Dangerous Permissions Research Articles

RetrieveDroid: k-NN Performance Evaluation of Distance Measurement Schemes for Android Malware Detection Using Case-Based Retrieval

One of the big challenges in cybersecurity is the detection of Android attacks since Android is the most popular mobile operating system. Within this system, applications require certain permissions to access critical resources. Investigation of the use of permissions is a concern to check whether an application is not mislead to divulge sensitive information. This work aims to determine whose distance schemes offers the best malware detection based on permission similarities. Case based reasoning (CBR) is a concept which aims to find a solution based on historical experiences. CBR performance relies on finding similarities between actual cases and stored cases and then to deduce solutions. This paper proposes to transform app data as vector of appearance of dangerous permissions and to store such vectors based on CBR structure. Then we investigate k-NN classification performance related to five distance-based metrics such as Euclidean, Cosine, Manhattan, Minkowski, and Mahalanobis. Experiments were carried out with a set of 419 applications, including 203 malicious and 216 benign samples. The whole dataset has been split in training set of 291 samples with 162 benign and 129 malicious, and the testing set of 128 samples with 54 benign and 74 malicious samples. k-Nearest Neighbor (k-NN) are used as the similarity algorithm in which the distance model is varied in each of the five distance models. Results reveal that Minkowski and Manhattan models provide the best overall performance to detect Android malware based on permissions, in terms of accuracy (99.21%) and precision (97%). This work is a good start to recommend to researchers distance metrics exploitable when performing permission similarity-based detection.

Android Apps Vulnerability Detection with Static and Dynamic Analysis Approach using MOBSF

Ensuring the security of Android applications is paramount, especially for apps like Mobile JKN, launched by the Social Security Agency on Health “BPJS Kesehatan” under the Ministry of Health Republic Indonesia, which contain sensitive participant data. Such information is often targeted by cybercriminals seeking personal gain through data theft by exploiting security vulnerabilities within the application. To address these risks, a thorough analysis was conducted to detect security loopholes in the Mobile JKN application. The study used the Mobile Security Framework (MOBSF) tools and involved static and dynamic analyses. Despite the application’s implementation of secure SSL Pinning and detection of rooted devices, the static analysis revealed potential security loopholes, including dangerous permission access, weak cryptographic methods, and vulnerable hardcoded secrets. Moreover, the application was found vulnerable to Janus, SQL Injection, and padding oracle attacks. While the dynamic analysis showed satisfactory implementation of SSL Pinning and no performance degradation, it also revealed that root detection was lacking, and debugger connections were not detected while the application was running. These findings emphasize the critical need for immediate security enhancements in the Mobile JKN application.

Measuring the Security of Indonesian Local Goverment Mobile Apps

Mobile apps are critical in supporting the Indonesian provincial government during daily operations. Regarding their important role, these apps are the potential to become a target of malicious activity to gain access to government information. Hence, in this research, we conduct a security measurement of mobile apps affiliated with the provincial governments in Indonesia, aiming to provide a source of information for the app's developer to make further security improvements. To the best of our knowledge, this is the first study to conduct an empirical analysis related to this area, expecting to become a cornerstone for further research. In total, we found 162 mobile apps available on the Google Play Store and correlated to 31 province governments in Indonesia. We conducted standard mobile apps static analysis method, starting from metadata scraping of each provincial government-affiliated app available at the Google Play Store and measured their security based on several indicators, including access to sensitive permission, unprotected exported components, the adoption of binary protection mechanism, and the appearance of third-party tracker libraries. We found that 27.1% (44) government apps request at least two dangerous permission, over 5% of the apps embed the Advertisement library, 10% of the apps have more than five exported Activities, and 44 (25.94%) Indonesian government apps did not adopt any binary protection mechanism. Hence, these results can be tailored as a reference for the provincial government in determining the level of effectiveness and impact of an app when developing mobile-based software in the future.

IOS and Android Platform Development of Korean Professional Application-Oriented Talent Training Platform Based on Multi-Dimensional Information Transmission Algorithm

iOS and Android platform development of Korean professional application-oriented talent training platform based on multi-dimensional information transmission algorithm. Firstly, we consider the data security of the system. When the application executes the sensitive operation, the policy executor will request the security policy from the security decision center. If the security policy contains restriction rules for the sensitive operation, the security decision center instructs the policy executor to carry out corresponding permission control and security operation. It is necessary to first perform static analysis on the Android application specified by the user to obtain all sensitive API calls and dangerous permission requests involved in the application; then convert the obtained information into policy points, and decide whether to agree or not by operating the policy points. Dangerous requests from applications and more fine-grained API calls. With these technologies, the professional application-oriented talent training platform is implemented. Through the verification, the efficiency of the platform is tested.

