FloVasion: Towards Detection of non-sensitive Variable Based Evasive Information-Flow in Android Apps

ABSTRACT

Smartphones are enriched by applications (apps) available through the mobile ecosystem. Various studies have reported that apps leaking sensitive user and device information are the primary target of cyber criminals. Existing program analysis tools can detect such information leakage flows. Reverse engineering tools are deployed to determine app information-flow via control and data-flow analysis. Malware authors employ information-flow based evasion techniques while leaking privacy sensitive data. In this paper, we discuss five novel app attacks that evade information flow analysis and leak sensitive device and user information (e.g. IMEI, SIM details, Location details, and user contacts). These attacks circumvent state-of-the-art analysis tools. We show that sensitive information can be leaked via non-sensitive variables, or by performing runtime inspection of classes and fields. We analyzed the proposed novel attack apps against some of the most promising state-of-the-art static analysis tools such as FlowDroid, DroidSafe, and dynamic analysis tools such as TaintDroid. Furthermore, we evaluated Play-Protect i.e. default on-device anti-malware, AVL Antivirus, and some other top commercial products against proposed novel app attacks. We demonstrate that existing tools are vulnerable to proposed attacks. Finally, this paper proposes AspectJ based runtime monitor as a possible solution that can be incorporated in the state-of-the-art app analysis techniques to detect information flow misuse.

KEYWORDS:

• Android malware
• Flow evasion
• Sensitive variables
• Runtime information gathering

ACKNOWLEDGEMENT

We thank anonymous readers for proof-reading the article.

Additional information

Funding

This research is partly supported by the Indo German DST-DAAD Project, “Investigation of Data Leakage Prevention Techniques for Android”, grant ID: INT/FRG/DAAD/P-13/2016.

Notes on contributors

Bharat Buddhadev

Bharat Buddhadev is a professor and head in Computer Engineering Department, Government Engineering College, Gadhinagar, Gujarat (India). Before that, he was professor in Computer Engineering Department at L D College of Engineering for more than 24 years. As an investigator, he has completed various Government research projects. He has supervised 5 PhD candidates, covering different aspects of computer engineering and information technology. He completed his master's degree in computer science and engineering from Indian Institute of Technology, Delhi. Presently, he is a PhD research scholar in the Malaviya National Institute of Technology, Jaipur. He has more than thirty years of experience in teaching and research. He is actively doing his research in the domain of malware.

Parvez Faruki

Parvez Faruki received MTech and PhD in computer science and engineering from Malaviya National Institute of Technology, Jaipur, India, in July 2012 and March 2016, respectively. In 2012, he was awarded CFAIT $ 10,000 Commonwealth fellowship for six months to visit University of Saskatchewan, Canada for further research. He visited Laboratoire Bordelais de Recherche en Informatique (LaBRI) Bordeaux, France to pursue further research in May-June 2015. In 2005, he joined the Department of Technical Education, Govt of Gujarat as lecturer in Information Technology. Presently, he is working as assistant professor in Government MCA College Ahmedabad. His research interests are mobile security, malware analysis and detection techniques on Android and Microsoft Windows. Email: [email protected]

Manoj Singh Gaur

Manoj Singh Gaur assumed the charge of director, Indian Institute of Technology, Jammu in June, 2017. Prior to joining IIT Jammu he was a professor and Head of the Department of Computer Science and Engineering at Malaviya National Institute of Technology (MNIT) Jaipur, India. Additionally, he was professor-In-charge (Coordinator) of IIIT Kota, which is currently being mentored by MNIT Jaipur. He has been dean, Students Affairs and head, Central Computer Centre at MNIT Jaipur as well. He also served as chairman, senate UG Board at MNIT Jaipur. He completed his master's degree in computer science and engineering from Indian Institute of Science Bangalore and PhD from University of Southampton, UK. In his teaching and research career of more than two decades, he has been investigator of a number of funded research projects in the area of information security and networks on chip. He has been part of the core group of Project ISEA (Information Security Education and Awareness) which is a major multi-Institutional project in the domain of Information Security in India. He has served technical program committees of many IEEE/ACM conferences and is a contributing reviewer of a number of ACM/IEEE/Elsevier/IET/Springer journals. Email: [email protected]

Shubham Kharche

Shubham Kharche is MTech scholar at Malaviya National Institute of Technology Jaipur. He is passionate about identifying covert channels for detection for potentially unwanted apps. He has completed internship as a software developer in the Amazon, Hyderabad. He is also Member Technical at D E Shaw India Pvt Ltd, Hyderabad, Telangana, India.Email: [email protected]

Akka Zemmari

Akka Zemmari is associate professor (Maître de Conférences, HDR) in Computer Science Researcher at Laboratoire Bordelais de Recherche en Informatique (LaBRI) Leader of the Research Group Distributed Algorithms with team Combinatorics and Algorithms. He is passionate about research in machine and deep learning, distributed algorithms, fault tolerant algorithms and development of models for huge and highly dynamic distributed networks. He is currently collaborating with Indian Institute of Technology Jammu and Malaviya National Institute of Technology Jaipur on mobile malware detection, application collusion detection and malware analysis. He has published more the 80+ papers in reputed journals and conferences. Email: [email protected]