf, 2013.
25. Google, "Featured, Staff Picks, Collections, and Badges," https://develo per.android.com/distribute/googleplay/about.html#featured-staff-picks.
26. J. Clark and P. van Oorschot, "SoK: SSL and HTTPS: Revisiting Past Challenges and Evaluating Certificate Trust Model Enhancements," in Proceedings of the IEEE Symposium on Security and Privacy (SP), May 2013, pp. 511-525.
27. A. Kittur, E. H. Chi, and B. Suh, "Crowdsourcing User Studies with Mechanical Turk," in Proceedings of the SIGCHI Conference on Human Factors in Computing Systems. New York, NY, USA: ACM, 2008, pp. 453-456.
28. F. Roesner and T. Kohno, "Securing Embedded User Interfaces: Android and Beyond," in Proceedings of the 22nd USENIX Security Symposium. Berkeley, CA, USA: USENIX Association, 2013, pp. 97-112.
29. A. P. Felt, E. Ha, S. Egelman, A. Haney, E. Chin, and D. Wagner, "Android Permissions: User Attention, Comprehension, and Behavior," in Proceedings of the Eighth Symposium On Usable Privacy and Security (SOUPS). New York, NY, USA: ACM, 2012, pp. 3:1-3:14.
30. R. Xu, H. Saïdi, and R. Anderson, "Aurasium: Practical Policy Enforcement for Android Applications," in Proceedings of the 21st USENIX Security Symposium. Berkeley, CA, USA: USENIX Association, 2012, pp. 27-27.
31. Z. E. Ye and S. Smith, "Trusted Paths for Browsers," in Proceedings of the 11th USENIX Security Symposium. Berkeley, CA, USA: USENIX Association, 2002, pp. 263-279.
32. A. Neupane, N. Saxena, K. Kuruvilla, M. Georgescu, and R. Kana, "Neural Signatures of User-Centered Security: An fMRI Study of Phishing and Malware Warnings," in Proceedings of the 21st Annual Network and Distributed System Security Symposium (NDSS), 2014.
33. Y Niu, F. Hsu, and H. Chen, "iPhish: Phishing Vulnerabilities on Consumer Electronics." in Proceedings of the 1st Conference on Usability, Psychology, and Security (UPSEC), 2008.
34. J. Sunshine, S. Egelman, H. Almuhimedi, N. Atri, and L. F. Cranor, "Crying Wolf: An Empirical Study of SSL Warning Effectiveness," in Proceedings of the 18th USENIX Security Symposium. Berkeley, CA, USA: USENIX Association, 2009, pp. 399-416.
35. J. Lee, L. Bauer, and M. L. Mazurek, "The Effectiveness of Security Images in Internet Banking," Internet Computing, IEEE, vol. 19, no. 1, pp. 54-62, Jan 2015.
36. S. Fahl, M. Harbach, T. Muders, L. Baumgärtner, B. Freisleben, and M. Smith, "Why Eve and Mallory Love Android: An Analysis of Android SSL (in)Security," in Proceedings of the 2012 ACM Conference on Computer and Communications Security (CCS). New York, NY, USA: ACM, 2012, pp. 50-61.
37. S. Schechter, R. Dhamija, A. Ozment, and I. Fischer, "The Emperor's New Security Indicators," in Proceedings of the IEEE Symposium on Security and Privacy (SP), May 2007, pp. 51-65.
38. D. Akhawe and A. P. Felt, "Alice in Warningland: A Large-scale Field Study of Browser Security Warning Effectiveness," in Proceedings of the 22nd USENIX Security Symposium. Berkeley, CA, USA: USENIX Association, 2013, pp. 257-272.
39. N. Chou, R. Ledesma, Y Teraguchi, D. Boneh, and J. C. Mitchell, "Client-side defense against web-based identity theft," in Proceedings of the 11th Annual Network and Distributed System Security Symposium (NDSS), 2004.
40. R. Dhamija and J. D. Tygar, "The Battle Against Phishing: Dynamic Security Skins," in Proceedings of the Symposium On Usable Privacy and Security (SOUPS). New York, NY, USA: ACM, 2005, pp. 77-88.
41. E. Kirda and C. Kruegel, "Protecting users against phishing attacks with AntiPhish," in Proceedings of the Computer Software and Applications Conference (COMPSAC), vol. 1, July 2005, pp. 517-524 Vol. 2.
42. Google, "Safe Browsing," http://www.google.com/transparencyrepor t/safebrowsing/.
43. D. Clercq and Grillenmeie, Microsoft Windows Security Fundamentals. (Chapter 5.2.1), Connecticut, USA: Digital Press, October 2006.
44. J. Rutkowska, "Qubes OS Architecture (Section 5.3)," http://files.qubes-os.Org/files/doc/arch-spec-0.3.pdf, January 2010.