Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Inter-App Communication #14

Merged
merged 1 commit into from
Mar 8, 2016

Conversation

ershweta
Copy link

@ershweta ershweta commented Mar 1, 2016

Hi Steven,

I developed 8 apps, in which, each of the 7 apps collude with the eighth app called collector and privacy lekage occur. Collector app will write sensitive info at external storage.
I have added 8 apps in Inter-App Communication and updated readme.md accordingly.

@StevenArzt StevenArzt merged commit 288818d into secure-software-engineering:develop Mar 8, 2016
@ershweta
Copy link
Author

ershweta commented Mar 8, 2016

Hi Steven,

Some information about the contributed apps.
You can put these apps under new category: "Colluding Apps"
The following apps :

  1. location
  2. location_broadcast
  3. location_service
    Have only LOCATION permission, and hence only can access location information.
    Similarly
  4. DeviceId_bradcast
  5. DeviceId_contentProvider1
  6. DeviceId_orderedIntent
  7. DeviceId_service
    have only READ_PHONE_STATE permission, and hence only can read device ID or related information.

But all the above apps are sending this sensitive information to the collector app. This app has WRITE_EXTERNAL_STORAGE permission and can write the data on external storage.

So individual apps are not harmful but their combination is creating privacy leakage paths. Privilege Escalation is occuring. Hence these can be put in the category "Colluding Apps".

NOTE: One more modification in acknowledgement, can you mention the funding body i.e.
Malaviya National Institute of Technology, Jaipur (INDIA) under DeITy Project funded from Government of India.

Thanks
Shweta Bhandari
PhD Scholar
MNIT Jaipur
India

@StevenArzt
Copy link
Member

I merged your test cases into DroidBench and updated the affiliation in the acknowledgements section of the README file accordingly. Thanks for your contribution!

@ershweta
Copy link
Author

ershweta commented Mar 9, 2016

Thanks Steven.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants