Privacy oracle: a system for finding application leaks with black box differential testing

By Jaeyeon Jung, Anmol Sheth, Ben Greenstein, David Wetherall, Gabriel Y. Maganis, Tadayoshi Kohno. 2008

111 citations recorded by the source corpus.

Subfields: Artificial Intelligence, Computer Networks and Communications, Signal Processing

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Computer Networks and Communications

In Signal Processing

Citations in the corpus

DeepXplore: Automated Whitebox Testing of Deep Learning Systems (2017, methodology): “Differential testing has been widely used for successfully testing various types of traditional software including JVMs [14], C compilers [45, 86], SSL/TLS certification validation logic [11, 15, 56, 67], PDF viewers [56], space flight software [28], mobile applications [36], and Web application fir”
SFADiff: Automated Evasion Attacks and Fingerprinting Using Black-box Differential Automata Learning (2016, methodology): “Di↵erential testing has been used successfully for testing a diverse set of systems including C compilers [32], Java virtual machine implementations [11], SSL/TLS implementations [8], mobile applications for privacy leaks [20], PDF malware detectors [31], and space flight software [18].”
The Art, Science, and Engineering of Fuzzing: A Survey (2018, methodology): “[118] introduced black-box differential fuzz testing , which uses differential testing of multiple inputs on a single program to map mutations from the PUT’s input to its output.”
Property Testing For Differential Privacy (2018, background): “This work focuses on blatant privacy leaks, such as a smart phone application surreptitiously leaking a user’s email (Jung et al., 2008, Enck et al., 2010, Fan et al., 2012).”
Systematic Detection of Capability Leaks in Stock Android Smartphones (2012, methodology): “Privacy Oracle [26] applies a differential testing technique to detect the correlation or likely leaks between input perturbations and output perturbations of the application.”
Obfuscation-Resilient Privacy Leak Detection for Mobile Apps Through Differential Analysis (2017, methodology): “While Privacy Oracle was mainly concerned with deterministic executions to eliminate OS artifacts that vary between executions and could interfere with the analysis, we observed that nondeterministic network traffic poses a far greater challenge when analyzing modern apps.”
AppsPlayground: automatic security analysis of smartphone applications (2013, background): “Privacy Oracle [13] however uses capture-playback to its advantage for multiple runs along same paths on application GUI but with slightly perturbed inputs.”
A Study of Android Application Security (2011, methodology): “Privacy Oracle [24] uses differential black box fuzz testing to find privacy leaks in applications.”