一句话：提出静态分析工具 ClipboardScope，大规模系统研究 Android 应用剪贴板数据使用与隐私泄漏，并划分四类使用模式。
移动操作系统剪贴板访问控制不足，使应用能读取其他应用复制的数据并存储或上传，但已有研究零散，缺乏对整个生态的系统性认识。本文提出自动化工具 ClipboardScope，利用原则化静态程序分析大规模揭示 Android 应用剪贴板数据使用：将使用定义为数据如何被验证以及流向何处，并划分 spot-on、grand-slam、selective、cherry-pick 四类模式。作者在 Google Play 截至 2022 年 6 月的 220 万应用中评估了 26,201 个访问并处理剪贴板文本的应用，分别识别出 23,948、848、1,075、330 个属于四类的应用，并发现广泛使用 SharedPreferences 存储历史数据可能构成隐蔽的隐私泄漏渠道。
Recently, clipboard usage has become prevalent in mobile apps allowing users to copy and paste text within the same app or across different apps. However, insufficient access control on the clipboard in the mobile operating systems exposes its contained data to high risks where one app can read the data copied in other apps and store it locally or even send it to remote servers. Unfortunately, the literature only has ad-hoc studies in this respect and lacks a comprehensive and systematic study of the entire mobile app ecosystem. To establish the missing links, this paper proposes an automated tool, ClipboardScope, that leverages the principled static program analysis to uncover the clipboard data usage in mobile apps at scale by defining a usage as a combination of two aspects, i.e., how the clipboard data is validated and where does it go. It defines four primary categories of clipboard data operation, namely spot-on, grand-slam, selective, and cherry-pick, based on the clipboard usage in an app. ClipboardScope is evaluated on 26,201 out of a total of 2.2 million mobile apps available on Google Play as of June 2022 that access and process the clipboard text. It identifies 23,948, 848, 1,075, and 330 apps that are recognized as the four designated categories, respectively. In addition, we uncovered a prevalent programming habit of using the SharedPreferences object to store historical data, which can become an unnoticeable privacy leakage channel.
DOI 原文 ·
@inproceedings{paperbot11318,
title = {Attention! Your Copied Data is Under Monitoring: A Systematic Study of Clipboard Usage in Android Apps},
author = {Yongliang Chen and Ruoqin Tang and Chaoshun Zuo and Xiaokuan Zhang and Lei Xue and Xiapu Luo and Qingchuan Zhao},
booktitle = {ICSE},
year = {2024},
doi = {10.1145/3597503.3623317}
}