Hidden in Plain Sight: Exploring Encrypted Channels in Android apps
Sajjad Pourali, Nayanamana Samarasinghe, Mohammad Mannan

TL;DR
This paper introduces ThirdEye, a tool that uncovers covert and non-standard data leaks in Android apps, revealing significant privacy risks hidden from existing analysis methods.
Contribution
The study presents ThirdEye, a novel analysis framework that detects encrypted and covert data transmissions across various protocols and storage media in Android apps.
Findings
22.92% of top Android apps use custom encryption for data transmission and storage.
85.38% of these apps transmit device identifiers that can fingerprint users.
Several apps transmit sensitive data over insecure or custom encrypted channels.
Abstract
As privacy features in Android operating system improve, privacy-invasive apps may gradually shift their focus to non-standard and covert channels for leaking private user/device information. Such leaks also remain largely undetected by state-of-the-art privacy analysis tools, which are very effective in uncovering privacy exposures via regular HTTP and HTTPS channels. In this study, we design and implement, ThirdEye, to significantly extend the visibility of current privacy analysis tools, in terms of the exposures that happen across various non-standard and covert channels, i.e., via any protocol over TCP/UDP (beyond HTTP/S), and using multi-layer custom encryption over HTTP/S and non-HTTP protocols. Besides network exposures, we also consider covert channels via storage media that also leverage custom encryption layers. Using ThirdEye, we analyzed 12,598 top-apps in various…
Peer Reviews
No public reviews on file for this paper yet. If you reviewed it on a platform where reviews are public (OpenReview, ICLR, NeurIPS, ICML), you can paste yours below so the community can read it here.
Code & Models
Videos
No videos yet. Explain this paper in a talk, walkthrough, or lecture? Add one.
Taxonomy
TopicsAdvanced Malware Detection Techniques · Privacy, Security, and Data Protection · Internet Traffic Analysis and Secure E-voting
