Secure Android Research Articles

BANK OF PASSWORDS: a secure Android password manager implemented based on specific requirements

Passwords serve as a vital means to safeguard our digital accounts. Many individuals resort to conventional methods like writing down passwords on paper or storing them on cloud services, often overlooking security risks, forgetting, and divulging is the most notable, which leads to loss of access to accounts, or potential breaches. In this paper, we propose the development of an Android application named "BANK OF PASSWORD" to address this issue. Our work focuses on creating a lightweight app equipped with essential functionalities desired by users, including password addition, updating, copying, searching, and deletion. To ensure the security of stored passwords, our approach incorporates various protective measures, such as access restriction through a login process and the utilization of SHA256 hashing and AES256 encryption for password encryption, where stored passwords are securely encrypted and stored as ciphertexts within an SQLite database. A fingerprint authentication was implemented as a second login method. Extensive testing of the application demonstrates the successful functioning of all proposed features and requirements on devices running API level 26 or above.

Survey on Blockchain-Based Data Storage Security for Android Mobile Applications.

This research paper investigates the integration of blockchain technology to enhance the security of Android mobile app data storage. Blockchain holds the potential to significantly improve data security and reliability, yet faces notable challenges such as scalability, performance, cost, and complexity. In this study, we begin by providing a thorough review of prior research and identifying critical research gaps in the field. Android's dominant position in the mobile market justifies our focus on this platform. Additionally, we delve into the historical evolution of blockchain and its relevance to modern mobile app security in a dedicated section. Our examination of encryption techniques and the effectiveness of blockchain in securing mobile app data storage yields important insights. We discuss the advantages of blockchain over traditional encryption methods and their practical implications. The central contribution of this paper is the Blockchain-based Secure Android Data Storage (BSADS) framework, now consisting of six comprehensive layers. We address challenges related to data storage costs, scalability, performance, and mobile-specific constraints, proposing technical optimization strategies to overcome these obstacles effectively. To maintain transparency and provide a holistic perspective, we acknowledge the limitations of our study. Furthermore, we outline future directions, stressing the importance of leveraging lightweight nodes, tackling scalability issues, integrating emerging technologies, and enhancing user experiences while adhering to regulatory requirements.

Student Database Management System

The main objective of this project is to add mobility and automation to the process of managing Student information in an institute. In a real-world environment, such as a college campus, information is disseminated to students in the form of notices, handwritten manuals, and vocal messages. Today, it is critical to employ not only the traditional forms of statement, but also newer ones, such as cell phone technology, to facilitate faster and easier communication among students. The college staff uses android devices to upload results and college information to a secure android application. Before any record changes, all data is thoroughly examined and validated on the server. The college Administrator manages the MYSql Database, where all data is safely kept. The method reduces paperwork and the amount of time it takes to access student records. In the previous system, college depended mainly on paper records, which had its own set of drawbacks. At the same time while searching any information it is too difficult to access and takes a lot of time to search the particular website. Hence, in order to overcome this problem a smart phone-based application using Android can be used to make this process easy and secure. Keywords: Student Database Management System, Android SDK, User Android Application.

Secure android IoT mobile and collaborative machine learning for controlling the management of enterprise

There is a need for increased security measures because of wide variety of android Internet of Thing (IoT) mobile devices that can communicate with each other via networks for controlling the management of enterprise. Elliptic Curve Deffie Hellman (ECDH) and Rivest Shamir Adleman (RSA) are used to secure data in android IoT phones in efficient manner. Android mobile can store a lot of data, including sensitive data. Protecting data saved on mobile has become a critical problem. In android IoT, Collaborative Machine Learning describes a method for collaboratively mining data, which makes it easier to manage and lowers cost of maintenance. To increase security in IoT phones, suggested system uses ECDH, RSA, and CML algorithms, which have been considered novelty of this method. RSA and ECDH are computed using time of decryption, encryption, and key generation. Conclusions show ECDH beats other alternatives like RSA. Finally, all users of the network have been tested.

