Practical Application-Level Dynamic Taint Analysis of Android Apps

Dynamic taint analysis traces data flows in applications at runtime and allows detection and consequently prevention of flow-based vulnerabilities, such as data leaks or injection attacks. While dynamic taint analysis spanning all components of the stack is potentially more precise, it requires adaptations of components across the OS stack and thus does not allow to analyze applications in their real runtime environment. In this paper, we introduce a dynamic taint analysis framework for Android applications which injects a taint analysis directly into an application's bytecode and can thus operate on any stock Android platform. Our approach is more precise than previous ones, copes with flow-aware source and sink definitions, and propagates data flows across process boundaries, including propagation over file I/O and inter process communication. We explain how our framework performs with popular apps from the Google Play Store and show that it achieves a precision which is comparable to the most precise platform-level tainting framework.