Analyzing HTTP-Based Information Exfiltration of Malicious Android Applications

Soham Kelkar; Timothy Kraus; Daria Morgan; Junjie Zhang; Rui Dai

doi:10.1109/TrustCom/BigDataSE.2018.00242

Analyzing HTTP-Based Information Exfiltration of Malicious Android Applications

Soham Kelkar, Timothy Kraus, Daria Morgan, Junjie Zhang, Rui Dai

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution

Abstract

Exfiltrating sensitive information from smartphones has become one of the most significant security threats. We have built a system to identify HTTP-based information exfiltration of malicious Android applications. In this paper, we discuss the method to track the propagation of sensitive information in Android applications using static taint analysis. We have studied the leaked information, destinations to which information is exfiltrated, and their correlations with types of sensitive information. The analysis results based on 578 malicious Android applications have revealed that a significant portion of these applications are interested in identity-related sensitive information. The vast majority of malicious applications leak multiple types of sensitive information. We have also identified servers associated with three country codes including CN, US, and SG are most active in collecting sensitive information. The analysis results have also demonstrated that a wide range of non-default ports are used by suspicious URLs.

Original language	English
Title of host publication	2018 17th IEEE International Conference On Trust, Security And Privacy In Computing And Communications/ 12th IEEE International Conference On Big Data Science And Engineering (TrustCom/BigDataSE)
Publisher	IEEE
Pages	1642-1645
Number of pages	4
ISBN (Electronic)	978-1-5386-4388-4
ISBN (Print)	978-1-5386-4389-1
DOIs	https://doi.org/10.1109/TrustCom/BigDataSE.2018.00242
State	Published - Sep 5 2018
Externally published	Yes
Event	17th IEEE International Conference on Trust, Security and Privacy in Computing and Communications and 12th IEEE International Conference on Big Data Science and Engineering, Trustcom/BigDataSE 2018 - New York, United States Duration: Jul 31 2018 → Aug 3 2018

Conference

Conference	17th IEEE International Conference on Trust, Security and Privacy in Computing and Communications and 12th IEEE International Conference on Big Data Science and Engineering, Trustcom/BigDataSE 2018
Country/Territory	United States
City	New York
Period	7/31/18 → 8/3/18

ASJC Scopus Subject Areas

Computer Networks and Communications
Hardware and Architecture
Information Systems
Information Systems and Management
Safety, Risk, Reliability and Quality

Keywords

Android Applications
HTTP Based
Information Exfiltration

Disciplines

Computer Sciences
Engineering

Access to Document

10.1109/TrustCom/BigDataSE.2018.00242License: Unspecified

Cite this

Kelkar, S., Kraus, T., Morgan, D., Zhang, J., & Dai, R. (2018). Analyzing HTTP-Based Information Exfiltration of Malicious Android Applications. In 2018 17th IEEE International Conference On Trust, Security And Privacy In Computing And Communications/ 12th IEEE International Conference On Big Data Science And Engineering (TrustCom/BigDataSE) (pp. 1642-1645). Article 8456110 IEEE. https://doi.org/10.1109/TrustCom/BigDataSE.2018.00242

Analyzing HTTP-Based Information Exfiltration of Malicious Android Applications. / Kelkar, Soham; Kraus, Timothy; Morgan, Daria et al.
2018 17th IEEE International Conference On Trust, Security And Privacy In Computing And Communications/ 12th IEEE International Conference On Big Data Science And Engineering (TrustCom/BigDataSE). IEEE, 2018. p. 1642-1645 8456110.

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution

Kelkar, S, Kraus, T, Morgan, D, Zhang, J & Dai, R 2018, Analyzing HTTP-Based Information Exfiltration of Malicious Android Applications. in 2018 17th IEEE International Conference On Trust, Security And Privacy In Computing And Communications/ 12th IEEE International Conference On Big Data Science And Engineering (TrustCom/BigDataSE)., 8456110, IEEE, pp. 1642-1645, 17th IEEE International Conference on Trust, Security and Privacy in Computing and Communications and 12th IEEE International Conference on Big Data Science and Engineering, Trustcom/BigDataSE 2018, New York, United States, 7/31/18. https://doi.org/10.1109/TrustCom/BigDataSE.2018.00242

Kelkar S, Kraus T, Morgan D, Zhang J, Dai R. Analyzing HTTP-Based Information Exfiltration of Malicious Android Applications. In 2018 17th IEEE International Conference On Trust, Security And Privacy In Computing And Communications/ 12th IEEE International Conference On Big Data Science And Engineering (TrustCom/BigDataSE). IEEE. 2018. p. 1642-1645. 8456110 doi: 10.1109/TrustCom/BigDataSE.2018.00242

