Blackdroid: A black-box way for Android plaintext and ciphertext privacy leaks detecting and guarding

摘要

Constantly emerging third-party apps bring huge convenience and enjoyment to Android users. However, vulnerabilities of Android's own permission management mechanism allow apps to read user's privacy data and send them outside without the user's consent. In this paper, we provide Blackdroid, a light weight plaintext and ciphertext privacy leaks detecting and controlling solution for Android. Based on preset labels, Blackdroid tracks the flow of text privacy data in third-party apps via a black-box way, and drops the bad packages containing privacy if necessary. We tested 4428 popular apps from Chinese Android market Gfan using Blackdroid. Of the tested apps, 21.7% send out packages carrying sensitive contents. In performance experiments, we observed only 4.5% time overload gain in internet package sending out phase.