MSR 2020
Mon 29 - Tue 30 June 2020
co-located with ICSE 2020
Tue 30 Jun 2020 11:12 - 11:24 at MSR:Zoom2 - Security Chair(s): Dimitris Mitropoulos

Developers continuously update their Android apps to keep up with competitors in the market. Such constant updates do not bother end users, since by default the Android platform automatically pushes the most recent compatible release on the device, unless there are major changes in the list of requested permissions that users have to explicitly grant. The lack of explicit user’s approval for each application update, however, may lead to significant risks for the end user, as the new release may include new subtle behaviors which may be privacy-invasive. The introduction of permission groups in the Android permission model makes this problem even worse: if a user gives a single permission within a group, the application can silently request further permissions in this group with each update—without having to ask the user.

In this paper, we explain the threat that permission groups may pose for the privacy of Android users. We run an empirical study on 2,865,553 app releases, and we show that in a representative app store more than ∼17% of apps request new dangerous permissions that the operating system grants without any user’s approval. Our analyses show that apps actually use over 56% of such automatically granted permissions, although most of their descriptions do not explicitly explain for what purposes. Finally, our manual inspection reveals clear abuses of apps that leak sensitive data such as user’s accurate location, list of contacts, history of phone calls, and emails which are protected by permissions that the user never explicitly acknowledges.

Tue 30 Jun
Times are displayed in time zone: (UTC) Coordinated Universal Time change

msr-2020-papers
11:00 - 12:00: Technical Papers - Security at MSR:Zoom2
Chair(s): Dimitris MitropoulosAthens University of Economics and Business

Q/A & Discussion of Session Papers over Zoom (Joining info available on Slack)

msr-2020-papers11:00 - 11:12
Live Q&A
Danielle GonzalezRochester Institute of Technology, USA, Michael RathTechnische Universität Ilmenau, Mehdi MirakhorliRochester Institute of Technology
DOI Pre-print Media Attached
msr-2020-papers11:12 - 11:24
Live Q&A
Paolo Calciati IMDEA Software Institute, Konstantin KuznetsovSaarland University, CISPA, Alessandra GorlaIMDEA Software Institute, Andreas ZellerCISPA Helmholtz Center for Information Security
Media Attached
msr-2020-papers11:24 - 11:36
Live Q&A
Triet Le Huynh MinhThe University of Adelaide, David Hin, Roland Croft, Muhammad Ali BabarThe University of Adelaide
DOI Pre-print Media Attached
msr-2020-Data-showcase11:36 - 11:48
Live Q&A
Jiahao FanNew Jersey Institute of Technology, USA, Yi LiNew Jersey Institute of Technology, USA, Shaohua WangNew Jersey Institute of Technology, USA, Tien N. NguyenUniversity of Texas at Dallas
Media Attached
msr-2020-papers11:48 - 12:00
Live Q&A
James WaldenNorthern Kentucky University
Pre-print Media Attached