Detecting covert communication on Android

Abstract

Using covert channels, malicious applications on Android-based smartphones are able to subvert the permission system and share data in a potentially untraceable manner. These channels are easy to exploit today, and have enough bandwidth to transmit sensitive information in real-time between collaborating applications. In this paper, we define and implement an application layer covert communications detector that does not require special permission from the user. We quantify the effect our detector has on channel capacities for malicious applications that wish to remain stealthy. Lastly, we evaluate the robustness of the volume and vibration channels on the Android emulator, HTC G1, and Motorola Droid, as well as characterize the effects of background noise on data loss and transfer rates.