Systematic Detection of Capability Leaks in Stock Android Smartphones

By Michael C. Grace, Yajin Zhou, Zhi Wang, Xuxian Jiang. Network and Distributed System Security Symposium, 2012

493 citations recorded by the source corpus.

View Paper: https://www.semanticscholar.org/paper/a4e956265abb25f9db47daaab079380fa69c00f1

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

Citations in the corpus

Vetting undesirable behaviors in android apps with permission use analysis (2013, background): “Thus our current implementation could not catch those behaviors that do not cause permission checks [35].”
DroidMat: Android Malware Detection through Manifest and API Calls Tracing (2012, background): “[21] try to detect capability leaks in stock Android smartphones.”
Static analysis of android apps: A systematic literature review (2017, methodology): “DPartner [136] 3 Woodpecker [137] 3 DroidAlarm [138] 3 3 Zuo et al.”
Dissecting Android Malware: Characterization and Evolution (2012, background): “Comdroid [36] [37] and Woodpecker [38] expose the confused deputy problem [39] on Android.”
RiskRanker: scalable and accurate zero-day android malware detection (2012, unknown): “RiskRanker at present does not check forconfused-deputy attacksthat targettheIPClayer, but its design was informed by our experiences developing the Woodpecker system.”
Evaluating Analysis Tools for Android Apps: Status Quo and Robustness Against Obfuscation (2016, background): “Woodpecker [21] aims at detecting ICC vulnerabilities in the bytecode of the pre-installed apps on an Android system.”
Detecting repackaged smartphone applications in third-party android marketplaces (2012, background): “Woodpecker [19] statically analyzes pre-loaded apps in smartphone firmware to uncover possible capability leaks.”
Hey, You, Get Off of My Market: Detecting Malicious Apps in Official and Alternative Android Markets (2012, background): “Woodpecker [41] similarly exposes capability leaks on stock Android phones by analyzing preloaded apps in the phone firmware.”
Effective inter-component communication mapping in Android with Epicc: an essential step towards holistic security analysis (2013, background): “These vulnerabilities can lead to permission leakage [17, 19, 25].”
Amandroid: A Precise and General Inter-component Data Flow Analysis Framework for Security Vetting of Android Apps (2014, background): “There has been a large body of work reporting Android app security issues [36, 37], some of which use static analysis techniques [11, 14, 18, 19].”
CHEX: statically vetting Android apps for component hijacking vulnerabilities (2012, background): “As demonstrated by [11, 20, 21, 27], an unprivileged malicious app can access permission-protected resources through privileged agents (or app components) that do not properly enforce permission checks.”
Execute This! Analyzing Unsafe and Malicious Dynamic Code Loading in Android Applications (2014, background): “, permissions that are requested by system applications, but not properly protected against unauthorized use by third-party applications [17].”
Collaborative Security (2015, background): “These are examples of explicit privacy, which is mentioned by many in the literature [Barkan et al. 2003; Schmidt et al. 2009; Enck et al. 2010; Reed et al. 2010; Schlegel et al. 2011; Arapinis et al. 2012; Grace et al. 2012].”