NoSurv: A Framework for Protection against Surveillance Attacks on Mobile Devices

Android is an open source operating system for mobile devices that has become very popular in the global market. This opens the door for various possible attacks with malicious programs, including surveillance attacks. In surveillance attacks, the target person is put under surveillance using his or her own mobile device. In this paper, we have designed a framework called NoSurv that protects the average user from surveillance attacks that could be conducted with newly installed applications by a third-party who is either trusted by the user or got a hold of the device with or without user's consensus. NoSurv is integrated with Android operating system and modifies its way of handling new installations. NoSurv analyzes the permissions required in the manifest file of the new application. If the application requests permissions that could be used for conducting a surveillance attack, NoSurv first checks the trustworthiness of the app in a local copy of a globally maintained whitelist of trusted apps that have shown not to conduct such attacks. This list is formed by crowdsourcing after the application has been installed on a pre-specified number of mobile devices that run NoSurv and have been monitored and proven to be safe. If the application is not in the list, NoSurv reserves that new application in a special zone called untrusted zone while preventing the application from obtaining dangerous permissions for a pre-specified period of time. After this period, NoSurv informs the user that s/he has a surveillance application and gives him/her the ability to move the application to a zone called trusted zone with all permissions requested or uninstall the application.