Android permissions demystified

Conference on Computer and Communications Security : proceedings of the ... conference on computer and communications security. ACM Conference on Computer and Communications Security Pub Date : 2011-10-17 DOI:10.1145/2046707.2046779

A. Felt, Erika Chin, Steve Hanna, D. Song, D. Wagner

{"title":"Android permissions demystified","authors":"A. Felt, Erika Chin, Steve Hanna, D. Song, D. Wagner","doi":"10.1145/2046707.2046779","DOIUrl":null,"url":null,"abstract":"Android provides third-party applications with an extensive API that includes access to phone hardware, settings, and user data. Access to privacy- and security-relevant parts of the API is controlled with an install-time application permission system. We study Android applications to determine whether Android developers follow least privilege with their permission requests. We built Stowaway, a tool that detects overprivilege in compiled Android applications. Stowaway determines the set of API calls that an application uses and then maps those API calls to permissions. We used automated testing tools on the Android API in order to build the permission map that is necessary for detecting overprivilege. We apply Stowaway to a set of 940 applications and find that about one-third are overprivileged. We investigate the causes of overprivilege and find evidence that developers are trying to follow least privilege but sometimes fail due to insufficient API documentation.","PeriodicalId":72687,"journal":{"name":"Conference on Computer and Communications Security : proceedings of the ... conference on computer and communications security. ACM Conference on Computer and Communications Security","volume":"195 1","pages":"627-638"},"PeriodicalIF":0.0000,"publicationDate":"2011-10-17","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":"1499","resultStr":null,"platform":"Semanticscholar","paperid":null,"PeriodicalName":"Conference on Computer and Communications Security : proceedings of the ... conference on computer and communications security. ACM Conference on Computer and Communications Security","FirstCategoryId":"1085","ListUrlMain":"https://doi.org/10.1145/2046707.2046779","RegionNum":0,"RegionCategory":null,"ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":null,"EPubDate":"","PubModel":"","JCR":"","JCRName":"","Score":null,"Total":0}

引用次数: 1499

Abstract

Android provides third-party applications with an extensive API that includes access to phone hardware, settings, and user data. Access to privacy- and security-relevant parts of the API is controlled with an install-time application permission system. We study Android applications to determine whether Android developers follow least privilege with their permission requests. We built Stowaway, a tool that detects overprivilege in compiled Android applications. Stowaway determines the set of API calls that an application uses and then maps those API calls to permissions. We used automated testing tools on the Android API in order to build the permission map that is necessary for detecting overprivilege. We apply Stowaway to a set of 940 applications and find that about one-third are overprivileged. We investigate the causes of overprivilege and find evidence that developers are trying to follow least privilege but sometimes fail due to insufficient API documentation.

查看原文

微信好友朋友圈 QQ好友复制链接

本刊更多论文

揭开Android权限的神秘面纱

Android为第三方应用程序提供了广泛的API，包括对手机硬件、设置和用户数据的访问。通过安装时应用程序权限系统控制对API中与隐私和安全相关部分的访问。我们研究Android应用程序，以确定Android开发人员是否遵循最小权限请求。我们开发了一款名为“偷渡者”的工具，用于检测编译后的Android应用程序中的过度权限。stowaaway确定应用程序使用的API调用集，然后将这些API调用映射到权限。我们在Android API上使用了自动化测试工具，以便构建检测过度权限所必需的权限映射。我们将偷渡者应用到940个申请中，发现大约三分之一的人享有特权。我们调查了过度特权的原因，并发现开发人员试图遵循最小特权，但有时由于API文档不足而失败的证据。

本文章由计算机程序翻译，如有差异，请以英文原文为准。

求助全文

约1分钟内获得全文去求助

来源期刊

Conference on Computer and Communications Security : proceedings of the ... conference on computer and communications security. ACM Conference on Computer and Communications Security

CiteScore

9.20

自引率

0.00%

发文量