Managing Privacy-sensitive Resource Access in Smartphone Applications
Automatic Mediation Of
Privacy-sensitive
Resource Access In
Smartphone Applications
B
e
n
L
i
v
s
h
i
t
s
a
n
d
J
a
e
y
e
o
n
J
u
n
g
M
i
c
r
o
s
o
f
t
R
e
s
e
a
r
c
h
PERMISSIONS IN
MOBILE APPS
2
Permissions Flavors
3
Examples of Permissions in Different
Mobile Operating Systems
4
General Guidelines
5
Best Practices for Mobile Application Developers
Center for Democracy & Technology
Guarding Location Access
•
Focus on 3 representative applications in the
Windows Phone store
6
AroundMe
7
public static bool AroundMe.App.CheckOptin() {if (((Option)Enum.Parse(typeof(Option),Config.GetSetting
(SettingConstants.UseMyLocation),true)) == Option.Yes) {return GetCurrentCoordinates();
}
if (MessageBox.Show("This app needs ...","Use location data?", MessageBoxButton.OKCancel)
== MessageBoxResult.OK)
{Config.UpdateSetting(new KeyValuePair<string,string>
(SettingConstants.UseMyLocation,Option.Yes.ToString()));
return GetCurrentCoordinates();
}
...
}
Burger King
8
public BurgerKing.View.MapPage() {this.InitializeComponent();
base.DataContext = new MapViewModel();
this.BuildApplicationBar();
if (AppSettings.Current.UseLocationService){this.watcher = new GeoCoordinateWatcher();
}
..
}
protected virtual void GART.Controls.ARDisplay.
OnLocationEnabledChanged(
DependencyPropertyChangedEventArgs e)
{ if (this.servicesRunning) { if (this.LocationEnabled) {this.StartLocation();
…
LumiaClock
9
public SomaAd()
{...
this._locationUseOK = true;
...
if (this._locationUseOK) {this.watcher = new GeoCoordinateWatcher
(GeoPositionAccuracy.Default);
this.watcher.MovementThreshold = 20.0;
this.watcher.StatusChanged +=
new EventHandler
<GeoPositionStatusChangedEventArgs>(
this.watcher_StatusChanged);
this.watcher.Start();
}
}
Where Does that Leave Us?
•
Properly protecting
location access is
challenging
•
Location access is
common
•
Some location-related code
is in the app
•
A lot of location access in
third-party libraries
•
Location choices are
sometimes ignored
•
Third-party libraries such
as ad libraries sometimes
expose flags for enabling
location access but those
are frequently ignored by
developers
10
1
•
Study how existing
applications
implement resource
access prompts on a
set of Windows Phone
applications
Contributions
2
•
F
o
r
m
u
l
a
t
e
a
p
r
o
b
l
e
m
o
f
v
a
l
i
d
p
r
o
m
p
t
p
l
a
c
e
m
e
n
t
i
n
g
r
a
p
h
-
t
h
e
o
r
e
t
i
c
t
e
r
m
s
•
P
r
o
p
o
s
e
a
s
t
a
t
i
c
a
n
a
l
y
s
i
s
a
l
g
o
r
i
t
h
m
f
o
r
c
o
r
r
e
c
t
r
e
s
o
u
r
c
e
a
c
c
e
s
s
p
r
o
m
p
t
p
l
a
c
e
m
e
n
t
Static analysis
13
3
•
W
e
e
v
a
l
u
a
t
e
o
u
r
a
p
p
r
o
a
c
h
t
o
b
o
t
h
l
o
c
a
t
i
n
g
m
i