GoFearless: A Safety and Security Android Based Application for Women

In today’s world, savagery against women has developed at an alarming rate considering the startling and dishonorable episodes around us. For different purposes, women got to travel alone in public transport to known or even obscure areas, at night as well. Moreover, they confront sexual badgering, eve-teasing, kidnapping, and whatnot. From the social, psychological, and legal points of view, these phenomena have significantly affected people from all sectors. For the last couple of years, the utilization of GPS navigation equipped with smartphones has extended significantly. Thus a smartphone can be utilized proficiently for individual security or other security purposes. This paper represents an android application entitled “GoFearless” that can protect ladies from hazardous circumstances so that they can feel courageous while traveling or getting to work every day. It is an android app with unique features such as instant cautioning the trusted contacts in conjunction with user location with three emergency trigger buttons-Panic, Cautious, and Update. Besides these, there are other options like addresses of adjacent police stations, police contacts, one-tap call to a national crisis number, recording and saving the surrounding phenomenon for future evidence purposes, etc. This app is developed in Android Studio utilizing Java Development kit, thus acting as a defender, taking after the user until they feel secure.

Efficient Deep Learning Network With Multi-Streams for Android Malware Family Classification

It is important to effectively detect, mitigate, and defend against Android malware attacks, because Android malware has long represented a major threat to Android app security. Characterizing and classifying similar malicious apps into groups plays a particularly crucial role in building a secure Android app ecosystem. The classification of malware families can efficiently enhance the malware detection process and systematically elucidate malware patterns. In this paper, we propose a novel efficient deep learning network with multi-streams for Android malware family classification. We first obtain the input data for a convolutional neural network (CNN) in string format from some main files or sections contained in each Android malicious app. We then classify malware families by applying a 1-dimensional convolution filter-based network for the files or sections. Further, by using gradient analysis to visualize the important files and sections in malicious apps, we attempt to intuitively grasp which files or sections are the most significant for malware family classification. To validate the effectiveness of our approach, we conduct extensive experiments with the well-known DREBIN and AMD malware datasets, and we compare our approach with existing methods. Our experimental results show that the 1D CNN model is more accurate than the 2D CNN model, and that the <monospace xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">code_item</monospace> part in the classes.dex is the most relevant feature for malware classification, as it is more relevant than other parts such as AndroidManifest.xml and certificate. The proposed method achieves the best accuracy of 93.2% by using 1D convolution filters with multi-streams for the main files and sections of the malware samples.

On Possible Cryptographic Optimization of Mobile Healthcare Application

The paper deals with a possible SOA based m-healthcare online system with secure mobile communication between patients and medical professionals with medical and insurance organizations. An example of an Android-based secure mobile client application is presented which can be used in the described secure m-healthcare model and it is experimentally evaluated. In the paper, we focus on possible optimization of cryptographic algorithms implemented in the secure Android mobile client application. The presented experimental results justify that security operations related to X.509v3 digital certificate generation and XML/WSS digital signature creation/verification are feasible on some current smart phones and justify the use of the proposed optimization techniques for implemented cryptographic algorithms.

Performance Analysis of 256-bit AES Encryption Algorithm on Android Smartphone

Encryption Techniques are one of the most important and very useful things to secure and protect the messages against such threads. To develop a highly secure android application, the application developer needs to take consideration various things furthermore the security after performance. Because of Android smartphone have limited resources, therefore effort to improve the performance of applications for the Android platform need to be done. The questions about which algorithms are performing better on Android are frequently arise in various developer forum such us Stack Overflow and Quora. To answer the questions this paper will show performance comparison of the most common safe encryption algorithm specifically Rijndael, Serpent and Twofish in order to establish which one of these is the most optimum to be implemented in Android smartphone. The test is carried out over devices which measure the performance and computational cost from the CPU and memory consumptions of the device and execution time when they run each algorithm on 256-bit key length. The test result shows that the Serpent has better encryption and decryption performance than Rijndael and Twofish. Serpent has the faster time for encryption and decryption. While Serpent and Twofish surpass Rijndael on efficiency use of memory for encryption and decryption. However, the most efficient percentage of CPU usage is done by Rijndael.

