一句话：结合动态检测与静态污点分析，自动评估 Android 剪贴板访问与隐私泄露，并实证发现搜狗输入法外传剪贴板数据。
针对 Android 缺乏对剪贴板访问的监控与控制，用户难以察觉应用可能泄露剪贴板中的私密信息，本文开展初步研究并提出一种自动化评估方法。方法包括两个部分：动态检测应用的剪贴板访问行为，以及通过静态数据流分析判定隐私泄露；其中在污点分析基础上引入调用图拼接，以支持泄露源的回溯。初步结果表明，该方法能够暴露剪贴板数据泄露问题，并据此发现流行应用搜狗输入法直接监控并将剪贴板中的用户数据传输至后端服务器。该工作为后续系统化审计 Android 剪贴板隐私风险提供了可行方向。
Since the new privacy feature in iOS enabling users to acknowledge which app is reading or writing to his or her clipboard through prompting notifications was updated, a plethora of top apps have been reported to frequently access the clipboard without user consent. However, the lack of monitoring and control of Android application's access to the clipboard data leave Android users blind to their potential to leak private information from Android clipboards, raising severe security and privacy concerns. In this preliminary work, we envisage and investigate an approach to (i) dynamically detect clipboard access behaviour, and (ii) determine privacy leaks via static data flow analysis, in which we enhance the results of taint analysis with call graph concatenation to enable leakage source backtracking. Our preliminary results indicate that the proposed method can expose clipboard data leakage as substantiated by our discovery of a popular app, i.e., Sogou Input, directly monitoring and transferring user data in a clipboard to backend servers.
DOI 原文 ·
@inproceedings{paperbot5965,
title = {An automated assessment of Android clipboards},
author = {Wei Wang and Ruoxi Sun and Minhui Xue and Damith C. Ranasinghe},
booktitle = {ASE},
year = {2020},
doi = {10.1145/3324884.3418905}
}