@inproceedings{e8ad418522e7446b9e3fef17dde682ea,

title = "Analyzing HTTP-Based Information Exfiltration of Malicious Android Applications",

abstract = " Exfiltrating sensitive information from smartphones has become one of the most significant security threats. We have built a system to identify HTTP-based information exfiltration of malicious Android applications. In this paper, we discuss the method to track the propagation of sensitive information in Android applications using static taint analysis. We have studied the leaked information, destinations to which information is exfiltrated, and their correlations with types of sensitive information. The analysis results based on 578 malicious Android applications have revealed that a significant portion of these applications are interested in identity-related sensitive information. The vast majority of malicious applications leak multiple types of sensitive information. We have also identified servers associated with three country codes including CN, US, and SG are most active in collecting sensitive information. The analysis results have also demonstrated that a wide range of non-default ports are used by suspicious URLs.",

keywords = "Android Applications, HTTP Based, Information Exfiltration",

author = "Soham Kelkar and Timothy Kraus and Daria Morgan and Junjie Zhang and Rui Dai",

note = "Publisher Copyright: {\textcopyright} 2018 IEEE.; 17th IEEE International Conference on Trust, Security and Privacy in Computing and Communications and 12th IEEE International Conference on Big Data Science and Engineering, Trustcom/BigDataSE 2018 ; Conference date: 31-07-2018 Through 03-08-2018",

year = "2018",

month = sep,

day = "5",

doi = "10.1109/TrustCom/BigDataSE.2018.00242",

language = "English",

isbn = "978-1-5386-4389-1",

pages = "1642--1645",

booktitle = "2018 17th IEEE International Conference On Trust, Security And Privacy In Computing And Communications/ 12th IEEE International Conference On Big Data Science And Engineering (TrustCom/BigDataSE)",

publisher = "IEEE",

}

TY - GEN

T1 - Analyzing HTTP-Based Information Exfiltration of Malicious Android Applications

AU - Kelkar, Soham

AU - Kraus, Timothy

AU - Morgan, Daria

AU - Zhang, Junjie

AU - Dai, Rui

PY - 2018/9/5

Y1 - 2018/9/5

N2 - Exfiltrating sensitive information from smartphones has become one of the most significant security threats. We have built a system to identify HTTP-based information exfiltration of malicious Android applications. In this paper, we discuss the method to track the propagation of sensitive information in Android applications using static taint analysis. We have studied the leaked information, destinations to which information is exfiltrated, and their correlations with types of sensitive information. The analysis results based on 578 malicious Android applications have revealed that a significant portion of these applications are interested in identity-related sensitive information. The vast majority of malicious applications leak multiple types of sensitive information. We have also identified servers associated with three country codes including CN, US, and SG are most active in collecting sensitive information. The analysis results have also demonstrated that a wide range of non-default ports are used by suspicious URLs.

AB - Exfiltrating sensitive information from smartphones has become one of the most significant security threats. We have built a system to identify HTTP-based information exfiltration of malicious Android applications. In this paper, we discuss the method to track the propagation of sensitive information in Android applications using static taint analysis. We have studied the leaked information, destinations to which information is exfiltrated, and their correlations with types of sensitive information. The analysis results based on 578 malicious Android applications have revealed that a significant portion of these applications are interested in identity-related sensitive information. The vast majority of malicious applications leak multiple types of sensitive information. We have also identified servers associated with three country codes including CN, US, and SG are most active in collecting sensitive information. The analysis results have also demonstrated that a wide range of non-default ports are used by suspicious URLs.

KW - Android Applications

KW - HTTP Based

KW - Information Exfiltration

UR - http://www.scopus.com/inward/record.url?scp=85054056418&partnerID=8YFLogxK

UR - http://www.scopus.com/inward/citedby.url?scp=85054056418&partnerID=8YFLogxK

UR - https://corescholar.libraries.wright.edu/cse/524

U2 - 10.1109/TrustCom/BigDataSE.2018.00242

DO - 10.1109/TrustCom/BigDataSE.2018.00242

M3 - Conference contribution

SN - 978-1-5386-4389-1

SP - 1642

EP - 1645

BT - 2018 17th IEEE International Conference On Trust, Security And Privacy In Computing And Communications/ 12th IEEE International Conference On Big Data Science And Engineering (TrustCom/BigDataSE)

PB - IEEE

T2 - 17th IEEE International Conference on Trust, Security and Privacy in Computing and Communications and 12th IEEE International Conference on Big Data Science and Engineering, Trustcom/BigDataSE 2018

Y2 - 31 July 2018 through 3 August 2018

ER -

Analyzing HTTP-Based Information Exfiltration of Malicious Android Applications

Abstract

Conference

ASJC Scopus Subject Areas

Keywords

Disciplines

Access to Document

Other files and links

Cite this