A Survey on Various Threats and Current State of Security in Android Platform

The advent of the Android system has brought smartphone technology to the doorsteps of the masses. The latest technologies have made it affordable for every section of the society. However, the emergence of the Android platform has also escalated the growth of cybercrime through the mobile platform. Its open source operating system has made it a center of attraction for the attackers. This article provides a comprehensive study of the state of the Android Security domain. This article classifies the attacks on the Android system in four categories (i) hardware-based attacks, (ii) kernel-based attacks, (iii) hardware abstraction layer-based attacks, and (iv) application-based attacks. The study deals with various threats and security measures relating to these categories and presents an in-depth analysis of the underlying problems in the Android security domain. The article also stresses the role of Android application developers in realizing a more secure Android environment. This article attempts to provide a comparative analysis of various malware detection techniques concerning their methods and limitations. The study can help researchers gain knowledge of the Android security domain from various aspects and build a more comprehensive, robust, and efficient solution to the threats that Android is facing.

Research on Data Mining of Permission-Induced Risk for Android IoT Devices

With the growing era of the Internet of Things (IoT), more and more devices are connecting with the Internet using android applications to provide various services. The IoT devices are used for sensing, controlling and monitoring of different processes. Most of IoT devices use Android applications for communication and data exchange. Therefore, a secure Android permission privileged mechanism is required to increase the security of apps. According to a recent study, a malicious Android application is developed almost every 10 s. To resist this serious malware campaign, we need effective malware detection approaches to identify malware applications effectively and efficiently. Most of the studies focused on detecting malware based on static and dynamic analysis of the applications. However, to analyse the risky permission at runtime is a challenging task. In this study, first, we proposed a novel approach to distinguish between malware and benign applications based on permission ranking, similarity-based permission feature selection, and association rule for permission mining. Secondly, the proposed methodology also includes the enhancement of the random forest algorithm to improve the accuracy for malware detection. The experimental outcomes demonstrate high proficiency of the accuracy for malware detection, which is pivotal for android apps aiming for secure data exchange between IoT devices.

Formal Analysis of Language-Based Android Security Using Theorem Proving Approach

Mobile devices are an indispensable part of modern-day lives to support portable computations and context-aware communication. Android applications within a mobile device share data to support application operations and better user experience, which also increases security risks to device’s data integrity and confidentiality. To analyze the security provided by the Android permissions, modern security techniques, based on the programming languages, have been used to enforce best practices for developing the secure Android applications. Android security assessment, based on the language-based techniques in an informal setting without formal tool support, is tedious and error-prone. Furthermore, the lack of proof of the soundness of the language-based techniques raises questions about the validity of the analysis. To enable computer-aided formal verification in Android security domain, we have developed a mathematical model of language-based Android security using computer-based proof assistant Coq. One of the main challenges for mechanizing the language-based security in theorem prover relates to the complexity of variable bindings in language-based security techniques. As the main contributions of the paper: 1) the language-based security, including variable binding, is formalized in theorem prover Coq; 2) a formal type checker is built to type check (capture safe data flows within) Android applications using computer; and 3) the soundness of the language-based security technique (type system) is mechanically verified. The formal model of the Android type system and their proof of soundness are machine-readable, and their correctness can be checked in the computer using Coq proof and type checkers.

(In)Secure Android Debugging: Security analysis and lessons learned

Universal Serial Bus (USB) is currently one of the most popular standards that controls communication between personal computers (PCs) and their peripheral devices. Thus, it is important to establish whether such connections are properly secured especially when USB is used to connect devices like smartphones, tablets, etc. where sensitive user data can be potentially stored. For this reason, this paper evaluates security of the recent Android versions with respect to the USB-related attacks. In particular, we present a novel approach to compromise Android-based devices by exploiting Android Debug Bridge (ADB) protocol using Man in the Middle (MitM) attacks. Comprehensive analysis of those types of attacks have revealed five novel security vulnerabilities in the Android OS. Security gaps found in this paper cannot only be used to bypass the lock screen security and to gain unauthorized access to the user’s private data but also to enable future ADB attacks by incorporating a backdoor to bypass phone security at any time. We also developed a tool which exploits all discovered vulnerabilities and can serve as a security mean to assess current ADB implementations as well as future protocol improvements. By disclosing new security weaknesses we want to raise security awareness of the users, researches, security professionals, and developers related to the USB-related attacks and to the threat they pose not only to PCs but also to the USB devices.

Taint flow analysis to improve Android application security

The current generation, adults and children of all ages, have come to know and love the smartphone. Everywhere you look, a majority of people will have a smartphone in hand. The entirety of one's l...

