Improving Leakage Path Coverage in Android Apps

With the phenomenal increase in Android apps usage and storing of personal information on mobile devices, securing this sensitive information has assumed significance. The Android application developers knowingly or unknowingly create apps that may directly or indirectly leak this information to outside world. The majority of state-of-the-art approaches detect leaks through inter-component communication (ICC) within an app. Android allows inter-component communication (ICC) within the components of the same application or across multiple applications. ICC mechanism is used for the exchange of information among apps. Via ICC, an app or a set of apps can send the sensitive information out of the application or device. In this paper, we propose an approach for intra-app as well as inter-app data transfer analysis through intents and/or shared preferences that improve the coverage of leakage paths detected as compared to existing approaches. Our proposed approach is capable of analyzing more than two applications at a time. We have evaluated proposed approach on the DroidBench dataset and 116 real-time apps randomly selected and downloaded from Google PlayStore. We detected 1298 inter-component paths within an app and 215 inter-app sensitive paths. Our approach reported ~17.71% of more inter-component paths using shared preferences for data transfer.