scholarly journals Panoptispy: Characterizing Audio and Video Exfiltration from Android Applications

2018 ◽  
Vol 2018 (4) ◽  
pp. 33-50 ◽  
Author(s):  
Elleen Pan ◽  
Jingjing Ren ◽  
Martina Lindorfer ◽  
Christo Wilson ◽  
David Choffnes

Abstract The high-fidelity sensors and ubiquitous internet connectivity offered by mobile devices have facilitated an explosion in mobile apps that rely on multimedia features. However, these sensors can also be used in ways that may violate user’s expectations and personal privacy. For example, apps have been caught taking pictures without the user’s knowledge and passively listened for inaudible, ultrasonic audio beacons. The developers of mobile device operating systems recognize that sensor data is sensitive, but unfortunately existing permission models only mitigate some of the privacy concerns surrounding multimedia data. In this work, we present the first large-scale empirical study of media permissions and leaks from Android apps, covering 17,260 apps from Google Play, AppChina, Mi.com, and Anzhi. We study the behavior of these apps using a combination of static and dynamic analysis techniques. Our study reveals several alarming privacy risks in the Android app ecosystem, including apps that over-provision their media permissions and apps that share image and video data with other parties in unexpected ways, without user knowledge or consent. We also identify a previously unreported privacy risk that arises from third-party libraries that record and upload screenshots and videos of the screen without informing the user and without requiring any permissions.

2020 ◽  
Vol 2020 (3) ◽  
pp. 222-242 ◽  
Author(s):  
Catherine Han ◽  
Irwin Reyes ◽  
Álvaro Feal ◽  
Joel Reardon ◽  
Primal Wijesekera ◽  
...  

AbstractIt is commonly assumed that “free” mobile apps come at the cost of consumer privacy and that paying for apps could offer consumers protection from behavioral advertising and long-term tracking. This work empirically evaluates the validity of this assumption by comparing the privacy practices of free apps and their paid premium versions, while also gauging consumer expectations surrounding free and paid apps. We use both static and dynamic analysis to examine 5,877 pairs of free Android apps and their paid counterparts for differences in data collection practices and privacy policies between pairs. To understand user expectations for paid apps, we conducted a 998-participant online survey and found that consumers expect paid apps to have better security and privacy behaviors. However, there is no clear evidence that paying for an app will actually guarantee protection from extensive data collection in practice. Given that the free version had at least one thirdparty library or dangerous permission, respectively, we discovered that 45% of the paid versions reused all of the same third-party libraries as their free versions, and 74% of the paid versions had all of the dangerous permissions held by the free app. Likewise, our dynamic analysis revealed that 32% of the paid apps exhibit all of the same data collection and transmission behaviors as their free counterparts. Finally, we found that 40% of apps did not have a privacy policy link in the Google Play Store and that only 3.7% of the pairs that did reflected differences between the free and paid versions.


10.2196/14267 ◽  
2020 ◽  
Vol 7 (7) ◽  
pp. e14267
Author(s):  
Henning Daus ◽  
Timon Bloecher ◽  
Ronny Egeler ◽  
Richard De Klerk ◽  
Wilhelm Stork ◽  
...  

Internet- and mobile-based approaches have become increasingly significant to psychological research in the field of bipolar disorders. While research suggests that emotional aspects of bipolar disorders are substantially related to the social and global functioning or the suicidality of patients, these aspects have so far not sufficiently been considered within the context of mobile-based disease management approaches. As a multiprofessional research team, we have developed a new and emotion-sensitive assistance system, which we have adapted to the needs of patients with bipolar disorder. Next to the analysis of self-assessments, third-party assessments, and sensor data, the new assistance system analyzes audio and video data of these patients regarding their emotional content or the presence of emotional cues. In this viewpoint, we describe the theoretical and technological basis of our emotion-sensitive approach and do not present empirical data or a proof of concept. To our knowledge, the new assistance system incorporates the first mobile-based approach to analyze emotional expressions of patients with bipolar disorder. As a next step, the validity and feasibility of our emotion-sensitive approach must be evaluated. In the future, it might benefit diagnostic, prognostic, or even therapeutic purposes and complement existing systems with the help of new and intuitive interaction models.


