Review of side-channel privacy inference of Android mobile devices

Futian SHI; Jian MAO; Jianwei LIU

doi:10.11959/j.issn.2096-109x.2018034

您当前的位置：

首页 >

文章列表页 >

Review of side-channel privacy inference of Android mobile devices

Comprehensive Reviews | 更新时间：2024-06-03

- Review of side-channel privacy inference of Android mobile devices
- Chinese Journal of Network and Information Security Vol. 4, Issue 4, Pages: 12-21(2018)
- 作者机构：
- 作者简介：
- 基金信息：
- DOI：10.11959/j.issn.2096-109x.2018034
  CLC： TP393
- Online First：2018-04，
  
  Published：15 April 2018
- 稿件说明：
移动端阅览
Futian SHI, Jian MAO, Jianwei LIU. Review of side-channel privacy inference of Android mobile devices[J]. Chinese Journal of Network and Information Security, 2018, 4(4): 12-21.
DOI：

Futian SHI, Jian MAO, Jianwei LIU. Review of side-channel privacy inference of Android mobile devices[J]. Chinese Journal of Network and Information Security, 2018, 4(4): 12-21. DOI： 10.11959/j.issn.2096-109x.2018034.

摘要

针对存在敏感信息泄露的Android边信道，基于隐私信息关联对象进行分类分析；对主要攻击模型进行了分析总结，包括推测隐私信息的核心方法及各个推测攻击的应用场景；对针对边信道攻击的检测和抑制方法进行了总结，分析了现有防御机制存在的问题。最后，展望了边信道隐私推测攻击的发展和研究方向。

Abstract

Android side channels may leak users’sensitive information.The existing Android side-channel attacks were analyzed and classified according to the type of the privacy-sensitive information with their inference models.The mainstream privacy inference approaches were analyzed and the deployed scenarios of these attacks were summarized.In addition

the mechanisms were discussed to detect or suppress the side-channel-based attacks and disclosed their limitations.Finally

the potential directions of research on side-channel-based privacy inference in Android systems were proposed.

关键词

Keywords

references

KOCHER P C , . Timing attacks on implementations of Diffie-Hellman,RSA,DSS,and other systems [C ] // Annual International Cryptology Conference . 1996 : 104 - 113 .

KOCHER P , JAFFE J , JUN B . Differential power analysis [C ] // Annual International Cryptology Conference . 1999 : 388 - 397 .

QUISQUATER J J , SAMYDE D . Electromagnetic analysis (ema):measures and counter-measures for smart cards [M ] // Smart Card Programming and Security.Berlin:Springer . 2001 : 200 - 210 .

MANGARD S , OSWALD E , POPP T . Power analysis attacks:revealing the secrets of smart cards [M ] . Springer Science ＆ Business Media , 2008 .

国家计算机网络应急技术处理协调中心 . 2017 年第四季度国内操作系统及浏览器占比情况分析 [R ] . 2018 .

CNCERT . Analysis of the occupation ratio of domestic operating system and browser in the fourth quarter of 2017 [R ] . 2018 .

THURM S , KANE Y I . Your Apps are watching you [J ] . The Wall Street Journal , 2010 , 17 ( 1 ).

张玉清 , 王凯 , 杨欢 , 等 . Android 安全综述 [J ] . 计算机研究与发展 , 2014 , 51 ( 7 ): 1385 - 1396 .

ZHANG Y Q , WANG K , YANG H , et al . Survey of Android OS security [J ] . Journal of Computer Research and Development , 2014 , 51 ( 7 ): 1385 - 1396 .

MAO J , CHEN Y , SHI F , et al . Toward exposing timing-based probing attacks in Web applications [J ] . Sensors , 2017 , 17 ( 3 ): 464 .

JANA S , SHMATIKOV V . Memento:learning secrets from process footprints [C ] // 2012 IEEE Symposium on Security and Privacy (SP) . 2012 : 143 - 157 .

CHEN Q A , QIAN Z , MAO Z M . Peeking into your App without actually seeing it:UI state inference and novel Android attacks [C ] // USENIX Security Symposium . 2014 : 1037 - 1052 .

YAN L , GUO Y , CHEN X , et al . A study on power side channels on mobile devices [C ] // The 7th Asia-Pacific Symposium on Internetware . 2015 : 30 - 38 .

MICHALEVSKY Y , SCHULMAN A , VEERAPANDIAN G A , et al . PowerSpy:location tracking using mobile device power analysis [C ] // USENIX Security Symposium . 2015 : 785 - 800 .

