IccTA: Detecting inter-component privacy leaks in android apps

Li Li, Alexandre Bartel, Tegawendé F. Bissyandé, Jacques Klein, Yves Le Traon, Steven Arzt, Siegfried Rasthofer, Eric Bodden, Damien Octeau, Patrick McDaniel

Research output: Chapter in Book/Report/Conference proceedingConference contribution

333 Scopus citations

Abstract

Shake Them All is a popular "Wallpaper" application exceeding millions of downloads on Google Play. At installation, this application is given permission to (1) access the Internet (for updating wallpapers) and (2) use the device microphone (to change background following noise changes). With these permissions, the application could silently record user conversations and upload them remotely. To give more confidence about how Shake Them All actually processes what it records, it is necessary to build a precise analysis tool that tracks the flow of any sensitive data from its source point to any sink, especially if those are in different components. Since Android applications may leak private data carelessly or maliciously, we propose IccTA, a static taint analyzer to detect privacy leaks among components in Android applications. IccTA goes beyond state-of-the-art approaches by supporting intercomponent detection. By propagating context information among components, IccTA improves the precision of the analysis. IccTA outperforms existing tools on two benchmarks for ICC-leak detectors: DroidBench and ICC-Bench. Moreover, our approach detects 534 ICC leaks in 108 apps from MalGenome and 2,395 ICC leaks in 337 apps in a set of 15,000 Google Play apps.

Original languageEnglish (US)
Title of host publicationProceedings - 2015 IEEE/ACM 37th IEEE International Conference on Software Engineering, ICSE 2015
PublisherIEEE Computer Society
Pages280-291
Number of pages12
ISBN (Electronic)9781479919345
DOIs
StatePublished - Aug 12 2015
Event37th IEEE/ACM International Conference on Software Engineering, ICSE 2015 - Florence, Italy
Duration: May 16 2015May 24 2015

Publication series

NameProceedings - International Conference on Software Engineering
Volume1
ISSN (Print)0270-5257

Other

Other37th IEEE/ACM International Conference on Software Engineering, ICSE 2015
CountryItaly
CityFlorence
Period5/16/155/24/15

All Science Journal Classification (ASJC) codes

  • Software

Fingerprint Dive into the research topics of 'IccTA: Detecting inter-component privacy leaks in android apps'. Together they form a unique fingerprint.

Cite this