s
s
i
n
g
p
r
o
m
p
t
s
a
n
d
p
l
a
c
i
n
g
t
h
e
m
w
h
e
n
t
h
e
y
a
r
e
m
i
s
s
i
n
g
o
n
1
0
0
a
p
p
s
•
O
v
e
r
a
l
l
,
o
u
r
t
w
o
-
p
r
o
n
g
s
t
r
a
t
e
g
y
o
f
d
o
m
i
n
a
t
o
r
-
b
a
s
e
d
a
n
d
b
a
c
k
w
a
r
d
p
l
a
c
e
m
e
n
t
s
u
c
c
e
e
d
s
i
n
a
b
o
u
t
9
5
%
o
f
a
l
l
u
n
i
q
u
e
c
a
s
e
s
•
Our analyses run in seconds,
making it possible to run them as
part of the app submission process
Evaluation
ANALYSIS APPROACH
14
In This Paper…
•
W
e
f
o
c
u
s
o
n
a
c
o
m
p
l
e
t
e
l
y
a
u
t
o
m
a
t
i
c
w
a
y
t
o
i
n
s
e
r
t
m
i
s
s
i
n
g
p
r
o
m
p
t
s
•
O
u
r
a
p
p
r
o
a
c
h
i
s
s
t
a
t
i
c
:
w
e
w
a
n
t
t
o
b
e
a
b
l
e
t
o
c
h
e
c
k
f
o
r
m
i
s
s
i
n
g
p
r
o
m
p
t
s
a
n
d
i
n
s
e
r
t
c
o
m
p
e
n
s
a
t
i
n
g
c
o
d
e
e
v
e
n
i
f
w
e
c
a
n
n
o
t
h
i
t
i
t
a
t
t
h
r
o
u
g
h
r
u
n
t
i
m
e
t
e
s
t
i
n
g
•
Graph-theoretic approach
•
Represent the application
statically as a graph
•
An inter-procedural version of
control flow graph (CFG)
•
Reason about prompt
placement in graph-theoretic
terms
•
Not information flow
•
A lot of work on finding
undesirable information flows
•
W
e
r
e
a
s
o
n
a
b
o
u
t
c
o
n
t
r
o
l
f
l
o
w
n
o
t
d
a
t
a
f
l
o
w
15
Challenges
1.
A
v
o
i
d
i
n
g
d
o
u
b
l
e
-
p
r
o
m
p
t
s
2.
Sticky prompts
3.
Avoiding weaker prompts
4.
Minimizing prompting
5.
Avoiding prompts in
background tasks
6.
Avoiding prompts in
libraries
if(P) l1 =
getLocation
();
l2 =
getLocation
();
16
Challenges
1.
Avoiding double-prompts
2.
S
t
i
c
k
y
p
r
o
m
p
t
s
3.
Avoiding weaker prompts
4.
Minimizing prompting
5.
Avoiding prompts in
background tasks
6.
Avoiding prompts in
libraries
17
Challenges
1.
Avoiding double-prompts
2.
Sticky prompts
3.
Avoiding weaker prompts
4.
Minimizing prompting
5.
A
v
o
i
d
i
n
g
p
r
o
m
p
t
s
i
n
b
a
c
k
g
r
o
u
n
d
t
a
s
k
s
6.
A
v
o
i
d
i
n
g
p
r
o
m
p
t
s
i
n
l
i
b
r
a
r
i
e
s
18
3
rd
party.dll
Valid Placement
19
Intuition for Placement
1.
Start with a resource access
2.
“Move” the prompts up until we
are outside of background tasks
•
Downside
:
•
possible to move these prompts too
far (to the beginning of the app in
the most extreme case)
•
This would violate the
frugal
requirement.
•
T
h
i
s
g
i
v
e
s
r
i
s
e
t
o
a
n
o
t
i
o
n
o
f
a
p
r
o
m
p
t
b
e
i
n
g
n
e
e
d
e
d
a
t
a
p
a
r
t
i
c
u
l
a
r
p
o
i
n
t
,
f
o
r
w
h
i
c
h
w
e
u
s
e
t
h
e
t
e
r
m
a
n
t
i
c
i
p
a
t
i
n
g
20
5
getLocation()
Dominator-Based Approach
21
1
Not frugal!
5
5
getLocation()
Backward Placement
22
5
5
2
Slower
4
getLocation()
Analysis Steps
23
1.
For every resource access type and every node
n
, pre-
compute r-anticipated value
A
r
(n)
2.
Merge values by meeting them in the semi-lattice of resource
types
A(n) =
ᴧ
A
r
(n)
3.
