Research On Detecting Privacy Leaks In Android Hybrid Applications Based On Dynamic Taint Tracking

In the era of mobile Internet, Android smart devices have become an integral part of our lives and are heavily relied on by millions of People. A lot of personal privacy data store in them, such as contacts, call history, text messages and photos. People are very concerned about whether their privacy will be compromised.Android native software appeared earlier and their software architecture is mature. A lot of research about privacy leak detection in Android native applications have been accumulated. While with Android smart devices performance improvements, HTML5 moible web technology developments and mobile browser engine performance improvments, Android hybrid applications build with a new Android application architecture emerged and became more and more popular. Android hybrid applications have novel software architecture and the bridge between Java and JavaScript layers diminishes the gaps between the native and web environments. As hybrid applications are different from native applications, the new privacy leak problems in hybrid application need be studied. The bridge mechanism enables Android hybrid applications leak privacy data through JavaScript code. And few systems can detect the privacy leak in Android hybrid applications through JavaScript code currently.Scenarios where privacy leak occurs in Android hybrid applications and the details that how privacy data spread in Dalvik Virtual Machine, WebKit engine and JavaScript engine are systematically studied. HTDroid, an efficient dynamic taint tracking system for detecting privacy leak through JavaScript code in Android hybrid application is newly proposed and implemented. HTDroid system reuses the dynamic taint tracking in Dalvik Virtual Machine of TaintDroid system and then transmits the taint tags of string datatype privacy data in Dalvik Virtual Machine to Web Kit engine and JavaScript engine. And it implements dynamic taint tracking in WebKit engine and JavaScript engine. HTDroid incurs only 22% performance overhead on a CPU-bound benchmark and imposes 4.3% overhead on JavaScript V8 engine benchmark.