ZHOU X , DEMETRIOU S , HE D , et al . Identity,location,disease and more:inferring your secrets from android public resources [C ] // The 2013 ACM SIGSAC Conference on Computer ＆ Communications Security . 2013 : 1017 - 1028 .

TAYLOR V F , SPOLAOR R , CONTI M , et al . Robust smartphone app identification via encrypted network traffic analysis [J ] . IEEE Transactions on Information Forensics and Security , 2018 , 13 ( 1 ): 63 - 78 .

CHANDRA S , LIN Z , KUNDU A , et al . Towards a systematic study of the covert channel attacks in smartphones [C ] // International Conference on Security and Privacy in Communication Systems . 2014 : 427 - 435 .

MARFORIO C , RITZDORF H , CAPKUN S . Analysis of the communication between colluding applications on modern smartphones [C ] // Computer Security Applications Conference . 2012 : 51 - 60 .

CAI L , CHEN H . TouchLogger:inferring keystrokes on touch screen from smartphone motion [C ] // Usenix Conference on Hot Topics in Security . 2011 : 9 - 9 .

OWUSU E , HAN J , DAS S , et al . ACCessory:password inference using accelerometers on smartphones [C ] // The Twelfth Workshop on Mobile Computing Systems ＆ Applications . ACM , 2012 :9.

宋晨光 , 刘建伟 , 伍前红 , 等 . 基于智能手表运动传感器的新型攻击及其防范 [J ] . 通信学报 , 2015 , 36 ( Z1 ): 235 - 242 .

SONG C G , LIU J W , WU Q H , et al . New attack based on smartwatch motion sensors and the protection method research [J ] . Journal on Communications , 2015 , 36 ( Z1 ): 235 - 242 .

PING D , SUN X , MAO B . Textlogger:inferring longer inputs on touch screen using motion sensors [C ] // The 8th ACM Conference on Security ＆ Privacy in Wireless and Mobile Networks . 2015 :24.

SPREITZER R , . Pin skimming:exploiting the ambient-light sensor in mobile devices [C ] // The 4th ACM Workshop on Security and Privacy in Smartphones ＆ Mobile Devices . 2014 : 51 - 62 .

HEMMINKI S , NURMI P , TARKOMA S . Accelerometer-based transportation mode detection on smartphones [C ] // The 11th ACM Conference on Embedded Networked Sensor Systems . 2013 :13.

HO B J , MARTIN P , SWAMINATHAN P , et al . From pressure to path:barometer-based vehicle tracking [C ] // The 2nd ACM International Conference on Embedded Systems for Energy-Efficient Built Environments . 2015 : 65 - 74 .

NARAIN S , VOHUU T D , BLOCK K , et al . Inferring user routes and locations using zero-permission mobile sensors [C ] // Security and Privacy . 2016 : 397 - 413 .

HAMERS L . Similarity measures in scientometric research:the Jaccard index versus Salton's cosine formula [J ] . Information Processing and Management , 1989 , 25 ( 3 ): 315 - 18 .

MÜLLER M . Dynamic time warping [J ] . Information Retrieval For Music and Motion , 2007 : 69 - 84 .

LIAW A , WIENER M . Classification and regression by randomForest [J ] . Rnews , 2002 , 2 ( 3 ): 18 - 22 .

SUYKENS J A K , VANDEWALLE J . Least squares support vector machine classifiers [J ] . Neural Processing Letters , 1999 , 9 ( 3 ): 293 - 300 .

EDDY S R . Hidden markov models [J ] . Current Opinion in Structural Biology , 1996 , 6 ( 3 ): 361 - 365 .

DIAO W , LIU X , LI Z , et al . No pardon for the interruption:new inference attacks on android through interrupt timing analysis [C ] // Security and Privacy . IEEE , 2016 : 414 - 432 .

MIKOLOV T , KARAFIÁT M , BURGET L , et al . Recurrent neural network based language model [C ] // The 11th Annual Conference of the International Speech Communication Association . 2010 .

SIMON L , XU W , ANDERSON R . Don’t interrupt me while i type:inferring text entered through gesture typing on Android keyboards [J ] . Proceedings on Privacy Enhancing Technologies , 2016 ( 3 ): 136 - 154 .

卿斯汉 . Android安全研究进展 [J ] . 软件学报 , 2016 , 27 ( 1 ): 45 - 71 .

