Indirect File Leaks in Mobile Applications

Daoyuan WU; Rocky K. C. CHANG

Indirect File Leaks in Mobile Applications

Daoyuan WU
, Rocky K. C. CHANG

Research output: Other Conference Contributions › Conference Paper (other) › Research › peer-review

Abstract

Today, much of our sensitive information is stored inside mobile applications (apps), such as the browsing histories and chatting logs. To safeguard these privacy files, modern mobile systems, notably Android and iOS, use sandboxes to isolate apps’ file zones from one another. However, we show in this paper that these private files can still be leaked by indirectly exploiting components that are trusted by the victim apps. In particular, we devise new indirect file leak (IFL) attacks that exploit browser interfaces, command interpreters, and embedded app servers to leak data from very popular apps, such as Evernote and QQ. Unlike the previous attacks, we demonstrate that these IFLs can affect both Android and iOS. Moreover, our IFL methods allow an adversary to launch the attacks remotely, without implanting malicious apps in victim’s smartphones. We finally compare the impacts of four different types of IFL attacks on Android and iOS, and propose several mitigation methods.

Original language	English
Number of pages	10
Publication status	Published - 21 May 2015
Externally published	Yes
Event	Mobile Security Technologies 2015 - San Jose, United States Duration: 21 May 2015 → 21 May 2015

Workshop

Workshop	Mobile Security Technologies 2015
Abbreviated title	MoST 2015
Country/Territory	United States
City	San Jose
Period	21/05/15 → 21/05/15

Bibliographical note

Acknowledgements:
We thank all three anonymous reviewers for their helpful comments.

Funding

This work was partially supported by a grant (ref. no. ITS/073/12) from the Innovation Technology Fund in Hong Kong.

Access to Document

https://www.ieee-security.org/TC/SPW2015/MoST/papers/s2p2.pdf

Cite this

@conference{b0acfc87f4a840c0a15ddee61d1d975b,

title = "Indirect File Leaks in Mobile Applications",

abstract = "Today, much of our sensitive information is stored inside mobile applications (apps), such as the browsing histories and chatting logs. To safeguard these privacy files, modern mobile systems, notably Android and iOS, use sandboxes to isolate apps{\textquoteright} file zones from one another. However, we show in this paper that these private files can still be leaked by indirectly exploiting components that are trusted by the victim apps. In particular, we devise new indirect file leak (IFL) attacks that exploit browser interfaces, command interpreters, and embedded app servers to leak data from very popular apps, such as Evernote and QQ. Unlike the previous attacks, we demonstrate that these IFLs can affect both Android and iOS. Moreover, our IFL methods allow an adversary to launch the attacks remotely, without implanting malicious apps in victim{\textquoteright}s smartphones. We finally compare the impacts of four different types of IFL attacks on Android and iOS, and propose several mitigation methods.",

author = "Daoyuan WU and CHANG, \{Rocky K. C.\}",

note = "Acknowledgements: We thank all three anonymous reviewers for their helpful comments. ; Mobile Security Technologies 2015, MoST 2015 ; Conference date: 21-05-2015 Through 21-05-2015",

year = "2015",

month = may,

day = "21",

language = "English",

}

TY - CONF

T1 - Indirect File Leaks in Mobile Applications

AU - WU, Daoyuan

AU - CHANG, Rocky K. C.

N1 - Acknowledgements: We thank all three anonymous reviewers for their helpful comments.

PY - 2015/5/21

Y1 - 2015/5/21

N2 - Today, much of our sensitive information is stored inside mobile applications (apps), such as the browsing histories and chatting logs. To safeguard these privacy files, modern mobile systems, notably Android and iOS, use sandboxes to isolate apps’ file zones from one another. However, we show in this paper that these private files can still be leaked by indirectly exploiting components that are trusted by the victim apps. In particular, we devise new indirect file leak (IFL) attacks that exploit browser interfaces, command interpreters, and embedded app servers to leak data from very popular apps, such as Evernote and QQ. Unlike the previous attacks, we demonstrate that these IFLs can affect both Android and iOS. Moreover, our IFL methods allow an adversary to launch the attacks remotely, without implanting malicious apps in victim’s smartphones. We finally compare the impacts of four different types of IFL attacks on Android and iOS, and propose several mitigation methods.

AB - Today, much of our sensitive information is stored inside mobile applications (apps), such as the browsing histories and chatting logs. To safeguard these privacy files, modern mobile systems, notably Android and iOS, use sandboxes to isolate apps’ file zones from one another. However, we show in this paper that these private files can still be leaked by indirectly exploiting components that are trusted by the victim apps. In particular, we devise new indirect file leak (IFL) attacks that exploit browser interfaces, command interpreters, and embedded app servers to leak data from very popular apps, such as Evernote and QQ. Unlike the previous attacks, we demonstrate that these IFLs can affect both Android and iOS. Moreover, our IFL methods allow an adversary to launch the attacks remotely, without implanting malicious apps in victim’s smartphones. We finally compare the impacts of four different types of IFL attacks on Android and iOS, and propose several mitigation methods.

M3 - Conference Paper (other)

T2 - Mobile Security Technologies 2015

Y2 - 21 May 2015 through 21 May 2015

ER -

Indirect File Leaks in Mobile Applications

Abstract

Workshop

Bibliographical note

Funding

Access to Document

Fingerprint

Cite this