For every
EVALUATION
24
Input Statistics
25
Benchmarks
26
•
Took 100 WP 7 apps
•
T
o
m
a
k
e
t
h
i
s
m
e
a
n
i
n
g
f
u
l
,
c
h
o
s
e
a
p
p
s
w
i
t
h
L
O
C
A
T
I
O
N
a
n
d
N
E
T
W
O
R
K
I
N
G
c
a
p
s
•
An average app is 7.3 MB
of code
•
Uses third-party ad libraries
Prompt Placement Success
27
Dominator-Based vs. Backward
•
When dominator-based
placement succeeds, it is
usually immediate
•
Backward placement is
helpful for cases where
dominator-based
placement fails
•
However, some of these
cases are still too hard,
leading to 7 unique failures
28
Timing
29
Manual Examination
•
Picked 10 apps with 27
resource accesses
•
Manually exercised as much
functionality as possible
•
V
e
r
i
f
i
c
a
t
i
o
n
i
n
c
l
u
d
e
s
r
u
n
n
i
n
g
t
h
e
s
e
a
p
p
s
i
n
a
n
e
m
u
l
a
t
o
r
t
o
c
o
l
l
e
c
t
n
e
t
w
o
r
k
p
a
c
k
e
t
s
a
n
d
A
P
I
c
a
l
l
s
•
F
a
l
s
e
n
e
g
a
t
i
v
e
s
:
r
e
s
o
u
r
c
e
a
c
c
e
s
s
w
e
t
h
i
n
k
i
s
p
r
o
t
e
c
t
e
d
w
h
e
r
e
a
s
i
n
f
a
c
t
a
t
r
u
n
t
i
m
e
i
t
h
a
s
n
o
p
r
e
c
e
d
i
n
g
p
r
o
m
p
t
s
•
O
u
t
o
f
2
7
a
c
c
e
s
s
e
s
o
u
r
a
n
a
l
y
s
i
s
r
e
p
o
r
t
s
1
0
a
s
u
n
p
r
o
t
e
c
t
e
d
•
N
o
f
a
l
s
e
n
e
g
a
t
i
v
e
s
o
b
s
e
r
v
e
d
:
a
n
a
l
y
s
i
s
c
o
r
r
e
c
t
l
y
i
d
e
n
t
i
f
i
e
s
t
h
e
m
a
s
u
n
p
r
o
t
e
c
t
e
d
a
n
d
f
i
n
d
s
p
r
o
p
e
r
p
r
o
m
p
t
p
l
a
c
e
m
e
n
t
s
30
False Positives
•
F
a
l
s
e
p
o
s
i
t
i
v
e
s
:
a
n
a
l
y
s
i
s
c
l
a
s
s
i
f
i
e
s
a
r
e
s
o
u
r
c
e
a
c
c
e
s
s
a
s
u
n
p
r
o
t
e
c
t
e
d
w
h
e
r
e
a
s
i
t
i
s
p
r
o
p
e
r
l
y
p
r
o
t
e
c
t
e
d
a
t
r
u
n
t
i
m
e
•
11 out of 21 accesses found
as unprotected turn out to be
false positives
•
Reasons include:
•
Not recognizing sticky prompts
•
Custom consent dialogs
•
Async calls and XAML
31
•
Our analysis errs on the safe side,
introducing false positives and not
false negatives
•
False positives may lead to double-
prompting
•
I
n
s
e
r
t
e
d
p
r
o
m
p
t
s
a
r
e
s
t
i
c
k
y
,
s
o
a
t
m
o
s
t
o
n
e
e
x
t
r
a
r
u
n
t
i
m
e
p
r
o
m
p
t
p
e
r
a
p
p
•
Easy to spot and suppress by app
store maintainers
•
Interesting future research
Conclusions
•
E
x
p
l
o
r
e
d
t
h
e
p
r
o
b
l
e
m
o
f
m
i
s
s
i
n
g
p
r
o
m
p
t
s
t
h
a
t
s
h
o
u
l
d
g
u
a
r
d
s
e
n
s
i
t
i
v
e
r
e
s
o
u
r
c
e
a
c
c
e
s
s
e
s
•
Graph-theoretic algorithm for
placing prompts
•
A
p
p
r
o
a
c
h
t
h
a
t
b
a
l
a
n
c
e
s
e
x
e
c
u
t
i
o
n
s
p
e
e
d
a
n
d
f
e
w
p
r
o
m
p
t
s
i
n
s
e
r
t
e
d
v
i
a
d
o
m
i
n
a
t
o
r
-
b
a
s
e
d
p
l
a
c
e
m
e
n
t
w
i
t
h
a
c
o
m
p
r
e
h
e
n
s
i
v
e
n
a
t
u
r
e
o
f
a
m
o
r
e
e
x
h
a
u
s
t
i
v
e
b
a
c
k
w
a
r
d
a
n
a
l
y
s
i
s
•
Overall, our two-prong
strategy of dominator-based
and backward placement
succeeds in
•
about 95% of all unique cases
•
highly scalable: analysis usually
takes under a second on average
•
Suggests that fully-automatic
prompt placement is viable
32
Explore automatic mediation of privacy-sensitive resource access in smartphone apps. Learn about permissions in mobile apps, different permission flavors, examples in various operating systems, general guidelines for developers, and strategies for guarding location access. Dive into code snippets showcasing location opt-in checks and location services for representative applications.