QING S H . Research progress on Android Security [J ] . Journal of Software , 2016 , 27 ( 1 ): 45 - 71 .

ARZT S , RASTHOFER S , FRITZ C , et al . FlowDroid:precise context,flow,field,object-sensitive and lifecycle-aware taint analysis for Android apps [C ] // ACM Sigplan Conference on Programming Language Design and Implementation . 2014 : 259 - 269 .

ENCK W , GILBERT P , CHUN B G , et al . TaintDroid:an information flow tracking system for real-time privacy monitoring on smartphones [J ] . ACM Transactions on Computer Systems , 2010 , 32 ( 2 ): 1 - 29 .

AAFER Y , DU W , YIN H . DroidAPIMiner:mining API-level features for robust malware detection in Android [C ] // International Conference on Security and Privacy in Communication Systems . 2013 : 86 - 103 .

MARICONTI E , ONWUZURIKE L , ANDRIOTIS P , et al . MamaDroid:detecting android malware by building Markov chains of behavioral models [C ] // Network and Distributed Systems Security Symposium(NDSS'17) . 2017 .

BABIL G S , MEHANI O , BORELI R , et al . On the effectiveness of dynamic taint analysis for protecting against private information leaks on Android-based devices [C ] // IEEE International Conference on Security and Cryptography . 2015 : 1 - 8 .

GRAA M , CUPPENS-BOULAHIA N , CUPPENS F , et al . Detection of side channel attacks based on data tainting in Android systems [C ] // IFIP International Conference on ICT Systems Security and Privacy Protection . 2017 : 205 - 218 .

吴敬征 , 武延军 , 罗天悦 , 等 . 一种基于权限控制机制的 Android 系统隐蔽信道限制方法 [J ] . 中国科学院大学学报 , 2015 , 32 ( 5 ): 667 - 675 .

WU J Z , WU Y J , LUO T Y , et al . A new mitigation approach for covert channel of Android operating system based on permission mechanism [J ] . Journal of University of Chinese Academy of Sciences , 2015 , 32 ( 5 ): 667 - 675 .

SHRESTHA P , MOHAMED M , SAXENA N . Slogger:smashing motion-based touchstroke logging with transparent system noise [C ] // ACM Conference on Security ＆ Privacy in Wireless and Mobile Networks . 2016 : 67 - 77 .

SCHWARZ M , LIPP M , GRUSS D , et al . KeyDrown:eliminating software-based keystroke timing side-channel attacks [C ] // Network and Distributed System Security Symposium . 2018 .

PETRACCA G , SUN Y , JAEGER T , et al . Android:preventing attacks on audio channels in mobile devices [C ] // Computer Security Applications Conference . 2015 : 181 - 190 .

ZHANG N , YUAN K , NAVEED M , et al . Leave me alone:app-level protection against runtime information gathering on Android [C ] // IEEE Symposium on Security and Privacy . 2015 : 915 - 930 .

FELT A P , HA E , EGELMAN S , et al . Android permissions:user attention,comprehension,and behavior [C ] // The Eighth Symposium on Usable Privacy and Security . 2012 :3.

LIPP M , GRUSS D , SPREITZER R , et al . ARMageddon:cache attacks on mobile devices [C ] // USENIX Security Symposium . 2016 : 549 - 564 .

SPREITZER R , GRIESMAYR S , KORAK T , et al . Exploiting data-usage statistics for website fingerprinting attacks on Android [C ] // The 9th ACM Conference on Security ＆ Privacy in Wireless and Mobile Networks . 2016 : 49 - 60 .

APTHORPE N , REISMAN D , FEAMSTER N . A smart home is no castle:privacy vulnerabilities of encrypted IoT traffic [C ] // Workshop on Data and Algorithmic Transparency . 2016 .

Views

1977

下载量

CSCD

Alert me when the article has been cited

提交

Tools

Publicity Resources

Accelerating cryptographic computation with parallel computing mechanisms in Android platform

Anti-obfuscation Android application similarity detection method based on API call

Static-analysis-based event input generation approach for Android application

Related Author

Ning FANG

Weibing CAO

Donghe NI

Guandong DI

Jieming GU

Bowen SUN

Peng WU

Qi LI

Related Institution

Beijing Bangcle Security Technology Co.,Ltd.

Beijing Institute of Electronics Technology and Application

College of Computer Sciences and Technology,Qingdao University

School of Cyberspace Security，Beijing University of Post and Telecommunications

Beijing Key Laboratory of integration with the world Internet

⁰