research-article

SandTrap: Tracking Information Flows On Demand with Parallel Permissions

Authors:

Alvin R. Lebeck,

Alexander Meijer,

Valentin Pistol,

Landon P. CoxAuthors Info & Claims

MobiSys '18: Proceedings of the 16th Annual International Conference on Mobile Systems, Applications, and Services

Pages 230 - 242

https://doi.org/10.1145/3210240.3210321

Published: 10 June 2018 Publication History

Abstract

The most promising way to improve the performance of dynamic information-flow tracking (DIFT) for machine code is to only track instructions when they process tainted data. Unfortunately, prior approaches to on-demand DIFT are a poor match for modern mobile platforms that rely heavily on parallelism to provide good interactivity in the face of computationally intensive tasks like image processing. The main shortcoming of these prior efforts is that they cannot support an arbitrary mix of parallel threads due to the limitations of page protections.

In this paper, we identify parallel permissions as a key requirement for multithreaded, on-demand native DIFT, and we describe the design and implementation of a system called SandTrap that embodies this approach. Using our prototype implementation, we demonstrate that SandTrap's native DIFT overhead is proportional to the amount of tainted data that native code processes. For example, in the photo-sharing app Instagram, SandTrap's performance is close to baseline (1x) when the app does not access tainted data. When it does, SandTrap imposes a slowdown comparable to prior DIFT systems (~8x).

Supplementary Material

WEBM File (p230-razeen.webm)

Download
71.85 MB

References

[1]

2015. Memory protection keys. https://lwn.net/Articles/643797/. (2015).

[2]

2018. Android Developers - Keeping Your App Responsive. https://developer.android.com/training/articles/perf-anr.html. (2018).

[3]

Andrew Appel and Kai Li. 1991. Virtual Memory Primitives for User Programs. In Proceedings of ASPLOS '91.

Digital Library

[4]

Steven Arzt, Siegfried Rasthofer, Christian Fritz, Eric Bodden, Alexandre Bartel, Jacques Klein, Yves le Traon, Damein Octeau, and Patrick McDaniel. 2014. Flow-Droid: Precice Context, Flow, Field, Object-sensitive and Lifecycle-aware Taint Analysis for Android Apps. In Proceedings of PLDI '14.

Digital Library

[5]

Adam Belay, Andrea Bittau, Ali Mashtizadeh, David Terei, David Mazières, and Christos Kozyrakis. 2012. Dune: Safe User-level Access to Privileged CPU Features. In Proceedings of OSDI '12.

Digital Library

[6]

Andrea Bittau, Petr Marchenko, Mark Handley, and Brad Karp. 2008. Wedge: Splitting Applications into Reduced-privilege Compartments. In Proceedings of NSDI '08.

Digital Library

[7]

Erik Bosman, Asia Slowinska, and Herbert Bos. 2011. Minemu: The World's Fastest Taint Tracker. In Proceedings of RAID '11.

Digital Library

[8]

Yaohui Chen, Sebassujeen Reymondjohnson, Zhichuang Sun, and Long Lu. 2016. Shreds: Fine-Grained Execution Units with Private Memory. In Proceedings of IEEE SP '16.

[9]

James Clause, Wanchun Li, and Alessandro Orso. 2007. Dytan: A Generic Dynamic Taint Analysis Framework. In Proceedings of ISSTA '07.

Digital Library

[10]

Landon P. Cox, Peter Gilbert, Geoffrey Lawler, Valentin Pistol, Ali Razeen, Bi Wu, and Sai Cheemalapati. 2014. SpanDex: Secure Password Tracking for Android. In Proceedings of USENIX Security '14.

Digital Library

[11]

David Devecsery, Peter M. Chen, Jason Flinn, and Satish Narayanasamy. 2018. Optimistic Hybrid Analysis: Accelerating Dynamic Analysis Through Predicated Static Analysis. In Proceedings of ASPLOS '18 (ASPLOS '18).

Digital Library

[12]

Xiaowan Dong, Sandhya Dwarkadas, and Alan L. Cox. 2016. Shared Address Translation Revisited. In Proceedings of EuroSys '16.