Download Presentation
Please find below an Image/Link to download the presentation.
The content on the website is provided AS IS for your information and personal use only. It may not be sold, licensed, or shared on other websites without obtaining consent from the author. Download presentation by click this link. If you encounter any issues during the download, it is possible that the publisher has removed the file from their server.
E N D
Presentation Transcript
Automatic Mediation Of Privacy-sensitive Resource Access In Smartphone Applications Ben Livshits and Jaeyeon Jung Ben Livshits and Jaeyeon Jung Microsoft Research Microsoft Research
2 PERMISSIONS IN MOBILE APPS
3 Permissions Flavors Permissions Allow access to GPS location? OK Cancel OK Cancel installation-time permissions runtime permissions
4 Examples of Permissions in Different Mobile Operating Systems installation-time permissions runtime permissions
5 General Guidelines Best Practices for Mobile Application Developers Center for Democracy & Technology
6 Guarding Location Access Focus on 3 representative applications in the Windows Phone store Resource Accesses App APIs used DLLs using location AroundMe 2 TryStart, getPosition AroundMe.dll %z Burger King 5 Start, getPosition BurgerKing.dll, GART.dll LumiaClock 2 Start, getPosition SOMAWP7.dll
7 7 AroundMe public static bool AroundMe.App.CheckOptin() { if (((Option)Enum.Parse(typeof(Option),Config.GetSetting (SettingConstants.UseMyLocation),true)) == Option.Yes return GetCurrentCoordinates(); } if (MessageBox.Show("This app needs ...", "Use location data?", MessageBoxButton.OKCancel == MessageBoxResult.OK) { Config.UpdateSetting(new KeyValuePair<string,string (SettingConstants.UseMyLocation,Option.Yes.ToString return GetCurrentCoordinates(); } ... } check check prompt prompt save save access access
8 8 Burger King public BurgerKing.View.MapPage() { this.InitializeComponent(); base.DataContext = new MapViewModel(); this.BuildApplicationBar(); if (AppSettings.Current.UseLocationService){ this.watcher = new GeoCoordinateWatcher(); } .. } application code protected virtual void GART.Controls.ARDisplay. OnLocationEnabledChanged( DependencyPropertyChangedEventArgs e) { if (this.servicesRunning) { if (this.LocationEnabled) { this.StartLocation(); library code
9 LumiaClock public SomaAd() { ... this._locationUseOK = true; ... if (this._locationUseOK) { this.watcher = new GeoCoordinateWatcher (GeoPositionAccuracy.Default); this.watcher.MovementThreshold = 20.0; this.watcher.StatusChanged += new EventHandler <GeoPositionStatusChangedEventArgs>( this.watcher_StatusChanged); this.watcher.Start(); } } library: just do it!
10 10 Where Does that Leave Us? Properly protecting location access is challenging Location choices are sometimes ignored Third-party libraries such as ad libraries sometimes expose flags for enabling location access but those are frequently ignored by developers Location access is common Some location-related code is in the app A lot of location access in third-party libraries
Contributions Study how existing applications implement resource access prompts on a set of Windows Phone applications
Static analysis Formulate a problem of valid prompt placement valid prompt placement in graph-theoretic terms problem of Propose a static analysis static analysis algorithm algorithm for correct resource access prompt placement placement prompt
13 Evaluation We evaluate our approach to both locating missing prompts and placing them when they are missing on 100 100 apps Overall, our two-prong strategy of dominator-based and backward placement succeeds in about 95% of all unique cases 95% Our analyses run in seconds, making it possible to run them as part of the app submission process
14 ANALYSIS APPROACH
15 15 In This Paper We focus on a completely automatic way to insert missing prompts missing prompts Graph-theoretic approach Represent the application statically as a graph An inter-procedural version of control flow graph (CFG) Reason about prompt placement in graph-theoretic terms insert Our approach is static want to be able to check for missing prompts and insert compensating code even if we cannot hit it at through runtime testing static: we Not information flow A lot of work on finding undesirable information flows We reason about control flow not data flow data flow control flow
16 16 Challenges if(P) l1 = getLocation(); l2 = getLocation(); 1. 1. Avoiding double Avoiding double- -prompts prompts 2. Sticky prompts 3. Avoiding weaker prompts 4. Minimizing prompting flag = true; if(P){ prompt(); flag = true; l1 = getLocation(); } if(!flag){ prompt(); l2 = getLocation(); } if(P){ prompt(); l1 = getLocation(); l2 = getLocation(); }else{ prompt(); l2 = getLocation(); } 5. Avoiding prompts in background tasks 6. Avoiding prompts in libraries
