I know what leaked in your pocket: uncovering privacy leaks on Android Apps with Static Taint Analysis

TL;DR

This paper introduces IccTA, a static analysis tool for Android apps that accurately detects privacy leaks across components and apps, outperforming existing methods in precision and recall.

Contribution

The paper presents IccTA, a novel static taint analysis approach that propagates context between components, significantly improving privacy leak detection accuracy.

Findings

Achieves 95.0% precision and 82.6% recall on DroidBench.

Detects 147 privacy leaks in 14 real-world applications.

Identifies inter-app privacy leaks using ApkCombiner.

Abstract

Android applications may leak privacy data carelessly or maliciously. In this work we perform inter-component data-flow analysis to detect privacy leaks between components of Android applications. Unlike all current approaches, our tool, called IccTA, propagates the context between the components, which improves the precision of the analysis. IccTA outperforms all other available tools by reaching a precision of 95.0% and a recall of 82.6% on DroidBench. Our approach detects 147 inter-component based privacy leaks in 14 applications in a set of 3000 real-world applications with a precision of 88.4%. With the help of ApkCombiner, our approach is able to detect inter-app based privacy leaks.