Detection of Side Channel Attacks Based on Data Tainting in Android Systems

Mariem Graa 1, 2 Nora Cuppens-Boulahia 1, 2 Frédéric Cuppens 1, 2 Jean-Louis Lanet 3 Routa Moussaileb 4
2 Lab-STICC_IMTA_CID_IRIS
Lab-STICC - Laboratoire des sciences et techniques de l'information, de la communication et de la connaissance
3 TAMIS - Threat Analysis and Mitigation for Information Security
Inria Rennes – Bretagne Atlantique , IRISA_D4 - LANGAGE ET GÉNIE LOGICIEL
Abstract : Malicious third-party applications can leak personal data stored in the Android system by exploiting side channels. TaintDroid uses a dynamic taint analysis mechanism to control the manipulation of private data by third-party apps [9]. However, TaintDroid does not propagate taint in side channels. An attacker can exploit this limitation to get private data. For example, Sarwar et al. [2] present side channel class of attacks using a medium that might be overlooked by the taint-checking mechanism to extract sensitive data in Android system. In this paper, we enhance the TaintDroid system and we propagate taint in side channels using formal policy rules. To evaluate the effectiveness of our approach, we analyzed 100 free Android applications. We found that these applications use different side channels to transfer sensitive data. We successfully detected that $$35\%$$35% of them leaked private information through side channels. Also, we detected Sarwar et al. [2] side channel attacks. Our approach generates $$9\%$$9% of false positives. The overhead given by our approach is acceptable in comparison to the one obtained by TaintDroid (9% overhead).
Type de document :
Communication dans un congrès
Sabrina De Capitani di Vimercati; Fabio Martinelli. SEC 2017 - 32th IFIP International Conference on ICT Systems Security and Privacy Protection, May 2017, Rome, Italy. Springer International Publishing, IFIP Advances in Information and Communication Technology, AICT-502, pp.205-218, 2017, ICT Systems Security and Privacy Protection. 〈10.1007/978-3-319-58469-0_14 〉
Liste complète des métadonnées

Littérature citée [20 références]  Voir  Masquer  Télécharger

https://hal.inria.fr/hal-01648994
Contributeur : Hal Ifip <>
Soumis le : lundi 27 novembre 2017 - 10:31:13
Dernière modification le : mercredi 16 mai 2018 - 11:24:14

Fichier

 Accès restreint
Fichier visible le : 2020-01-01

Connectez-vous pour demander l'accès au fichier

Licence


Distributed under a Creative Commons Paternité 4.0 International License

Identifiants

Citation

Mariem Graa, Nora Cuppens-Boulahia, Frédéric Cuppens, Jean-Louis Lanet, Routa Moussaileb. Detection of Side Channel Attacks Based on Data Tainting in Android Systems. Sabrina De Capitani di Vimercati; Fabio Martinelli. SEC 2017 - 32th IFIP International Conference on ICT Systems Security and Privacy Protection, May 2017, Rome, Italy. Springer International Publishing, IFIP Advances in Information and Communication Technology, AICT-502, pp.205-218, 2017, ICT Systems Security and Privacy Protection. 〈10.1007/978-3-319-58469-0_14 〉. 〈hal-01648994〉

Partager

Métriques

Consultations de la notice

514