1. Enhancing Users’ Comprehension of Android Permissions Liu Yang, Nader Boushehrinejad, Pallab Roy, Vinod Ganapathy, Liviu Iftode Department of Computer Science Rutgers University

2. Android Apps Social networking Gaming Entertainment Communication Transportation Sports … Online shopping

3. Resources on Android

4. App-based Permission Model: An Example This app requests the following resources: Your accounts, your locations, your messages, network communication, your personal information, phone calls, system tools, … (39 permission in total) App installed if user approves the request No install if user rejects the request

5. Users Puzzled by Permissions 3% of users correctly answer three permission questions [ Felt. et al. SOUPS’12, Kelly et al., USEC’12 ] – A lot of permissions defined (134, Android 2.2) – Not always self-explanatory, e.g., SUBSCRIBED_FEEDS_READ, WRITE_SYN_SETTINGS, … Confusion exists for developers [Felt et al. CCS’11]

6. Permission Misuse Locations IMEI Contacts IMEI Phone number com.antiviruscom.kayak.androidcom.taskoscom.kakao.talkcom.myyearbook.m [Hornyack et al., AppFence, CCS’11] [Lin et al., Ubicom’12] Locations: 45/110 apps IMEI: 31/110 apps Contacts: 7/110 apps Phone#: 5/110 apps com.facebook Contacts

7. Our Contribution Enhancing users’ comprehension of permissions using crowdsourcing – Permission usage commented by app users – Permission comments shared among users Designing Droidganger which provides clues of permission usage – Record/replay + permission suppression Feasibility study

8. Architecture Overview Permission comments Comments Processing Server (CPS) Droidganger Permission comments aggregation and presentation Internet

9. Crowdsourcing Users of same apps form user communities Users use Droidganger to help permission understanding Each user reviews one permission (small task) More users – more permissions covered – more execution paths covered – more apps covered

10. Intuition of Droidganger Permission changes Capability changes App behavior changes Q: Behavior changes visible or understandable? Q: How to capture changes? A: Record/replay + permission suppression

11. Overview of Droidganger Record (all permissions granted) Replay (a permission suppressed) Deviation Detection User inputs permission comments Execution trace To Comment Processing Server

12. Record and Replay Record app execution – non-deterministic inputs and events, e.g., keystrokes, touches/drags, etc. (saved as a trace) – outputs, e.g., screenshots, etc. Replay a trace – each time a different permission suppressed – snapshots taken for comparison

13. Deviation Detection Snapshots Record phaseReplay phase Difference detector User comments on detected difference

14. Comment Processing Server Comments grouped by apps and permissions Comments aggregation Comments presented for pubic access

15. Feasibility Study Implementation of Droidganger – Android 4.0 + Emulator – Record: Intercepting KeyEvents and MotionEvents – Compiling events to Python scripts – Replaying scripts with Monkeyrunner Data Sets – AngryBirds Rio (6 permissions) – Antivirus (39 permissions)

16. Observations Pairs of screenshots of AngryBirds (a) Record stage (all requested permissions granted) (b) Replay stage (INTERNET permission suppressed)

17. Observations (cont.) RecordReplay (all requested permissions granted) WRITE_SYNC _SETTINGS permission suppressed

18. Observations (cont.) Summary of observed effects with replay + permission suppression Meaningful: permission suppression provides helpful clues of purposes of permissions Crashed: app crashed due to permission suppression Syslog only: execution deviation was only captured by syslog None: no difference was observed with permission suppression

19. Challenges Network proxy: recording network traffic Randomness, e.g., card games, etc. Non-repeatable execution, e.g., online payments, etc. Application failure when permission suppressed User incentives

20. Comparison to Privacy as Expectations (PAE) [ Lin et al., Ubicomp’12 ] capturing users’ expectations on privacy PAE Our work Goals: improving users’ comprehension of permissions Objects: Access to privacy related resources Permissions requested by apps Techs: Crowdsourcing TaintDroid New interfaces Crowdsourcing Record/replay + Permission suppression

21. Related Work Information flow and permission misuse – AppFence [Hornyack et al., CCS’11] – TaintDroid [Enck et al., OSDI’10] – Permission demystified [Felt et al., CCS’11] Privacy-preserving – Apex [Nauman et al., AsiaCCS’10] – MockDroid [Beresford et al., Hotmobile’11] Permission comprehension and attention – [Felt et al., SOUPS’12], [Kelley et al., USEC’12] – [Lin et al., Ubicom’12]

22. Conclusion Crowdsourcing – Collections of users help each other on permission understanding Record/replay + permission suppression: – Changes of app behavior provide clues of permission usage Feasibility study – Droidganger providing helpful clues on permission usage