Assessment of App Store Description and Privacy Policy to Explore Ethical and Safety Concerns Associated with the Use of Mental Health Apps for Depression.

Mental Health apps (MH apps) could help address the huge unmet mental health care need of developing countries. This study aimed to explore potential ethical, data safety, and privacy issues associated with using MH apps for depression. A cross-sectional assessment of the top 50 MH apps (by Google Play store search result ordering) for depression available in India was conducted in November 2021. Most apps were listed under the category of health and fitness (54%). The median number of total and dangerous permissions requested at the time of download was nine and three, respectively. Privacy policy in English was available for 76%. The average length of the privacy policy was 2171 words, and the mean Flesch-Kincaid reading grade level was 12 (much higher than the recommended cut-off of eight). Important features relevant to safeguarding consumer confidentiality, including names of third parties with which user data could be shared (42%), explicit consent before sharing data with third parties (16%), and assurance regarding the collection of de-identifiable data (11%), were missing from the majority of privacy policies. There is an urgent need to improve the accessibility and usability of privacy policies by app developers, with the active involvement of other stakeholders.

PermPress: Machine Learning-Based Pipeline to Evaluate Permissions in App Privacy Policies

Privacy laws and app stores (e.g., Google Play Store) require mobile apps to have transparent privacy policies to disclose sensitive actions and data collection, such as accessing the phonebook, camera, storage, GPS, and microphone. However, many mobile apps do not accurately disclose their sensitive data access that requires sensitive (&#x2019;dangerous&#x2019;) permissions. Thus, analyzing discrepancies between apps&#x2019; permissions and privacy policies facilitates the identification of compliance issues upon which privacy regulators and marketplace operators can act. This paper proposes <i>PermPress</i> &#x2013; an automated machine-learning system to evaluate an Android app&#x2019;s permission-completeness, i.e., whether its privacy policy matches its dangerous permissions. <i>PermPress</i> combines machine learning techniques with human annotation of privacy policies to establish whether app policies contain permission-relevant information. <i>PermPress</i> leverages MPP-270, an annotated policy corpus, for establishing a gold standard dataset of permission completeness. This corpus shows that only 31% of apps disclose all dangerous permissions in privacy policies. By leveraging the annotated dataset and machine learning techniques, <i>PermPress</i> achieves an AUC score of 0.92 in predicting the permission-completeness of apps. A large-scale evaluation of 164, 156 Android apps shows that, on average, 7% of apps do not disclose more than half of their declared dangerous permissions in privacy policies, whereas 60% of apps omit to disclose at least one dangerous permission-related data collection in privacy policies. This paper&#x2019;s investigation uncovers the non-transparent state of app privacy policies and highlights the need to standardize app privacy policies&#x2019; compliance and completeness checking process.

Machine learning-based malware detection on Android devices using behavioral features

The most recent focus of security vulnerabilities has been on Android devices. Several permissions were developed to detect malware, but they can affect the device through malware applications that deal with dangerous permissions. To detect malware, behavioral features and machine learning techniques are used in this work. The purpose of this work is to evaluate the impact of malware occurrence using a behavioral features dataset. For malware detection, the features are incorporated into the prediction model using LBGM, ENB0, and EEXR. There is a Collector Phase, a Cleaner Phase, a Selector Phase, and a Detector Phase in this proposed system. This proposed system does the relevant process for detecting malware through these four phases. According to the performance results, the proposed prediction model EEXR gives high accuracy of 96.75% and less error rate of 3.28% while predicting more than other methods.

Detecting over-claim permissions and recognising dangerous permission in Android apps

Detecting over-claim permissions and recognising dangerous permission in Android apps

Deep Learning Based Android Anomaly Detection Using a Combination of Vulnerabilities Dataset

As the leading mobile phone operating system, Android is an attractive target for malicious applications trying to exploit the system’s security vulnerabilities. Although several approaches have been proposed in the research literature for the detection of Android malwares, many of them suffer from issues such as small training datasets, there are few features (most studies are limited to permissions) that ultimately affect their performance. In order to address these issues, we propose an approach combining advanced machine learning techniques and Android vulnerabilities taken from the AndroVul dataset, which contains a novel combination of features for three different vulnerability levels, including dangerous permissions, code smells, and AndroBugs vulnerabilities. Our approach relies on that dataset to train Deep Learning (DL) and Support Vector Machine (SVM) models for the detection of Android malware. Our results show that both models are capable of detecting malware encoded in Android APK files with about 99% accuracy, which is better than the current state-of-the-art approaches.