Digital Library

[13]

Petros Efstathopoulos, Maxwell Krohn, Steve VanDeBogart, Cliff Frey, David Ziegler, Eddie Kohler, David Mazières, Frans Kaashoek, and Robert Morris. 2005. Labels and Event Processes in the Asbestos Operating System. In Proceedings of SOSP '05.

Digital Library

[14]

Manuel Egele, Christopher Kruegel, Engin Kirda, and Giovanni Vigna. 2011. PiOS: Detecting Privacy Leaks in iOS Applications. In Proceedings of NDSS '11.

[15]

William Enck, Peter Gilbert, Byung-Gon Chun, Landon P. Cox, Jaeyeon Jung, Patrick McDaniel, and Anmol N. Sheth. 2010. TaintDroid: An Information-Flow Tracking system for Realtime Privacy Monitoring on Smartphones. In Proceedings of OSDI '10.

Digital Library

[16]

WesLee Frisby, Benjamin Moench, Benjamin Recht, and Thomas Ristenpart. 2012. Security Analysis of Smartphone Point-of-Sale Systems. In Proceedings of WOOT '12.

Digital Library

[17]

Peter Gilbert, Jaeyong Jung, Kyungmin Lee, Henry Qin, Daniel Sharkey, Anmol Sheth, and Landon P. Cox. 2011. YouProve: Authenticity and Fidelity in Mobile Sensing. In Proceedings of SenSys '11.

Digital Library

[18]

Cosmin Gorgovan, Amanieu d'Antras, and Mikel Luján. 2016. MAMBO: A Low-Overhead Dynamic Binary Modification Tool for ARM. ACM Trans. Archit. Code Optim. 13, 1, Article 14 (April 2016), 14:1--14:26 pages.

Digital Library

[19]

Joseph L. Greathouse, Hongyi Xin, Yixin Luo, and Todd Austin. 2012. A Case for Unlimited Watchpoints. In Proceedings of ASPLOS '12.

Digital Library

[20]

Alex Ho, Michael Fetterman, Christopher Clark, Andrew Warfield, and Steven Hand. 2006. Practical Taint-Based Protection using Demand Emulation. In Proceedings of EuroSys '06.

Digital Library

[21]

Terry Ching-Hsiang Hsu, Kevin Hoffman, Patrick Eugster, and Mathis Payer. 2016. Enforcing Lease Privilege Memory Views for Multithreaded Applications. In Proceedings of CCS '16.

Digital Library

[22]

Min Gyung Kang, Stephen McCamant, Pongsin Poosankam, and Dawn Song. 2011. DTA++: Dynamic Taint Analysis with Targeted Control-Flow Propagation. In Proceedings of NDSS '11.

[23]

Maxwell Krohn, Alexander Yip, Micah Brodsky, Natan Cliffer, M. Frans Kaashoek, Eddie Kohler, and Robert Morris. 2007. Information Flow Control for Standard OS Abstractions. In Proceedings of SOSP '07.

Digital Library

[24]

James Litton, Anjo Vahldiek-Oberwagner, Eslam Elnikety, Deepak Garg, Bobby Bhattacharjee, and Peter Druschel. 2016. Light-weight Contexts: An OS Abstraction for Safety and Performance. In Proceedings of OSDI '16.

Digital Library

[25]

James Newsome and Dawn Song. 2005. Dynamic Taint Analysis for Automatic Detection, Analysis, and Signature Generation of Exploits on Commodity Software. In Proceedings of NDSS '05.

[26]

Chenxiong Qian, Xiapu Luo, Yuru Shao, and Alvin T.S. Chan. 2014. On Tracking Information Flows through JNI in Android Applications. In Proceedings of DSN '14.

Digital Library

[27]

Feng Qin, Cheng Wang, Zhenmin Li, Ho-seop Kim, Yuanyuan Zhou, and Youfeng Wu. 2006. LIFT: A Low-Overhead Practical Information Flow Tracking System for Detecting Security Attacks. In Proceedings of MICRO '06.