2021 ◽  
Vol 2021 ◽  
pp. 1-19
Author(s):  
Ming Di ◽  
Shah Nazir ◽  
Fucheng Deng

The wide-ranging implementation of Android applications used in various devices, from smartphones to intelligent television, has made it thought-provoking for developers. The permission granting mechanism is one of the defects imposed by the developers. Such assessing of defects does not allow the user to comprehend the implication of privacy for granting permission. Mobile applications are speedily easily reachable to typical users of mobile. Despite possible applications for improving the affordability, availability, and effectiveness of delivering various services, it handles sensitive data and information. Such data and information carry considerable security and privacy risks. Users are usually unaware of how the data can be managed and used. Reusable resources are available in the form of third-party libraries, which are broadly active in android apps. It provides a diversity of functions that deliver privacy and security concerns. Host applications and third-party libraries are run in the same process and share similar permissions. The current study has presented an overview of the existing approaches, methods, and tools used for influencing user behavior concerning android privacy policy. Various prominent libraries were searched, and their search results were analyzed briefly. The search results were presented in diverse perspectives for showing the details of the work done in the area. This will help researchers to offer new solutions in the area of the research.


2018 ◽  
Vol 2018 ◽  
pp. 1-12 ◽  
Author(s):  
Jaewoo Shim ◽  
Kyeonghwan Lim ◽  
Seong-je Cho ◽  
Sangchul Han ◽  
Minkyu Park

Unity is the most popular cross-platform development framework to develop games for multiple platforms such as Android, iOS, and Windows Mobile. While Unity developers can easily develop mobile apps for multiple platforms, adversaries can also easily build malicious apps based on the “write once, run anywhere” (WORA) feature. Even though malicious apps were discovered among Android apps written with Unity framework (Unity apps), little research has been done on analysing the malicious apps. We propose static and dynamic reverse engineering techniques for malicious Unity apps. We first inspect the executable file format of a Unity app and present an effective static analysis technique of the Unity app. Then, we also propose a systematic technique to analyse dynamically the Unity app. Using the proposed techniques, the malware analyst can statically and dynamically analyse Java code, native code in C or C ++, and the Mono runtime layer where the C# code is running.


2021 ◽  
Author(s):  
Ning Zhang

This dissertation focuses on the analysis of large-scale image and video data consortia with applications to multimedia indexing and retrieval. Bag-of-words (BoW) model is adopted and improved to suit the efficiency and effectiveness requirements in analyzing large-scale multimedia data. BoW method has been developed from the text retrieval domain and successfully applied in computer vision, such as image scene and object categorization. Specifically, we utilized the BoW model in the domain of image classification and retrieval, tackled challenges of large-scale multimedia applications of video analysis and mobile-based social activity recommendation using visual intents, respectively. Incorporating the BoW model with unsupervised classification, we propose a scalable and generic approach in video analysis. The method aims at systematically analyzing unlabeled video from its genre identification, frame classification, and event detection. Unlike conventional domain-knowledge dependent approaches, the BoW model is domain-knowledge independent. Moreover, the system is mainly unsupervised and requires minimum human input. Therefore, our method is capable of processing massive quantity of videos generically. In addition, for the evaluation, sports video has been used as the testing ground. Combining the BoW model with advanced retrieval algorithms, we propose a mobilebased visual search and social activity recommendation system. The merit of the BoW model in large-scale image retrieval is integrated with the flexible user interface provided by the mobile platform. Instead of text or voice input, the system takes visual images captured from the built-in camera and attempts to understand users’ intents through interactions. Subsequently, such intents are recognized through a retrieval mechanism using the BoW model. Finally, visual results are mapped onto contextually relevant information and entities (i.e. local business) for social task suggestions. Hence, the system offers users the ability to search information and make decisions on-the-go.


