多维度iOS隐私泄露评估模型研究

doi:10.11959/j.issn.2096-109x.2016.00043

Abstract

Abstract:

The existing iOS platform is lacking ofsystematic assessment methods of privacy leak detection.To solve this problem,a multi-dimensional iOSprivacy disclosure evaluation model was presented.This model combined static analysis,dynamic analysis and network data analysis method to extract the features of the application’s pri-vacy disclosure behavior and evaluate it form multiple dimensions way.The model on 30 different types of apps from the iOS App Store and found out that more than 50% of all investigated apps aretracking users’ locations were evaluated,almost 40% of all send data to a server without the user’s consent.The model makes up for the limitations of single static analysis or dynamic analysis methods,solves the quantization problem of privacy disclosure effectively.

Key words: iOS, privacy disclosure, static analysis, dynamic analysis, network data analysis

CLC Number:

TN929.53

Yue-xiu XING,Ai-qun HU,Yong-jian WANG,Ran ZHAO. Research on multi-dimensional iOS privacy disclosure evaluation model[J]. Chinese Journal of Network and Information Security, 2016, 2(4): 73-79.

Figures/Tables 7

References 14

[1]	Smartphone OS market share,2015 Q2[EB/OL]. .
[2]	EGELE M , KRUEGEL C , KIRDA E , et al . PiOS:detecting privacy leaks in iOS applications[C]// NDSS.c 2011:289-291.
[3]	GILBERT P , CHUN B G , LANDON P , et al . Automating privacy testing of smartphone applications:technical report:CS-2011-02[R]. Duke University, 2011.
[4]	KURTZ A , WEINLEIN A , SETTGAST C , et al . DiOS:dynamic privacy analysis of iOS applications:friedrich-alexander-universit?t erlangen-nürnberg,dept of computer science,CS-2014-03[R]. 2014.
[5]	PENG L , CUI B J . A comparative study on software vulnerability static analysis techniques and tools[C]// Information Theory and In-formation Security.c 2010:521-524.
[6]	EPIFANI M , PASQUALE S . Learning iOS Forensics[M]// Bir-mingham:Packt Publishing Ltd, 2015:153-170.
[7]	iOS developer library[EB/OL]. .
[8]	NYGARD S . Class-dump[EB/OL] Managerial Finance, .
[9]	AGARWAL Y , HALL M . Protect my privacy:detecting and miti-gating privacy leaks on iOS devices using crowdsourcing[C]// The Intemational Conference on Mobile Systems,Application,and Ser-vices.c 2013:97-110.
[10]	Dumpdecrypted[EB/OL]. .
[11]	FairPlay[EB/OL]. .
[12]	Hopper[EB/OL]. .
[13]	FREEMAN J . Mobile substrate[EB/OL]. .
[14]	Tshark[EB/OL]. .

Metrics

Recommended 0

No Suggested Reading articles found!

隐私API分类	关键API函数举例	函数说明
定位服务API （Location API）	-(void)requestWhenInUseAuthorization	程序前台运行时请求使用定位服务
通讯录API（Contacts API）	-(void)requestAccessForEntityType:(CNEntityType)entityTypecompletionHandler:(void(^)(BOOL granted,NSError*error)) completionHandler	请求访问通讯录
日历和提醒事项API （Calendar API）	-(void)requestAccessToEntityType:(EKEntityType)entityType completion:(EKEventStoreRequest AccessCompletionHandler)completion	请求访问日历和提醒事项的用户权限
照片API（Photo API）	+(void)requestAuthorization:(void(^)(PHAuthorizationStatus status))handler	请求访问照片库的用户权限
麦克风API（Microphone API）	-(void)requestRecordPermission:(PermissionBlock)response	请求使用麦克风
相机API（Camera API）	+(instancetype)deviceInputWithDevice:(AVCaptureDevice )device error:(NSError *)outError	捕获设备输入
健康API（Health API）	-(void)requestAuthorizationToShareTypes:(NSSet＜HKSampleType ＞ )typesToSharereadTypes:(NSSet＜HKO bjectType ＞ )typesToRead completion:(void(^)(BOOL success,NSError*error)) completion	请求访问健康数据
社交账户API （Social API）	-(void)requestAccessToAccountsWithType:(ACAccountType )accountType options:(N Diction-ary )optionscompletion:(ACAccountStoreRequestAccessCompletionHandler)completion	请求访问社交账户数据
本机信息API（Nativeinfo API）	extern NSString* CTSettingCopyMyPhoneNumber()	获取本机号码