Digital Library

[28]

Andrew Quinn, David Devecsery, Peter M. Chen, and Jason Flinn. 2016. JetStream: Cluster-Scale Parallelization of Information Flow Queries. In Proceedings of OSDI '16.

Digital Library

[29]

Lenin Ravindranath, Jitendra Padhye, Sharad Agarwal, Ratul Mahajan, Ian Obermiller, and Shahin Shayandeh. 2012. AppInsight: Mobile App Performance Monitoring in the Wild. In Proceedings of OSDI '12.

Digital Library

[30]

Ali Razeen, Valentin Pistol, Alexander Meijer, and Landon P. Cox. 2016. Better Performance Through Thread-local Emulation. In Proceedings of HotMobile '16.

Digital Library

[31]

Haichen Shen, Aruna Balasubramanian, Anthony LaMarca, and David Wetherall. 2015. Enhancing Mobile Apps To Use Sensor Hubs Without Programmer Effort. In Proceedings of UbiComp '15.

Digital Library

[32]

Riley Spahn, Jonathan Bell, Michael Z. Lee, Sravan Bhamidipati, Roxana Geambasu, and Geil Kaiser. 2014. Pebbles: Fine-Grained Data Management Abstractions for Modern Operating Systems. In Proceedings of OSDI '14.

Digital Library

[33]

Mingshen Sun, Tao Wei, and John C.S. Lui. 2016. TaintART: A Practical Multilevel Information-Flow Tracking System for Android RunTime. In Proceedings of CCS '16.

Digital Library

[34]

Yang Tang, Phillip Ames, Sravan Bhamidipati, Ashish Bijlani, Roxana Geambasu, and Nikhil Sarda. 2012. Clean OS: Limiting Mobile Data Exposure with Idle Eviction. In Proceedings of OSDI '12.

Digital Library

[35]

Emmett Witchel, Josh Cates, and Krste Asanović. 2002. Mondrian Memory Protection. In Proceedings of ASPLOS '02.

Digital Library

[36]

Jonathan Woodruff, Robert N.M. Watson, David Chisnall, Simon W. Moore, Jonathan Anderson, Brooks Davis, Ben Laurie, Peter G. Neumann, Robert Norton, and Michael Roe. 2014. The CHERI Capability Model: Revisiting RISC in an Age of Risk. In Proceedings of ISCA '14.

Digital Library

[37]

Lok Kwong Yan and Heng Yin. 2012. DroidScope: Seamlessly Reconstructing the OS and Dalvik Semantic Views for Dynamic Android Malware Analysis. In Proceedings of USENIX Security '12.

Digital Library

[38]

Nickolai Zeldovich, Silas Boyd-Wickizer, Eddie Kohler, and David Mazières. 2006. Making Information Flow Explicit in HiStar. In Proceedings of OSDI '06.

Digital Library

[39]

Yajin Zhou, Xiaoguang Wang, Yue Chen, and Zhi Wang. 2014. ARMlock: Hardware-based Fault Isolation for ARM. In Proceedings of CCS '14.

Digital Library

Cited By

Graux PLalande JViet Triem Tong VWilke P(2023)OATs’inside: Retrieving Object Behaviors From Native-based Obfuscated Android ApplicationsDigital Threats: Research and Practice10.1145/35849754:2(1-27)Online publication date: 10-Aug-2023
https://dl.acm.org/doi/10.1145/3584975
Novak EAung PDo T(2020)VPN+ Towards Detection and Remediation of Information Leakage on Smartphones2020 21st IEEE International Conference on Mobile Data Management (MDM)10.1109/MDM48529.2020.00025(39-48)Online publication date: Jun-2020
https://doi.org/10.1109/MDM48529.2020.00025
Wang FKo RMickens JLorch JYu M(2019)RiverbedProceedings of the 16th USENIX Conference on Networked Systems Design and Implementation10.5555/3323234.3323285(615-629)Online publication date: 26-Feb-2019
https://dl.acm.org/doi/10.5555/3323234.3323285
Show More Cited By

Index Terms

SandTrap: Tracking Information Flows On Demand with Parallel Permissions

Recommendations

Benchmark Dalvik and Native Code for Android System
IBICA '11: Proceedings of the 2011 Second International Conference on Innovations in Bio-inspired Computing and Applications

