TaintART: A Practical Multi-level Information-Flow Tracking System for Android RunTime Sadiq Basha

Paper Information TaintART: A Practical Multi-level Information-Flow Tracking System for Android RunTime CCS '16 Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security Authors: Mingshen Sun The Chinese University of Hong Kong, Hong Kong, Hong Kong Tao Wei Baidu, Inc., Beijing, China John C.S. Lui The Chinese University of Hong Kong, Hong Kong, Hong Kong

Motivation Android Malware Stats In 2016, Kaspersky Lab detected the following: 8,526,221 malicious installation packages 128,886 mobile banking Trojans 261,214 mobile ransomware Trojans https://www.av-test.org/en/statistics/malware/

Motivation Historical privacy violation problem with android software Problem exacerbated by smartphones Almost ubiquitously store private information Monetization pressures to detriment of user privacy Current privacy control methods arguably inadequate Idea: Can’t change the current system without repercussions Instead, create a method to audit untrusted applications Execution: Must be able to detect potential misuses of private information, and be fast enough to be usable

Dynamic taint analysis Technique that tracks information dependencies from an origin Labels i.e. taint is given to sensitive data from certain sources handle label transitions (taint propagation) between variables, files, and procedures at runtime a tainted label transmit out of the device through some functions (sinks) data leakage A Applications Detect & Prevent attacks information policy enforcement testing in software engineering data lifetime and scope analysis B D C

TaintART Dynamic information-flow tracking system, targeting latest ART (Android Run-Time) TaintDroid was designed for the legacy Dalvik environment Multi-level taints labelling to identify the sensitive levels Uses processor registers for taint storage Requires just registers accesses to achieve faster taint propagation vs. TaintDroid

System Design

Dalvik vs ART Dalvik environment source code -> dex bytecode -> optimized dex bytecode -> run ART environment source code -> dex bytecode -> compiled native code -> run

TaintART Architecture Compiler at the installation stage Runtime in the runtime stage https://mssun.me/research/ccs16taintart.html

Floating point registers Taint Tag Storage TaintART prototype is built on Google Nexus 5 R5 register is reserved for taint storage Nexus 5 contains a vector floating-point coprocessor, So from S0 to S15 is for floating point registers S15 ….. S4 S3 S2 S1 S0 R15 R4 R3 R2 R1 R0 R5 1 Floating point registers Regular registers

Taint Propagation Logic Clear destination bit Masking tainted bit Shifting bits Merging tainted bits

Content Resolver File Camera Media Recorder Implementation &Case study Taint sources and privacy leakage levels Levels Leaked Data Classes / Service No Leakage N/A 1 Device Identity Telephony Manager 2 Sensor Data Sensor Manager Location Data Location Manager 3 Sensitive Content Content Resolver File Camera Media Recorder analysis popular apps at runtime tracking data flows Taobao leaks device identity, sensor data and location data at runtime whereas for Amazon shopping there is no leakage

Evaluation Macro benchmarks Application Launch Time: 6% i.e. 22.1ms overhead Application Installation Time: 12.2% i.e. 205.8ms overhead Contacts Read/Write: 20%/12%

Evaluation Micro Benchmarks Compiler 80 built-in apps in AOSP resulted to 19.9% overhead i.e. ~67ms Overhead of 0.8% instruction for memory access Overall 21% overhead, mainly in data processing instructions AOSP - Android Open Source Project Because Android uses ahead-of-time compilation strategy, an app is only compiled once at the installation time. Therefore, the overhead on compilation time is acceptable for analysis usage Comparison of Compilation Time Comparison of Instructions

Concluding Remarks MERITS TaintART produced useful results for every application tested A useful privacy analysis tool was implemented Produced no false positives in experiments conducted High performance in design DEMERITS As per the analysis Can be circumvented by implicit information flow Cannot identify if tainted information re-enters the phone after leaving IMPROVEMENTS Interactive application latency was reported anecdotally, but could have been measured more formally

Thank You