分析方法	类别	权重值	备注
	查看授权状态API	1	/
静态分析	申请授权API	3	/
	读写API	5	/
	查看授权状态API	6	/
动态分析	申请授权API	8	/
	读写API	10	/
	泄露行为1)	/	App[i]_Risk=100%
	泄露行为2)	15	/
网络数据分析
	泄露行为3)	/	App[i]_Risk=100%
	泄露行为4)	15	/

设备	配置描述
计算机CPU	Intel Core i5 2.4 GHz
计算机内存	8 GB 1 600 MHz DDR3
计算机操作系统	OS X Yosemite 10.10.1
iOS手机版本	iOS 8.3
iOS手机内存	1 024 MB

分析方法	隐私API分类	API函数			隐私泄露行为	权重值
分析方法	隐私API分类	类别		个数	隐私泄露行为	权重值
	定位服务API	A,B,C		1,2,1	/	12
	通讯录API	A,B		1,1	/	8
	日历和提醒事务API	/		/	/	/
	图片API	A,B,C		1,1,1,	/	9
静态分析	麦克风API	B		1	/	3
	相机API	A,B,C		1,1,1	/	9
	健康API	/		/	/	/
	社交API	A		1	/	5
	本机API	/		/	/	/
	定位服务API	A,B,C		1,2,1	/	32
	通讯录API	A,B,C		1,1,1	/	24
	日历和提醒事务API	/		/	/	/
	图片API	A,B,C		1,1,1	/	24
动态分析	麦克风API	B		1	/	8
	相机API	A,B,C		1,1,1	/	24
	健康API	/		/	/	/
	社交API	A,B		1,1	/	18
	本机API	A		2	/	20
	/		/		行为1)不存在	/
网络数据分析	//		//		行为2) 不存在行为3) 不存在	//
	/		/		行为4) 存在	15

Research on multi-dimensional iOS privacy disclosure evaluation model

RichHTML

PDF下载

Knowledge

Abstract

Cite this article

share this article

Figures/Tables 7

References 14

Related Articles 10

Metrics

Recommended 0

[1]	Fan CHAO, Zhi YANG, Xuehui DU, Bing HAN. Classified risk assessment method of Android application based on multi-factor clustering selection [J]. Chinese Journal of Network and Information Security, 2021, 7(2): 161-173.
[2]	Tianyu ZHOU,Wenbo SHEN,Nanzi YANG,Jinku LI,Chenggang QIN,Wang YU. Analysis of DoS attacks on Docker inter-component stdio copy [J]. Chinese Journal of Network and Information Security, 2020, 6(6): 45-56.
[3]	Fan CHAO,Zhi YANG,Xuehui DU,Yan SUN. Android malware detection method based on deep neural network [J]. Chinese Journal of Network and Information Security, 2020, 6(5): 67-79.
[4]	Xiaokang YIN,Liu LIU,Long LIU,Shengli LIU. Function argument number identification in stripped binary under PPC and MIPS instruction set [J]. Chinese Journal of Network and Information Security, 2020, 6(4): 95-103.
[5]	Da XIAO,Bohan LIU,Baojiang CUI,Xiaochen WANG,Suoxing ZHANG. Malware prediction technique based on program gene [J]. Chinese Journal of Network and Information Security, 2018, 4(8): 21-30.
[6]	Qing LI,Ayong YE,Zhiqiang YAO,Aimin CHEN. RAP detection method based on AP fingerprint [J]. Chinese Journal of Network and Information Security, 2018, 4(5): 55-61.
[7]	Dong ZHANG,Yao ZHANG,Gang LIU,Gui-xiang SONG. Research on host malcode detection using machine learning [J]. Chinese Journal of Network and Information Security, 2017, 3(7): 25-32.
[8]	Yi-lin YE,Zhen-ji ZHOU,Zheng HONG,Hui-ying YAN,Li-fa WU. Static-analysis-based event input generation approach for Android application [J]. Chinese Journal of Network and Information Security, 2017, 3(6): 21-32.
[9]	Bo-wen SUN,Yan-yi HUANG,Qiao-kun WEN,Bin TIAN,Peng WU,Qi LI. Malware classification method based on static multiple-feature fusion [J]. Chinese Journal of Network and Information Security, 2017, 3(11): 68-76.
[10]	Jia CHEN,Shan-qing1 GUO. Toward discovering and exploiting private server-side Web API [J]. Chinese Journal of Network and Information Security, 2016, 2(12): 27-38.