1. TaintART: A Practical Multi-level Information-Flow Tracking System for Android RunTime
Sadiq Basha

2. Paper Information
TaintART: A Practical Multi-level Information-Flow Tracking System for Android RunTime
CCS '16 Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security
Authors:
Mingshen Sun The Chinese University of Hong Kong, Hong Kong, Hong Kong
Tao Wei Baidu, Inc., Beijing, China
John C.S. Lui The Chinese University of Hong Kong, Hong Kong, Hong Kong

3. Motivation Android Malware Stats
In 2016, Kaspersky Lab detected the following:
8,526,221 malicious installation packages
128,886 mobile banking Trojans
261,214 mobile ransomware Trojans

4. Motivation Historical privacy violation problem with android software
Problem exacerbated by smartphones
Almost ubiquitously store private information
Monetization pressures to detriment of user privacy
Current privacy control methods arguably inadequate
Idea:
Can’t change the current system without repercussions
Instead, create a method to audit untrusted applications
Execution:
Must be able to detect potential misuses of private information, and
be fast enough to be usable

5. Dynamic taint analysis
Technique that tracks information dependencies from an origin
Labels i.e. taint is given to sensitive data from certain sources
handle label transitions (taint propagation) between variables, files, and procedures at runtime
a tainted label transmit out of the device through some functions (sinks)
data leakage A
Applications
Detect & Prevent attacks
information policy enforcement
testing in software engineering
data lifetime and scope analysis B D C

6. TaintART
Dynamic information-flow tracking system, targeting latest ART (Android Run-Time)
TaintDroid was designed for the legacy Dalvik environment
Multi-level taints labelling to identify the sensitive levels
Uses processor registers for taint storage
Requires just registers accesses to achieve faster taint propagation vs. TaintDroid

7. System Design

8. Dalvik vs ART Dalvik environment
source code -> dex bytecode -> optimized dex bytecode -> run
ART environment
source code -> dex bytecode -> compiled native code -> run

9. TaintART Architecture
Compiler at the installation stage
Runtime in the runtime stage

10. Floating point registers
Taint Tag Storage
TaintART prototype is built on Google Nexus 5
R5 register is reserved for taint storage
Nexus 5 contains a vector floating-point coprocessor, So from S0 to S15 is for floating point registers
S15
….. S4 S3 S2 S1 S0
R15 R4 R3 R2 R1 R0 R5 1
Floating point registers
Regular registers

11. Taint Propagation Logic
Clear destination bit
Masking tainted bit
Shifting bits
Merging tainted bits

12. Content Resolver File Camera Media Recorder
Implementation &Case study
Taint sources and privacy leakage levels
Levels
Leaked Data
Classes / Service
No Leakage
N/A 1
Device Identity
Telephony Manager 2
Sensor Data
Sensor Manager
Location Data
Location Manager 3
Sensitive Content
Content Resolver File Camera Media Recorder
analysis popular apps at runtime
tracking data flows
Taobao leaks device identity, sensor data and location data at runtime whereas for Amazon shopping there is no leakage

13. Evaluation Macro benchmarks
Application Launch Time: 6% i.e. 22.1ms overhead
Application Installation Time: 12.2% i.e ms overhead
Contacts Read/Write: 20%/12%

14. Evaluation Micro Benchmarks Compiler
80 built-in apps in AOSP resulted to 19.9% overhead i.e. ~67ms
Overhead of 0.8% instruction for memory access
Overall 21% overhead, mainly in data processing instructions
AOSP - Android Open Source Project
Because Android uses ahead-of-time compilation strategy, an app is only compiled once at the installation time. Therefore, the overhead on compilation time is acceptable for analysis usage
Comparison of Compilation Time
Comparison of Instructions

15. Concluding Remarks MERITS
TaintART produced useful results for every application tested
A useful privacy analysis tool was implemented
Produced no false positives in experiments conducted
High performance in design
DEMERITS
As per the analysis
Can be circumvented by implicit information flow
Cannot identify if tainted information re-enters the phone after leaving
IMPROVEMENTS
Interactive application latency was reported anecdotally, but could have been measured more formally

16. Thank You