Secure android covert channel with robust survivability to service provider restrictions

The overarching field of information hiding has been extensively researched. However, the potential for use of smartphones - communicating over cellular service provider networks - has yet to be fully explored. In this paper, we propose Android-Stego - a covert communication framework for Android smartphones. We have presented results analysing real-world cellular service-providers' restrictions on MMS messages and the corrective actions they take using a prototype implementation of Android-Stego. With the prototype implementation, we have also analysed the messages at both the sending and the receiving ends to determine the service providers' actions on MMS messages - such as compression and/or format conversion.

Secure android covert channel with robust survivability to service provider restrictions

The overarching field of information hiding has been extensively researched. However, the potential for use of smartphones - communicating over cellular service provider networks - has yet to be fully explored. In this paper, we propose Android-Stego - a covert communication framework for Android smartphones. We have presented results analysing real-world cellular service-providers' restrictions on MMS messages and the corrective actions they take using a prototype implementation of Android-Stego. With the prototype implementation, we have also analysed the messages at both the sending and the receiving ends to determine the service providers' actions on MMS messages - such as compression and/or format conversion.

Granular Per(M)issions: Questions Unanswered

Objectives: In android users do not understand the permissions structure and how apps utilize these permissions. Methods/Statistical Analysis: Study of App Ops system in android and finding out ways to check what permission android apps are using and also to check and derive various algorithms to see what levels of access can be granted to permissions. Also to see if an application can be developed so that the user could know what permissions app is using and whether they are required or not? Findings: After proposing four algorithms and trying to classify the level of protection access to permissions we have found that this classification yields desired results. The client can know what permissions are being requested by which apps and can therefore be enlightened to its hazards and security risks. Also although this approach is similar to what Google has done with the Marshmallow version howsoever it suffers from shortcomings and is not yet, a complete solution. Thus, our results will only substantiate and help in the creation of a more robust and secure android version. Whether this much power should be given to the naive user, however is a question that needs some thought. Application/Improvements: Our algorithms can be applied to newer versions of android to make it more secure and ensure user privacy.

The Use of Remote Access Tools by System Administrators Today and their Effectiveness: Case Study of Remote Desktop, Virtual Network Computing and Secure Android App

This study sought to find out how Network Administrators make use of remote access tools in their daily activities as Network Administrators. It also investigated how effective and reliable these tools have been to Network Administrators in terms of the tools’ ability to return desired results to the users (Network Administrators). From the findings of this research, 37.93% of the Network Administrators use remote access tools to do file transfer from one computer to the other, 26.44% use remote access tools to share or deploy applications on their local networks, 20.69% use remote access tools to access their terminal servers and 14.94% use remote access tools to create and set user privileges on their networks. The investigation further revealed that 36.78% of Network Administrators agreed that remote desktop was effective, 24.14% also agreed that the secure android app was effective and 21.84% agreed that VNC was also effective. General Terms Remote Access Tools, Protocols, effectiveness, reliability.

Recovering Data from Password Protected Data Security Applications in Android Based Smartphones

The standard method of mobile forensic analysis is to attach the mobile device to forensic tools and to perform logical, file system, or physical extraction. A hindrance in analysis arises if the mobile is not properly supported or data in the handset is secured using data security android applications. The techniques discussed in this paper help in the analysis and extraction of data files secured using data hiding password protected android based applications. A few well known data protection android applications are analyzed. The analysis was performed on both partially supported and fully supported sets.

Warning System for Detecting Malicious Applications on Android System

Android, Google open source operating system for mobile devices, has been rapidly grown. Android applications (apps) are uploaded to not only official market, play store, but also other alternative markets. These markets have no inspection system for detecting malicious apps. So, malicious apps can be easily uploaded on the market. Many studies have presented to detect malicious apps for the secure Android mobile environment. But without user participation, it is difficult to detect all of malicious apps. We present a Warning System for detecting malicious applications on Android system. The warning system monitors API calls related suspicious behaviors running on the service layer. After analysis malicious apps, we find that almost malicious apps use similar API calls. We proposed modified Android platform to warn suspicious API calls are running on the service layer. The warning system lets user realize the information of suspicious API calls and block the API calls.