17 17 Challenges 1. Avoiding double-prompts Sticky prompts if (MessageBox.Show( "This app needs to know your location in order to find locations around you, can it use your location data? note: you can change the settings later through the settings menu", "Use location data? ", 1) == 1) { Config.UpdateSetting( new KeyValuePair<string, string>( SettingConstants.UseMyLocation, Option.Yes.ToString())); return GetCurrentCoordinates(); } 2. 2. Sticky prompts 3. Avoiding weaker prompts 4. Minimizing prompting 5. Avoiding prompts in background tasks 6. Avoiding prompts in libraries
18 18 Challenges 1. Avoiding double-prompts 2. Sticky prompts 3. Avoiding weaker prompts 4. Minimizing prompting Avoiding prompts in background tasks background tasks Avoiding prompts in libraries libraries 5. 5. Avoiding prompts in 6. 6. Avoiding prompts in 3rd party.dll
19 Valid Placement
20 20 Intuition for Placement Start with a resource access Move the prompts up until we are outside of background tasks 1. 2. Downside: possible to move these prompts too far (to the beginning of the app in the most extreme case) This would violate the frugal requirement. This gives rise to a notion of a prompt being needed needed at a particular point, for which we use the term anticipating 5 getLocation()
21 21 Dominator-Based Approach 1 5 5 getLocation() Not frugal!
22 22 Backward Placement 2 4 5 getLocation() 5 Slower
23 Analysis Steps 1. For every resource access type and every node n, pre- compute r-anticipated value Ar(n) 2. Merge values by meeting them in the semi-lattice of resource types A(n) = Ar(n) 3. For every
24 EVALUATION
25 Input Statistics apps analyzed app size 100 7.3MB processed methods 352,816 3.5K on average background/library methods 26,033 7% library methods 25,898 7% nodes 1,333,056 anticipating 171,253 12% accesses 227 2 per app 1/3rd accesses in background/library methods 78
26 26 Benchmarks Took 100 WP 7 apps To make this meaningful, chose apps with LOCATION and NETWORKING NETWORKING caps LOCATION An average app is 7.3 MB of code Uses third-party ad libraries
27 27 Prompt Placement Success Total Unique Failed 5% Failed 9% Succeeded 91% Succeeded 95%
28 28 Dominator-Based vs. Backward When dominator-based placement succeeds, it is usually immediate Backward placement is helpful for cases where dominator-based placement fails Dominator 3% Backward 27% Na ve 70% However, some of these cases are still too hard, leading to 7 unique failures
29 Timing 100000 18,152 15,103 10000 1,779 1,366 942 1000 158 123 100 10 1 0.1 0 0.01 app loading backward, per access placement graph dominator-based, per anticipating computation prompt insertion, per app call graph construction finding missing prompts construction access
30 30 Manual Examination Picked 10 apps with 27 resource accesses False negatives False negatives: resource access we think is protected whereas in fact at runtime it has no preceding prompts Manually exercised as much functionality as possible Out of 27 accesses our analysis reports 10 unprotected unprotected 10 as Verification includes running these apps in an emulator to collect network packets network packets and API calls API calls No false negatives observed: No false negatives observed: analysis correctly identifies them as unprotected and finds proper prompt placements placements identifies
31 31 False Positives False positives: False positives: analysis classifies a resource access as unprotected whereas it is properly protected at runtime Our analysis errs on the safe side, introducing false positives and not false negatives False positives may lead to double- prompting Inserted prompts are sticky, so at most one most one extra runtime prompt per app Easy to spot and suppress by app store maintainers 11 out of 21 accesses found as unprotected turn out to be false positives at Reasons include: Not recognizing sticky prompts Custom consent dialogs Async calls and XAML Interesting future research
32 32 Conclusions Explored the problem of missing prompts prompts that should guard sensitive resource accesses sensitive resource accesses Overall, our two-prong strategy of dominator-based and backward placement succeeds in about 95% of all unique cases highly scalable: analysis usually takes under a second on average missing Graph-theoretic algorithm for placing prompts Approach that balances execution speed execution speed and few prompts inserted via dominator- based placement with a comprehensive nature comprehensive nature of a more exhaustive exhaustive backward analysis Suggests that fully-automatic prompt placement is viable