Author(s):  
Ashish Bijlani ◽  
Umakishore Ramachandran ◽  
Roy Campbell

This work presents the first-ever detailed and large-scale measurement analysis of storage consumption behavior of applications (apps) on smart mobile devices. We start by carrying out a five-year longitudinal static analysis of millions of Android apps to study the increase in their sizes over time and identify various sources of app storage consumption. Our study reveals that mobile apps have evolved as large monolithic packages that are packed with features to monetize/engage users and optimized for performance at the cost of redundant storage consumption. We also carry out a mobile storage usage study with 140 Android participants. We built and deployed a lightweight context-aware storage tracing tool, called cosmos, on each participant's device. Leveraging the traces from our user study, we show that only a small fraction of apps/features are actively used and usage is correlated to user context. Our findings suggest a high degree of app feature bloat and unused functionality, which leads to inefficient use of storage. Furthermore, we found that apps are not constrained by storage quota limits, and developers freely abuse persistent storage by frequently caching data, creating debug logs, user analytics, and downloading advertisements as needed. Finally, drawing upon our findings, we discuss the need for efficient mobile storage management, and propose an elastic storage design to reclaim storage space when unused. We further identify research challenges and quantify expected storage savings from such a design. We believe our findings will be valuable to the storage research community as well as mobile app developers.


2021 ◽  
Author(s):  
Ning Zhang

This dissertation focuses on the analysis of large-scale image and video data consortia with applications to multimedia indexing and retrieval. Bag-of-words (BoW) model is adopted and improved to suit the efficiency and effectiveness requirements in analyzing large-scale multimedia data. BoW method has been developed from the text retrieval domain and successfully applied in computer vision, such as image scene and object categorization. Specifically, we utilized the BoW model in the domain of image classification and retrieval, tackled challenges of large-scale multimedia applications of video analysis and mobile-based social activity recommendation using visual intents, respectively. Incorporating the BoW model with unsupervised classification, we propose a scalable and generic approach in video analysis. The method aims at systematically analyzing unlabeled video from its genre identification, frame classification, and event detection. Unlike conventional domain-knowledge dependent approaches, the BoW model is domain-knowledge independent. Moreover, the system is mainly unsupervised and requires minimum human input. Therefore, our method is capable of processing massive quantity of videos generically. In addition, for the evaluation, sports video has been used as the testing ground. Combining the BoW model with advanced retrieval algorithms, we propose a mobilebased visual search and social activity recommendation system. The merit of the BoW model in large-scale image retrieval is integrated with the flexible user interface provided by the mobile platform. Instead of text or voice input, the system takes visual images captured from the built-in camera and attempts to understand users’ intents through interactions. Subsequently, such intents are recognized through a retrieval mechanism using the BoW model. Finally, visual results are mapped onto contextually relevant information and entities (i.e. local business) for social task suggestions. Hence, the system offers users the ability to search information and make decisions on-the-go.


Author(s):  
Sarah Davidson ◽  
Gil Bohrer ◽  
Andrea Kölzsch ◽  
Candace Vinciguerra ◽  
Roland Kays

Movebank, a global platform for animal tracking and other animal-borne sensor data, is used by over 3,000 researchers globally to harmonize, archive and share nearly 3 billion animal occurrence records and more than 3 billion other animal-borne sensor measurements that document the movements and behavior of over 1,000 species. Movebank’s publicly described data model (Kranstauber et al. 2011), vocabulary and application programming interfaces (APIs) provide services for users to automate data import and retrieval. Near-live data feeds are maintained in cooperation with over 20 manufacturers of animal-borne sensors, who provide data in agreed-upon formats for accurate data import. Data acquisition by API complies with public or controlled-access sharing settings, defined within the database by data owners. The Environmental Data Automated Track Annotation System (EnvDATA, Dodge et al. 2013) allows users to link animal tracking data with hundreds of environmental parameters from remote sensing and weather reanalysis products through the Movebank website, and offers an API for advanced users to automate the submission of annotation requests. Movebank's mobile apps, the Animal Tracker and Animal Tagger, use APIs to support reporting and monitoring while in the field, as well as communication with citizen scientists. The recently-launched MoveApps platform connects with Movebank data using an API to allow users to build, execute and share repeatable workflows for data exploration and analysis through a user-friendly interface. A new API, currently under development, will allow calls to retrieve data from Movebank reduced according to criteria defined by "reduction profiles", which can greatly reduce the volume of data transferred for many use cases. In addition to making this core set of Movebank services possible, Movebank's APIs enable the development of external applications, including the widely used R programming packages 'move' (Kranstauber et al. 2012) and 'ctmm' (Calabrese et al. 2016), and user-specific workflows to efficiently execute collaborative analyses and automate tasks such as syncing with local organizational and governmental websites and archives. The APIs also support large-scale data acquisition, including for projects under development to visualize, map and analyze bird migrations led by the British Trust for Ornithology, the coordinating organisation for European bird ringing (banding) schemes (EURING), Georgetown University, National Audubon Society, Smithsonian Institution and United Nations Convention on Migratory Species. Our API development is constrained by a lack of standardization in data reporting across animal-borne sensors and a need to ensure adequate communication with data users (e.g., how to properly interpret data; expectations for use and attribution) and data owners (e.g., who is using publicly-available data and how) when allowing automated data access. As interest in data linking, harvesting, mirroring and integration grows, we recognize needs to coordinate API development across animal tracking and biodiversity databases, and to develop a shared system for unique organism identifiers. Such a system would allow linking of information about individual animals within and across repositories and publications in order to recognize data for the same individuals across platforms, retain provenance and attribution information, and ensure beneficial and biologically meaningful data use.


2018 ◽  
Vol 2018 ◽  
pp. 1-17 ◽  
Author(s):  
Hyunwoo Choi ◽  
Yongdae Kim

It is pretty well known that insecure code updating procedures for Android allow remote code injection attack. However, other than codes, there are many resources in Android that have to be updated, such as temporary files, images, databases, and configurations (XML and JSON). Security of update procedures for these resources is largely unknown. This paper investigates general conditions for remote code injection attacks on these resources. Using this, we design and implement a static detection tool that automatically identifies apps that meet these conditions. We apply the detection tool to a large dataset comprising 9,054 apps, from three different types of datasets: official market, third-party market, and preinstalled apps. As a result, 97 apps were found to be potentially vulnerable, with 53 confirmed as vulnerable to remote code injection attacks.


2019 ◽  
Author(s):  
Henning Daus ◽  
Timon Bloecher ◽  
Ronny Egeler ◽  
Richard De Klerk ◽  
Wilhelm Stork ◽  
...  

UNSTRUCTURED Internet- and mobile-based approaches have become increasingly significant to psychological research in the field of bipolar disorders. While research suggests that emotional aspects of bipolar disorders are substantially related to the social and global functioning or the suicidality of patients, these aspects have so far not sufficiently been considered within the context of mobile-based disease management approaches. As a multiprofessional research team, we have developed a new and emotion-sensitive assistance system, which we have adapted to the needs of patients with bipolar disorder. Next to the analysis of self-assessments, third-party assessments, and sensor data, the new assistance system analyzes audio and video data of these patients regarding their emotional content or the presence of emotional cues. In this viewpoint, we describe the theoretical and technological basis of our emotion-sensitive approach and do not present empirical data or a proof of concept. To our knowledge, the new assistance system incorporates the first mobile-based approach to analyze emotional expressions of patients with bipolar disorder. As a next step, the validity and feasibility of our emotion-sensitive approach must be evaluated. In the future, it might benefit diagnostic, prognostic, or even therapeutic purposes and complement existing systems with the help of new and intuitive interaction models.


Sign in / Sign up

Export Citation Format

Share Document