Analyzing security issues of android mobile health and medical applications.

We conduct a first large-scale analysis of mobile health (mHealth) apps available on Google Play with the goal of providing a comprehensive view of mHealth apps' security features and gauging the associated risks for mHealth users and their data. We designed an app collection platform that discovered and downloaded more than 20 000 mHealth apps from the Medical and Health & Fitness categories on Google Play. We performed a suite of app code and traffic measurements to highlight a range of app security flaws: certificate security, sensitive or unnecessary permission requests, malware presence, communication security, and security-related concerns raised in user reviews. Compared to baseline non-mHealth apps, mHealth apps generally adopt more reliable signing mechanisms and request fewer dangerous permissions. However, significant fractions of mHealth apps expose users to serious security risks. Specifically, 1.8% of mHealth apps package suspicious codes (eg, trojans), 45.0% rely on unencrypted communication, and as much as 23.0% of personal data (eg, location information and passwords) is sent on unsecured traffic. An analysis of the app reviews reveals that mHealth app users are largely unaware of the surfaced security issues. Despite being better aligned with security best practices than non-mHealth apps, mHealth apps are still far from ensuring robust security guarantees. App users, clinicians, technology developers, and policy makers alike should be cognizant of the uncovered security issues and weigh them carefully against the benefits of mHealth apps.

FORENSIC AND BEHAVIOR ANALYSIS OF FREE ANDROID VPNS

Millions of users worldwide use VPN clients to either circumvent censorship or to access geo-blocked content, and specifically for privacy and security purposes. In the pretext of secured communication and privacy, numerous free android-based VPNs are being pushed up in the Google Play store. However, the users aren’t sure or aware of whether the VPN is truly secure or just leaking their data. So, the forensic and behavior analysis of selected free android VPNs was carried out to study the usability of free android-based VPNs in terms of providing security and privacy; specifically, the presence of dangerous permissions, malware presence, traffic encryption, the DNS leaks, and the possibility of leaving forensic artifacts on the device after the VPN use. The study revealed considerable portion of the sample free VPNs were flagged malicious and had dangerous levels of permissions in use. While some failed the DNS leak test and some VPNs even did not encrypt the traffic. Given the availability of a huge number of Free VPNs in the Google Play store, it was found important that the users must be aware of the inherent risks put by the use of these Free VPNs.

HEFESTDROID: Highly Effective Features for Android Malware Detection and Analysis

Rapid globalization and advances in mobile technology have brought about phenomenal attention and great opportunities for android application developers to contribute meaningfully to the global digital market. The android mobile platform being one of the famous mobile operating systems has the highest number of applications in the digital market with a total market share of 76.23% between August 2018 and August 2019, according to a report of global stats counter. However, the substantial number of applications on the platform has led to a great number of malware attacks on the user’s privacy and sensitive documents. Consequently, a significant number of malware detection studies have been carried out to reduce the number of malware attacks. This paper analyses the impact of using highly effective android permission features to decipher the problem malware attack. The Highly Effective Features for Android Malware Detection and Analysis (HEFEST) summarises four effective android permission features to be considered in conducting malware detection analysis and classifications. The features recognized in this study are; Normal Declared Permission, Dangerous Permission, Signature-Based Permission, and Signature-or-system. The selection is based on the capabilities of the features in depicting the behaviors of android apps. The research data are drawn from Drebin open source, the dataset comprises 15,036 benign and malicious applications extracted from 215 distinct features, the records 9,026 were malicious and 6,010 benign applications. However, this research compares the detection accuracy of android permission features using machine learning-based algorithms; Support Vector Machine, and K-Nearest Neighbor to achieve a comprehensive accuracy ratio of malware detection, the classifier has a strong accuracy decision of classification and exceptional computational efficiency. The model correctly classified 2,812 out of 2,869 malicious applications appropriately with an accuracy of 98.0% and also classified 1,607 out of 1,642 accurately with a success rate of 97.9%. Generally, 98.0% of classification accuracy was archived.

