Abstract
Nowadays, smartphones play a crucial role in our lives and inevitably contain extensive personal and sensitive data. However, unregulated data processing within mobile devices and threats from externals have led to a surge in unauthorized accessing behaviors, raising concerns for user privacy and data protection.In this dissertation, we present a systematic methodology to unveil privacy vulnerabilities arising from unauthorized accessing behaviors in smartphones, as well as their possible mitigation measures. Specifically, we investigate these behaviors from three different aspects: (i) unauthorized access that involves individuals being granted permissions but accessing data beyond the necessary scope (e.g., location data), (ii) unauthorized access to sensitive data without proper permissions and explicit consent (e.g., clipboard data), and (iii) external unauthorized access to the control over the device (e.g., voice command injection).
Accordingly, we first focus on examining unauthorized accessing behaviors on location data. We introduce an automatic tool, LocationScope, to uncover aggressive location data harvesting behaviors in mobile apps that collect data beyond actual needs. Specifically, we recognize location-based services via embedding data-flow paths and identify aggressive behaviors with an outlier detection technique. In addition, we propose ClipboardScope to investigate unauthorized access targeting smartphone clipboard data, which is sensitive but requires no permission to be accessed. In particular, we leverage principled program analysis to measure the purpose of such clipboard data access through two orthogonal aspects—how the clipboard text is validated (e.g., no verification, checking the existence of indicators, or the compatibility of specific formats) and its destination (e.g., for displaying only, storing locally, or transmitting to the external). Besides in-mobile behaviors, we unveil external unauthorized access to smartphones, which is brought by the vulnerable USB-C connection and defects in multi-port chargers. We exploit this vulnerable interface to bypass existing smartphone authentication mechanisms without requiring physical access to the smartphone and directly execute sensitive commands via voice injections, which poses tremendous security risks.
These findings unveil concerning situations arising from unauthorized access in smartphones. Therefore, we discuss possible mitigation measures for in-mobile unauthorized access, including regulating software development specifications and improving app vetting mechanisms. Moreover, we argue that effective authentication can protect smartphones from malicious external unauthorized access. As such, we propose SwipePass, an acoustic-based second-factor user authentication system for smartphones. It is built upon the prevalent and user-friendly pattern lock in most smartphones. It authenticates a legitimate user based on user-specific biometric and behavioral patterns, which are derived from the variated ultrasonic audios transmitted by the device’s built-in microphone and speaker during the unlocking process.
In general, this dissertation carefully investigates unauthorized accessing behaviors in smartphones from both in-mobile and external aspects and discusses possible mitigation measures. It contributes to the ongoing efforts to safeguard smartphones from unauthorized access by raising awareness and proposing effective countermeasures.
| Date of Award | 3 Jul 2024 |
|---|---|
| Original language | English |
| Awarding Institution |
|
| Supervisor | Weitao XU (Supervisor) & Qingchuan ZHAO (Co-supervisor) |