一句话：提出基于代数数据类型的污点分析，用含 AND/XOR/哈希的组合污点签名刻画敏感标识符的泄漏方式。
现有污点分析只报告 source→sink 的流，无法区分互斥的污点来源，也无法刻画来源的组合方式（如 IMEI 与 MAC 拼接后哈希泄漏，还是分别哈希后分别泄漏），在 Android 场景下精度尤为不足。本文提出代数数据类型污点分析，生成包含 AND、XOR、哈希算子的简洁污点签名，把泄漏类比为代数中的积类型与和类型。作者将其实现为 Android 静态分析，为应用推导出描述硬件/软件标识符如何被加工与外传的泄漏签名。基于 Google Play 上 1000 款头部应用及其内嵌库，论文开展六项实证研究：区分原始流与哈希流以消除现有分析的精度损失，发现违反 Google Play 指南滥用硬件标识符的应用与库，表明第三方代码而非应用自身代码是泄漏主因，暴露潜在的去匿名化实践，并量化近两年来应用隐私友好度的提升。
Current taint analyses track flow from sources to sinks, and report the results simply as source → sink pairs, or flows. This is imprecise and ineffective in many real-world scenarios; examples include taint sources that are mutually exclusive, or flows that combine sources (e.g., IMEI and MAC Address are concatenated, hashed, leaked vs. IMEI and MAC Address hashed separately and leaked separately). These shortcomings are particularly acute in the context of Android, where sensitive identifiers can be combined, processed, and then leaked, in complicated ways. To address these issues, we introduce a novel, algebraic-datatype taint analysis that generates rich yet concise taint signatures involving AND, XOR, hashing – akin to algebraic, product and sum, types. We implemented our approach as a static analysis for Android that derives app leak signatures – an algebraic representation of how, and where, hardware/software identifiers are manipulated before being exfiltrated to the network. We perform six empirical studies of algebraic-datatype taint tracking on 1,000 top apps from Google Play and their embedded libraries, including: discerning between “raw” and hashed flows which eliminates a source of imprecision in current analyses; finding apps and libraries that go against Google Play’s guidelines by (ab)using hardware identifiers; showing that third-party code, rather than app code, is the predominant source of leaks; exposing potential de-anonymization practices; and quantifying how apps have become more privacy-friendly over the past two years.
DOI 原文 ·
@inproceedings{paperbot6373,
title = {Algebraic-datatype taint tracking, with applications to understanding Android identifier leaks},
author = {Sydur Rahaman and Iulian Neamtiu and Xin Yin},
booktitle = {FSE},
year = {2021},
doi = {10.1145/3468264.3468550}
}