Analysis of Diabetes Apps to Assess Privacy-Related Permissions: Systematic Search of Apps.

BackgroundMobile health has become a major vehicle of support for people living with diabetes. Accordingly, the availability of mobile apps for diabetes has been steadily increasing. Most of the previous reviews of diabetes apps have focused on the apps’ features and their alignment with clinical guidelines. However, there is a lack of knowledge on the actual compliance of diabetes apps with privacy and data security guidelines.ObjectiveThe aim of this study was to assess the levels of privacy of mobile apps for diabetes to contribute to the raising of awareness of privacy issues for app users, developers, and governmental data protection regulators.MethodsWe developed a semiautomatic app search module capable of retrieving Android apps’ privacy-related information, particularly the dangerous permissions required by apps, with the aim of analyzing privacy aspects related to diabetes apps. Following the research selection criteria, the original 882 apps were narrowed down to 497 apps that were included in the analysis.ResultsApproximately 60% of the analyzed diabetes apps requested potentially dangerous permissions, which pose a significant risk to users’ data privacy. In addition, 28.4% (141/497) of the apps did not provide a website for their privacy policy. Moreover, it was found that 40.0% (199/497) of the apps contained advertising, and some apps that claimed not to contain advertisements actually did. Ninety-five percent of the apps were free, and those belonging to the “medical” and “health and fitness” categories were the most popular. However, app users do not always realize that the free apps’ business model is largely based on advertising and, consequently, on sharing or selling their private data, either directly or indirectly, to unknown third parties.ConclusionsThe aforementioned findings confirm the necessity of educating patients and health care providers and raising their awareness regarding the privacy aspects of diabetes apps. Therefore, this research recommends properly and comprehensively training users, ensuring that governments and regulatory bodies enforce strict data protection laws, devising much tougher security policies and protocols in Android and in the Google Play Store, and implicating and supervising all stakeholders in the apps’ development process.

Utilizing Sentence Embedding for Dangerous Permissions Detection in Android Apps' Privacy Policies

Privacy policies analysis relies on understanding sentences meaning in order to identify sentences of interest to privacy related applications. In this paper, the authors investigate the strengths and limitations of sentence embeddings to detect dangerous permissions in Android apps privacy policies. Sent2Vec sentence embedding model was utilized and trained on 130,000 Android apps privacy policies. The terminology extracted by the sentence embedding model was then compared with the gold standard on a dataset of 564 privacy policies. This work seeks to provide answers to researchers and developers interested in extracting privacy related information from privacy policies using sentence embedding models. In addition, it may help regulators interested in deploying sentence embedding models to check for privacy policies' compliance with the government regulations and to identify points of inconsistencies or violations.

FCDP: Fidelity Calculation for Description-to-Permissions in Android Apps

Mobile app descriptions have been widely used in app markets to deliver various types of information to end-users. Even though this information may implicitly expose the dangerous permissions that allow access to sensitive data, most users cannot correctly identify and interpret the corresponding textual sentences owing to insufficient knowledge regarding Android permissions and the semantics of app descriptions. It is therefore important to assist users in understanding whether an app description accurately reflects whether the app may request dangerous permissions. To this end, we propose an approach named Fidelity Calculation for Description-to-Permissions (FCDP). It is aimed at assisting app-market auditors in assessing whether an app description indicates all information related to dangerous permissions using a quantified fidelity for providing a high-quality description to mobile users. Furthermore, we experimentally investigate the effect of different factors on FCDP, and we demonstrate that FCDP outperforms the state-of-the-art method by over 3.65% in predicting description-to-permissions. By using 64,265 Android descriptions crawled from Google Play, our in-depth analysis further indicates that most app descriptions do not entirely disclose the semantics of dangerous permissions for mobile users in the wild. It is therefore quite urgent to assist app-market auditors in regulating description writing in this regard.

Information security management of enterprise mobile device

The development of the modern labour market involves increasing the level of mobility of personnel, so the current trend is the spread of mobile devices in the implementation of professional activities. This practice improves the efficiency of enterprise, but also has a negative impact on the security of information systems of enterprises. The growing requirements of employers have led to the growth of the functionality of mobile devices. However, this also causes an increase in the number of vulnerabilities in them, leading to an increase in the complexity of the security processes. The combination of the above problems determines the need to organize the process of information security management of enterprise mobile devices. The model of information security management of enterprise mobile devices is described in the article. It allows identifying vulnerabilities of operating system objects of enterprise mobile devices by modelling combinations of dangerous permissions more accurately.

