No Privacy Among Spies: Assessing the Functionality and Insecurity of Consumer Android Spyware Apps
No Privacy Among Spies: Assessing the Functionality and Insecurity of Consumer Android Spyware Apps
复制标题
DOI：
10.56553/popets-2023-0013
复制
发表时间：
2023-01
期刊：
影响因子：
--
通讯作者：
Enze Liu;S. Rao;S. Havron;Grant Ho;S. Savage;Geoff Voelker;Damon McCoy
中科院分区：
文献类型：
--
作者：
Enze Liu;S. Rao;S. Havron;Grant Ho;S. Savage;Geoff Voelker;Damon McCoy
消费者移动间谍软件应用程序暗中监视用户的活动（即短信，电话，电子邮件，位置等），并通过互联网传输这些信息以支持远程监视。与概念上类似的用于国家间谍活动的应用程序不同，所谓的“跟踪软件”应用程序以零售的方式向消费者大规模销售，并使更广泛的受害者暴露在侵入性监控之下。如今，这类应用的市场已经大到足以支持数十家竞争对手，据报道，个别供应商监控着数十万部手机。然而，虽然研究界很清楚这些应用程序的存在，但我们对它们运行机制的理解仍然是临时的。在这项工作中，我们对针对Android手机的14种不同的领先移动间谍软件应用程序进行了深入的技术分析。我们记录了用于监控各种用户活动（例如，照片，短信，实时麦克风访问）的机制范围-主要是通过创造性地滥用Android api。我们还发现了这些应用用来躲避检测和实现持久化的以前未记录的方法。此外，我们记录了每个应用程序为保护其收集的敏感数据的隐私而采取的措施，确定了间谍软件供应商的一系列失误（包括以明文方式发送的隐私敏感数据或在很少或没有保护的情况下存储在云中）。
Consumer mobile spyware apps covertly monitor a user's activities (i.e., text messages, phone calls, e-mail, location, etc.) and transmit that information over the Internet to support remote surveillance. Unlike conceptually similar apps used for state espionage, so-called "stalkerware" apps are mass-marketed to consumers on a retail basis and expose a far broader range of victims to invasive monitoring. Today the market for such apps is large enough to support dozens of competitors, with individual vendors reportedly monitoring hundreds of thousands of phones. However, while the research community is well aware of the existence of such apps, our understanding of the mechanisms they use to operate remains ad hoc. In this work, we perform an in-depth technical analysis of 14 distinct leading mobile spyware apps targeting Android phones. We document the range of mechanisms used to monitor user activity of various kinds (e.g., photos, text messages, live microphone access) — primarily through the creative abuse of Android APIs. We also discover previously undocumented methods these apps use to hide from detection and to achieve persistence. Additionally, we document the measures taken by each app to protect the privacy of the sensitive data they collect, identifying a range of failings on the part of spyware vendors (including privacy-sensitive data sent in the clear or stored in the cloud with little or no protection).