Apex: extending Android permission model and enforcement with user-defined runtime constraints

By M. Nauman, Sohail Khan, Xinwen Zhang. ACM Asia Conference on Computer and Communications Security, 2010

667 citations recorded by the source corpus.

Subfields: Artificial Intelligence, Information Systems, Signal Processing

View Paper: https://www.semanticscholar.org/paper/4d5b0fe49e7fa08b252af70e890a58b49353fc17

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Information Systems

In Signal Processing

Citations in the corpus

Uranine: Real-time Privacy Leakage Monitoring without System Modification for Android (2015, background): “A number of works additionally prevent access of private information or supply fake data to apps [5, 40, 23].”
Towards Taming Privilege-Escalation Attacks on Android (2012, background): “However, not all of them target privilege escalation attacks: Porscha [32] provides policy-oriented secure content handling; Apex [30] allows users to selectively grant and deny permissions at install time; CRePE [11] enables the enforcement of contextrelated policies; Paranoid Android (PA) [34] aim”
Expectation and purpose: understanding users' mental models of mobile app privacy through crowdsourcing (2012, background): “For example, Facebook and Path, were found uploading users’ contact lists to their servers, which greatly surprised their users and made them feel very uncomfortable [21, 34].”
Hey, You, Get Off of My Market: Detecting Malicious Apps in Official and Alternative Android Markets (2012, background): “Apex [47], MockDroid [28], TISSA [54] and AppFence [42] revise the current Android framework or runtime to better provide fine-grained controls of resources accessed by third-party untrusted apps.”
Dissecting Android Malware: Characterization and Evolution (2012, background): “Specifically, Apex [46], MockDroid [47], TISSA [48] and AppFence [49] extend the current Android framework to provide find-grained controls of system resources accessed by untrusted third-party apps.”
Privilege Escalation Attacks on Android (2010, neutral): “In [19] Nauman et al.”
Systematic Detection of Capability Leaks in Stock Android Smartphones (2012, methodology): “Apex [28] modifies the permission framework to allow for selectively granting permissions and revoking permissions at runtime.”
An empirical study of cryptographic misuse in android applications (2013, background): “Furthermore, the Android permission system has been at the core of many scientific publications [14, 16, 24].”
Vetting undesirable behaviors in android apps with permission use analysis (2013, methodology): “Apex [45] and Saint [46] were two extensions to the Android’s permission system by introducing runtime constraints on the granted permissions.”
Modeling Users' Mobile App Privacy Preferences: Restoring Usability in a Sea of Permission Settings (2014, background): “Apex proposed by Nauman et al. [34] provides fine-grained control over resource usage based on context and runtime constraints.”
RiskRanker: scalable and accurate zero-day android malware detection (2012, background): “A raft of follow-up work then sought to address theseinformation leaksby alteringtheframeworksinvolved: Apex [48],MockDroid [32],TISSA[57]andAppFence [46] all o.er extensions to the Android framework to provide .nergrained control over an app s access to potentially sensitive resources.”
PScout: analyzing the Android permission specification (2012, background): “Saint [29], Apex [27] and Aurasium [35] are three systems proposed to provide runtime policy enforcement to complement existing permission systems.”
Android Security: A Survey of Issues, Malware Penetration, and Defenses (2015, background): “In addition, it locks the device and demands ransom to unlock the device.”
Following Devil's Footprints: Cross-Platform Analysis of Potentially Harmful Libraries on Android and iOS (2016, background): “…PHAs, most of which aims at detecting the code [37], [38], [39], [40], [41], [42], [43], [44], [45] for performing potentially harmful behaviors (e.g., stealing the user’s sensitive information), and protecting the Android system from various attacks [46], [47], [48], [49], [50], [51], [52], [53].”
Taming Information-Stealing Smartphone Applications (on Android) (2011, methodology): “As with our research, Apex [14] utilizes the Android permission model to constrain runtime app behavior.”
ContexloT: Towards Providing Contextual Integrity to Appified IoT Platforms (2017, background): “The security of IoT platforms are not hypothetical concerns as a number of real attacks have already been reported.”