Authors:
Rosangela Casolare
1
;
Fabio Martinelli
2
;
Francesco Mercaldo
3
;
2
and
Antonella Santone
3
Affiliations:
1
Department of Biosciences and Territory, University of Molise, Pesche (IS), Italy
;
2
Institute for Informatics and Telematics, National Research Council of Italy, Pisa, Italy
;
3
Department of Medicine and Health Sciences “Vincenzo Tiberio”, University of Molise, Campobasso, Italy
Keyword(s):
Android, Security, Model Checking, Formal Methods, Privacy.
Abstract:
Mobile devices store a lot of sensitive and private information. It is easy from the developer point of view to release the access to sensitive and critical assets in mobile application development, such as Android. For this reason it can happen that the developer inadvertently causes sensitive data leak, putting users’ privacy at risk. Recently, a type of attack that creates a capability to transfer sensitive data between two (or more) applications is emerging i.e., the so-called colluding covert channel. To demonstrate this possibility, in this work we design and develop a set of applications exploiting covert channels for malicious purposes, which uses the smartphone accelerometer to perform a collusion between two Android applications. The vibration engine sends information from the source application to the sink application, translating it into a vibration pattern. The applications have been checked by more than sixty antimalware which did not classify them as malware, except fo
r two antimalware which returned a false positive.
(More)