Analyzing HTTP-Based Information Exfiltration of Malicious Android Applications
Document Type
Conference Proceeding
Publication Date
9-5-2018
Abstract
Exfiltrating sensitive information from smartphones has become one of the most significant security threats. We have built a system to identify HTTP-based information exfiltration of malicious Android applications. In this paper, we discuss the method to track the propagation of sensitive information in Android applications using static taint analysis. We have studied the leaked information, destinations to which information is exfiltrated, and their correlations with types of sensitive information. The analysis results based on 578 malicious Android applications have revealed that a significant portion of these applications are interested in identity-related sensitive information. The vast majority of malicious applications leak multiple types of sensitive information. We have also identified servers associated with three country codes including CN, US, and SG are most active in collecting sensitive information. The analysis results have also demonstrated that a wide range of non-default ports are used by suspicious URLs.
Repository Citation
Kelkar, S.,
Kraus, T.,
Morgan, D.,
Zhang, J.,
& Dai, R.
(2018). Analyzing HTTP-Based Information Exfiltration of Malicious Android Applications. Proceedings - 17th IEEE International Conference on Trust, Security and Privacy in Computing and Communications and 12th IEEE International Conference on Big Data Science and Engineering, Trustcom/BigDataSE 2018, 1642-1645.
https://corescholar.libraries.wright.edu/cse/524
DOI
10.1109/TrustCom/BigDataSE.2018.00242