Android Malware Detection Based on API Pairing

Aiming at the problem that the permission-based detection is too coarse-grained, a malware detection method based on sensitive application program interface(API) pairing is proposed. The method decompiles the application to extract the sensitive APIs corresponding to the dangerous permissions, and uses the pairing of the sensitive APIs to construct the undirected graph of malicious applications and undirected graph of benign applications. According to the importance of sensitive APIs in malware and benign applications, different weights on the same edge in the different graphs are assigned to detect Android malicious applications. Experimental results show that the proposed method can effectively detect Android malicious applications and has practical significance.

A detection method for android application security based on TF-IDF and machine learning.

Android is the most widely used mobile operating system (OS). A large number of third-party Android application (app) markets have emerged. The absence of third-party market regulation has prompted research institutions to propose different malware detection techniques. However, due to improvements of malware itself and Android system, it is difficult to design a detection method that can efficiently and effectively detect malicious apps for a long time. Meanwhile, adopting more features will increase the complexity of the model and the computational cost of the system. Permissions play a vital role in the security of the Android apps. Term Frequency—Inverse Document Frequency (TF-IDF) is used to assess the importance of a word for a file set in a corpus. The static analysis method does not need to run the app. It can efficiently and accurately extract the permissions from an app. Based on this cognition and perspective, in this paper, a new static detection method based on TF-IDF and Machine Learning is proposed. The system permissions are extracted in Android application package’s (Apk’s) manifest file. TF-IDF algorithm is used to calculate the permission value (PV) of each permission and the sensitivity value of apk (SVOA) of each app. The SVOA and the number of the used permissions are learned and tested by machine learning. 6070 benign apps and 9419 malware are used to evaluate the proposed approach. The experiment results show that only use dangerous permissions or the number of used permissions can’t accurately distinguish whether an app is malicious or benign. For malware detection, the proposed approach achieve up to 99.5% accuracy and the learning and training time only needs 0.05s. For malware families detection, the accuracy is 99.6%. The results indicate that the method for unknown/new sample’s detection accuracy is 92.71%. Compared against other state-of-the-art approaches, the proposed approach is more effective by detecting malware and malware families.

Security Challenges in Android mHealth Apps Permissions: A Case Study of Persian Apps

Introduction: In this study, Persian Android mobile health (mhealth) applications were studied to describe usage of dangerous permissions in health related mobile applications. So the most frequently normal and dangerous permissions used in mhealth applications were reviewed.Materials and Methods: We wrote a PHP script to crawl information of Android apps in “health” and “medicine” categories from Cafebazaar app store. Then permission information of these application were extracted.Results: 11627 permissions from 3331 studied apps were obtained. There was at least one dangerous permission in 48% of reviewed apps. 41% of free applications, 53% of paid applications and 71% of in-purchase applications contained dangerous permissions. 1321 applications had writing permission to external storage of phone (40%), 1288 applications had access to read from external storage (39%), 422 applications could read contact list and ongoing calls (13%) and 188 applications were allowed to access phone location (5%).Conclusion: Most of Android permissions are harmless but significant number of the apps have at least one dangerous permission which increase the security risk. So paying attention to the permissions requested in the installation step is the best way to ensure that the application installed on your phone can only access what you want.

MADFU: An Improved Malicious Application Detection Method Based on Features Uncertainty.

Millions of Android applications (apps) are widely used today. Meanwhile, the number of malicious apps has increased exponentially. Currently, there are many security detection technologies for Android apps, such as static detection and dynamic detection. However, the uncertainty of the features in detection is not considered sufficiently in these technologies. Permissions play an important role in the security detection of Android apps. In this paper, a malicious application detection model based on features uncertainty (MADFU) is proposed. MADFU uses logistic regression function to describe the input (permissions) and output (labels) relationship. Moreover, it uses the Markov chain Monte Carlo (MCMC) algorithm to solve features’ uncertainty. After experimenting with 2037 samples, for malware detection, MADFU achieves an accuracy of up to 95.5%, and the false positive rate (FPR) is 1.2%. MADFU’s Android app detection accuracy is higher than the accuracy of directly using 24 dangerous permission. The results also indicate that the method for an unknown/new sample’s detection accuracy is 92.7%. Compared to other state-of-the-art approaches, the proposed method is more effective and efficient, by detecting malware.