摘要
与传统计算平台相比,移动平台拥有大量涉及用户隐私的私密信息.随着Android移动平台日趋流行和应用商城模式的普及,如何保护用户隐私这一安全性课题日益受到关注.本文发现当前Android日志系统存在泄漏用户隐私数据的安全性风险,设计并实现了一个基于静态信息流分析的Android应用程序检测工具LogMiner,用于辅助应用商城在应用发布时的安全性检测工作.LogMiner对200个Android应用程序进行检测,成功分析177个应用,平均每个应用分析时间为4.3分钟,其中33个应用中存在日志安全性隐患,占总数的18.6%.这一结果表明现实生活中的Android应用程序的确存在着这类安全隐患.最后,本文对现有日志系统提出了改进方案.
Compared to the traditional computing platforms, mobile computing platforms usually contain plenty of private information of users. As the increasing popularity of Android and Android Markets, privacy protection on mobile computing platforms has become a growing concern. However, this paper found the existing Android Logging System is vulnerable to the privacy leakage. To detect such security risk, LogMiner is proposed for Android Markets, which is based on static information flow analysis. The experiment re- sults show that 23 of 200 Android applications log the user sensitive data into the Logging System, and prove that some real-world Android applications do have the logging security risk. Finally, this paper gives some advices to improve the existing Android Log- ging System to get rid of this risk.
出处
《小型微型计算机系统》
CSCD
北大核心
2013年第6期1276-1281,共6页
Journal of Chinese Computer Systems
基金
国家核高基重大专项项目(2009ZX01036-001-003)资助
