Detecting capability leaks in Android-based smartphones

摘要: Recent years have witnessed increased popularity and adoption of smartphones partially due to the functionalities convenience offered their users (e.g., ability run third-party applications). To manage amount access given smartphone applications, Android provides a permission-based security model, which requires each application explicitly request permissions before it can be installed run. In this paper, we systematically analyze eight flagship from leading manufacturers, including HTC, Motorola, Samsung found out that stock phone images do not properly enforce permission model. Several privileged protect sensitive user data dangerous features on phones are unsafely exposed other applications need them for actual use, violation termed capability leak in paper. facilitate identifying these leaks, take static analysis approach accordingly developed system called Woodpecker. Our results with show among 13 examined so far, 11 were leaked, individual leaking up permissions. By exploiting leaked capabilities, an untrusted wipe data, send SMS messages premium numbers), record conversation, or obtain geo-locations affected – all without asking any permission.