More Like this

1. DryJIN: Detecting Information Leaks in Android Applications

   Choi, Minseong; Im, Yubin; Ko, Steve; Kwon, Yonghwi; Jeon, Yuseok; Cho, Haehyun (July 2024, IFIP International Conference on ICT Systems Security and Privacy Protection)

   Android devices, handling sensitive data like call records and text messages, are prone to privacy breaches. Existing information flow tracking systems face difficulties in detecting these breaches due to two main challenges: the multi-layered Android platform using different programming languages (Java and C/C++), and the complex, event-driven execution flow of Android apps that complicates tracking, especially across these language barriers. Our system, DryJIN, addresses this by effectively tracking information flow within and across both Java and native modules. Utilizing symbolic execution for native code data flows and integrating it with Java data flows, DryJIN enhances existing static analysis techniques (Argus-SAF, JuCify, and FlowDroid) to cover previously unaddressed information flow patterns. We validated DryJIN ’s effectiveness through a comprehensive evaluation on over 168k apps, including malware and real-world apps, demonstrating its superiority over current state-of-the-art methods. 

   more » « less
2. GUILeak: Tracing Privacy Policy Claims on User Input Data for Android Applications

   https://doi.org/10.1145/3180155.3180196  

   Wang, Xiaoyin; Qin, Xue; Hosseini, Mitra Bokaei; Slavin, Rocky; Breaux, Travis D.; Niu, Jianwei (May 2018, Proceedings - International Conference on Software Engineering)

   The Android mobile platform supports billions of devices across more than 190 countries around the world. This popularity coupled with user data collection by Android apps has made privacy protection a well-known challenge in the Android ecosystem. In practice, app producers provide privacy policies disclosing what information is collected and processed by the app. However, it is difficult to trace such claims to the corresponding app code to verify whether the implementation is consistent with the policy. Existing approaches for privacy policy alignment focus on information directly accessed through the Android platform (e.g., location and device ID), but are unable to handle user input, a major source of private information. In this paper, we propose a novel approach that automatically detects privacy leaks of user-entered data for a given Android app and determines whether such leakage may violate the app's privacy policy claims. For evaluation, we applied our approach to 120 popular apps from three privacy-relevant app categories: finance, health, and dating. The results show that our approach was able to detect 21 strong violations and 18 weak violations from the studied apps. 

   more » « less
3. Same Script, Different Behavior: Characterizing Divergent JavaScript Execution Across Different Device Platforms

   https://doi.org/10.1145/3719027.3765202  

   Zafar, Ahsan; Su, Junhua; Datta, Sohom; Kapravelos, Alexandros; Das, Anupam (November 2025, ACM)

   JavaScript drives dynamic content across modern web platforms, yet differences in browser engines, hardware, and APIs create distinct execution environments on mobile and desktop devices. This divergence raises important concerns about platform-specific tracking, but its scope and impact remain underexplored. In this paper, we present a hybrid analysis of JavaScript execution across mobile and desktop to uncover behavioral differences in how identical code operates. By combining static analysis of script structure with dynamic tracing of runtime behavior, we identify execution path divergences tied to the user's device. Our study shows that 20.6% of scripts on the top 10K Tranco-ranked websites exhibit platform-specific execution. Our tracing algorithm pinpoints the sources of divergence for 92.8% of conditional Web API calls, with 76% involving known fingerprinting APIs and 6% relying on lesser-known but platform-revealing interfaces. We further categorize divergent paths, finding asymmetric tracking patterns: desktop flows are dominated by fingerprinting and bot detection, while mobile flows focus more on behavioral profiling. 

   more » « less
4. Do You Get What You Pay For? Comparing The Privacy Behaviors of Free vs. Paid Apps

   Han, Catherine; Reyes, Irwin; Elazari Bar On, Amit; Reardon, Joel; Feal, Álvaro; Bamberger, Kenneth A.; Egelman, Serge; Vallina-Rodriguez, Narseo (June 2019, The Workshop on Technology and Consumer Protection (ConPro ’19))

   It is commonly assumed that the availability of “free” mobile apps comes at the cost of consumer privacy, and that paying for apps could offer consumers protection from behavioral advertising and long-term tracking. This work empirically evaluates the validity of this assumption by investigating the degree to which “free” apps and their paid premium versions differ in their bundled code, their declared permissions, and their data collection behaviors and privacy practices. We compare pairs of free and paid apps using a combination of static and dynamic analysis. We also examine the differences in the privacy policies within pairs. We rely on static analysis to determine the requested permissions and third-party SDKs in each app; we use dynamic analysis to detect sensitive data collected by remote services at the network traffic level; and we compare text versions of privacy policies to identify differences in the disclosure of data collection behaviors. In total, we analyzed 1,505 pairs of free Android apps and their paid counterparts, with free apps randomly drawn from the Google Play Store’s category-level top charts. Our results show that over our corpus of free and paid pairs, there is no clear evidence that paying for an app will guarantee protection from extensive data collection. Specifically, 48% of the paid versions reused all of the same third-party libraries as their free versions, while 56% of the paid versions inherited all of the free versions’ Android permissions to access sensitive device resources (when considering free apps that include at least one third-party library and request at least one Android permission). Additionally, our dynamic analysis reveals that 38% of the paid apps exhibit all of the same data collection and transmission behaviors as their free counterparts. Our exploration of privacy policies reveals that only 45% of the pairs provide a privacy policy of some sort, and less than 1% of the pairs overall have policies that differ between free and paid versions. 

   more » « less
5. Spartan Jester: end-to-end information flow control for hybrid Android applications

   Sexton, Julian; Chudnov, Andrey; Naumann, David A. (May 2017, IEEE Mobile Security Technologies (MoST))

   Web-based applications are attractive due to their portability. To leverage that, many mobile applications are hybrid, incorporating a web component that implements most of their functionality. While solutions for enforcing security exist for both mobile and web applications, enforcing and reasoning about the security of their combinations is difficult. We argue for a combination of static and dynamic analysis for assurance of end-to-end confidentiality in hybrid apps. We show how information flows in hybrid Android applications can be secured through use of SPARTA, a static analyzer for Android/Java, and JEST, a dynamic monitor for JavaScript, connected by a compatibility layer that translates policies and value representations. This paper reports on our preliminary investigation using a case study. 

   more » « less