TY - GEN
T1 - A study of android application security
AU - Enck, William
AU - Octeau, Damien
AU - McDaniel, Patrick
AU - Chaudhuri, Swarat
PY - 2011/1/1
Y1 - 2011/1/1
N2 - The fluidity of application markets complicate smartphone security. Although recent efforts have shed light on particular security issues, there remains little insight into broader security characteristics of smartphone applications. This paper seeks to better understand smartphone application security by studying 1,100 popular free Android applications. We introduce the ded decompiler, which recovers Android application source code directly from its installation image. We design and execute a horizontal study of smartphone applications based on static analysis of 21 million lines of recovered code. Our analysis uncovered pervasive use/misuse of personal/ phone identifiers, and deep penetration of advertising and analytics networks. However, we did not find evidence of malware or exploitable vulnerabilities in the studied applications. We conclude by considering the implications of these preliminary findings and offer directions for future analysis.
AB - The fluidity of application markets complicate smartphone security. Although recent efforts have shed light on particular security issues, there remains little insight into broader security characteristics of smartphone applications. This paper seeks to better understand smartphone application security by studying 1,100 popular free Android applications. We introduce the ded decompiler, which recovers Android application source code directly from its installation image. We design and execute a horizontal study of smartphone applications based on static analysis of 21 million lines of recovered code. Our analysis uncovered pervasive use/misuse of personal/ phone identifiers, and deep penetration of advertising and analytics networks. However, we did not find evidence of malware or exploitable vulnerabilities in the studied applications. We conclude by considering the implications of these preliminary findings and offer directions for future analysis.
UR - http://www.scopus.com/inward/record.url?scp=85025700509&partnerID=8YFLogxK
UR - http://www.scopus.com/inward/citedby.url?scp=85025700509&partnerID=8YFLogxK
M3 - Conference contribution
T3 - Proceedings of the 20th USENIX Security Symposium
SP - 315
EP - 330
BT - Proceedings of the 20th USENIX Security Symposium
PB - USENIX Association
T2 - 20th USENIX Security Symposium
Y2 - 8 August 2011 through 12 August 2011
ER -