Prof. Dr. Eric Bodden

As Golem and Heise are writing today, Google has updated its rules for advertisement in Android Apps. Earlier this year, researchers from the SSE group and from Fraunhofer SIT have found that almost one third of the top apps in Google’s Play store use advertising services that in many instances violate the store’s content policy. The result is annoying for users, as these apps will plague them with very intrusive forms of advertisement that can be very hard to eliminate even for expert users. Early on, we have shared these results with Google and Google. The change by Google now obligates app developers to ensure that the ad frameworks they include in their app do not use any ad services violating Google’s policy.

Currently, the Google Play Store contains nearly 700000 apps . Most of them can be downloaded for free. These apps are developed by different kinds of developer, like hobby or semiprofessional developers or by actual software companies. To make some profit or get an allowance developers can augment these free apps with advertisement.

Advertising companies, such as leadbolt or airpush provide ready made ad libraries that developers can easily include in an application. Read the rest of this entry »

Today at USENIX Damien Octeau presented our joint work on a new analysis of Android Inter-Component Communication. This is joint work with Penn State University and the University of Luxembourg in the context of our Google Award on creating a map of Android inter-component communication.

We are still in the process of improving the implementation and integrating it with FlowDroid. Once this is done, we will make our tool Epicc open source. The paper is available for download, here’s the abstract:

Many threats present in smartphones are the result of interactions between application components, not just artifacts of single components. However, current techniques for identifying inter-application communication are ad hoc and do not scale to large numbers of applications. In this paper, we reduce the discovery of inter-component communication (ICC) in smartphones to an instance of the Interprocedural Distributive Environment (IDE) problem, and develop a sound static analysis technique targeted to the Android platform. We apply this analysis to 1,200 applications selected from the Play store and characterize the locations and substance of their ICC. Experiments show that full specifications for ICC can be identified for over 93% of ICC locations for the applications studied. Further the analysis scales well; analysis of each application took on average 113 seconds to complete. Epicc, the resulting tool, finds ICC vulnerabilities with far fewer false positives than the next best tool. In this way, we develop a scalable vehicle to extend current security analysis to entire collections of applications as well as the interfaces they export.

Cross-posted from SEEBlog

At CCS 2013, we will be giving a tutorial on instrumenting Android apps to enhance their security. You are most welcome to attend! From the abstract:

Novel types of malware on mobile devices have raised researchers interest in implementing static and dynamic techniques for detecting and mitigating malicious behavior of mobile applications. In this hands-on tutorial we will demonstrate and explain different techniques for instrumenting Android applications using the Aspect Bench Compiler (abc) and the program analysis and transformation tool Soot. Through high-level abstractions such as AspectJ aspects and Tracematches, abc supports a declarative style of instrumentation that lends itself to the rapid prototyping of at least simple instrumentation schemes. Soot supports instrumentation in an imperative style, which requires more work but allows more fine-grained control. Both abc and Soot are inter operable, as they instrument the same intermediate program representation. Furthermore, as we show, both can be easily integrated with static program analyses that can be used to specialize instrumentation schemes based on additional information extracted from the static structure of the instrumented app.

In September, Steven Arzt and Siegfried Rasthofer will be giving a similar tutorial also at RV 2013.

Cross-posted from SEEBlog