2013sarwar_scrubdroid.bib

@inproceedings{2013sarwar_scrubdroid,
    abstract = {We investigate the limitations of using dynamic taint analysis for tracking privacy-sensitive information on Android-based mobile devices. Taint tracking keeps track of data as it propagates through variables, inter-process messages and files, by tagging them with taint marks. A popular taint-tracking system, {TaintDroid}, uses this approach in Android mobile applications to mark private information, such as device identifiers or user's contacts details, and subsequently issue warnings when this information is misused (e.g., sent to an undesired third party). We present a collection of attacks on Android-based taint tracking. Specifically, we apply generic classes of anti-taint methods in a mobile device environment to circumvent this security technique. We have implemented the presented techniques in an Android application, {ScrubDroid}. We successfully tested our app with the {TaintDroid} implementations for Android {OS} versions 2.3 to 4.1.1, both using the emulator and with real devices. Finally, we evaluate the success rate and time to complete of the presented attacks. We conclude that, although taint tracking may be a valuable tool for software developers, it will not effectively protect sensitive data from the black-box code of a motivated attacker applying any of the presented anti-taint tracking methods.},
    address = {Setubal, Portugal},
    author = {Sarwar, Golam and Mehani, Olivier and Boreli, Roksana and Kaafar, Mohamed~Ali},
    booktitle = {SECRYPT 2013, 10th International Conference on Security and Cryptography},
    day = {29},
    editor = {Samarati, Pierangela},
    keywords = {2013, android, dynamictaintanalysis, malware, nicta, oliviermehani, privacy, scrubdroid, security, taintdroid},
    location = {Reykj\'{a}vik, Iceland},
    month = jul,
    organization = {ACM SIGSAC},
    publisher = {SciTePress},
    title = {On the Effectiveness of Dynamic Taint Analysis for Protecting Against Private Information Leaks on {A}ndroid-based Devices},
    url = {http://www.nicta.com.au/pub?id=6865},
    pdf-url = {http://www.nicta.com.au/pub?doc=6865},
    code-url = {http://nicta.info/scrubdroid},
    year = {2013}
}