Google's Android Native Development Kit (NDK) is a toolset that lets you embed components to use of native code in your Android applications. It makes possible for developers to easily compile in C/C++ for the Android development platform. Generally, ...
Cross-language Android permission specification
ESEC/FSE 2022: Proceedings of the 30th ACM Joint European Software Engineering Conference and Symposium on the Foundations of Software Engineering

The Android system manages access to sensitive APIs by permission enforcement. An application (app) must declare proper permissions before invoking specific Android APIs. However, there is no official documentation providing the complete list of ...
Lightweight, obfuscation-resilient detection and family identification of Android malware
ICSE '18: Proceedings of the 40th International Conference on Software Engineering

The number of malicious Android apps has been and continues to increase rapidly. These malware can damage or alter other files or settings, install additional applications, obfuscate their behaviors, propagate quickly, and so on. To identify and handle ...

Comments

Information & Contributors

Information

Published In

cover image ACM Conferences

MobiSys '18: Proceedings of the 16th Annual International Conference on Mobile Systems, Applications, and Services

June 2018

560 pages

ISBN:9781450357203

DOI:10.1145/3210240

Copyright © 2018 ACM.

Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. Copyrights for components of this work owned by others than the author(s) must be honored. Abstracting with credit is permitted. To copy otherwise, or republish, to post on servers or to redistribute to lists, requires prior specific permission and/or a fee. Request permissions from [email protected].

Sponsors

SIGMOBILE: ACM Special Interest Group on Mobility of Systems, Users, Data and Computing

In-Cooperation

SIGOPS: ACM Special Interest Group on Operating Systems

Publisher

Association for Computing Machinery

New York, NY, United States

Publication History

Published: 10 June 2018

Permissions

Request permissions for this article.

Request Permissions

Check for updates

Author Tags

Qualifiers

Research-article
Research
Refereed limited

Conference

MobiSys '18

Sponsor:

SIGMOBILE

MobiSys '18: The 16th Annual International Conference on Mobile Systems, Applications, and Services

June 10 - 15, 2018

Munich, Germany

Acceptance Rates

Overall Acceptance Rate 274 of 1,679 submissions, 16%

Contributors

Other Metrics

View Article Metrics

Bibliometrics & Citations

Bibliometrics

Article Metrics

4
Total Citations
View Citations
244
Total Downloads

Downloads (Last 12 months)6
Downloads (Last 6 weeks)1

Reflects downloads up to 10 Feb 2025

Other Metrics

View Author Metrics

Citations

Cited By

Graux PLalande JViet Triem Tong VWilke P(2023)OATs’inside: Retrieving Object Behaviors From Native-based Obfuscated Android ApplicationsDigital Threats: Research and Practice10.1145/35849754:2(1-27)Online publication date: 10-Aug-2023
https://dl.acm.org/doi/10.1145/3584975
Novak EAung PDo T(2020)VPN+ Towards Detection and Remediation of Information Leakage on Smartphones2020 21st IEEE International Conference on Mobile Data Management (MDM)10.1109/MDM48529.2020.00025(39-48)Online publication date: Jun-2020
https://doi.org/10.1109/MDM48529.2020.00025
Wang FKo RMickens JLorch JYu M(2019)RiverbedProceedings of the 16th USENIX Conference on Networked Systems Design and Implementation10.5555/3323234.3323285(615-629)Online publication date: 26-Feb-2019
https://dl.acm.org/doi/10.5555/3323234.3323285
Yao ZMirzamohammadi SAmiri Sani APayer MLie DMannan MBackes MWang X(2018)MilkomedaProceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security10.1145/3243734.3243772(1455-1469)Online publication date: 15-Oct-2018
https://dl.acm.org/doi/10.1145/3243734.3243772

View Options

Login options

Check if you have access through your login credentials or your institution to get full access on this article.

Full Access

Get this Publication

View options

PDF

View or Download as a PDF file.

eReader

View online with eReader.

Figures

Tables

Media

View Table of Conten