Paper Info
Title
What the App is That? Deception and Countermeasures in the Android User Interface
Abstract
Mobile applications are part of the everyday lives of billions of people, who often trust them with sensitive information. These users identify the currently focused app solely by its visual appearance, since the GUIs of the most popular mobile OSes do not show any trusted indication of the app origin. In this paper, we analyze in detail the many ways in which Android users can be confused into misidentifying an app, thus, for instance, being deceived into giving sensitive information to a malicious app. Our analysis of the Android platform APIs, assisted by an automated state-exploration tool, led us to identify and categorize a variety of attack vectors (some previously known, others novel, such as a non-escapable full screen overlay) that allow a malicious app to surreptitiously replace or mimic the GUI of other apps and mount phishing and click-jacking attacks. Limitations in the system GUI make these attacks significantly harder to notice than on a desktop machine, leaving users completely defenseless against them. To mitigate GUI attacks, we have developed a two-layer defense. To detect malicious apps at the market level, we developed a tool that uses static analysis to identify code that could launch GUI confusion attacks. We show how this tool detects apps that might launch GUI attacks, such as ransom ware programs. Since these attacks are meant to confuse humans, we have also designed and implemented an on-device defense that addresses the underlying issue of the lack of a security indicator in the Android GUI. We add such an indicator to the system navigation bar, this indicator securely informs users about the origin of the app with which they are interacting (e.g., The Pay Pal app is backed by "Pay Pal, Inc."). We demonstrate the effectiveness of our attacks and the proposed on-device defense with a user study involving 308 human subjects, whose ability to detect the attacks increased significantly when using a system equipped with our defense.
Year
DOI
Venue
2015
10.1109/SP.2015.62
2015 IEEE Symposium on Security and Privacy
Keywords
Field
DocType
mobile-security,usable-security,static-analysis
Internet privacy,World Wide Web,Android (operating system),Phishing,Deception,Navigation bar,Computer science,Computer security,Graphical user interface,Information sensitivity,User interface,Visual appearance
Conference
ISSN
Citations 
PageRank 
1081-6011
44
1.40
References 
Authors
26
6
Name
Order
Citations
PageRank
Antonio Bianchi135113.41
Jacopo Corbetta2461.79
Luca Invernizzi327514.27
Yanick Fratantonio463827.12
Christopher Kruegel58799516.05
Giovanni Vigna67121507.72