AndroTIME: Identifying Timing Side Channels in the Android API

Gerald Palfinger; Bernd Prünster; Dominik Ziegler

doi:10.1109/TrustCom50675.2020.00253

AndroTIME: Identifying Timing Side Channels in the Android API

Gerald Palfinger^*, Bernd Prünster, Dominik Ziegler

^*Corresponding author for this work

Research output: Chapter in Book/Report/Conference proceeding › Conference paper › peer-review

Abstract

The permission system of Android has continuously evolved to better guard the privacy of users. New permissions have been introduced and existing methods which were abused now require a permission or have been entirely removed. Retrieving private data about users without their consent is thus getting continuously harder for applications.
In this paper, we systematically analyse how timing-based side channels in the Android API can be used to circumvent this tight permission system. We introduce AndroTIME, a framework to automatically detect such side channels in the Android API. Using this automated approach, we were able to identify several new timing-based side-channel leaks in Android 10 and Android 11. The detected side channels enable querying for installed applications, active accounts, files, and browser logins. The leaked information could be used to fingerprint users, detect secret user habits, or even infer a concrete user identity.

Original language	English
Title of host publication	Proceedings - 2020 IEEE 19th International Conference on Trust, Security and Privacy in Computing and Communications, TrustCom 2020
Editors	Guojun Wang, Ryan Ko, Md Zakirul Alam Bhuiyan, Yi Pan
Place of Publication	China
Pages	1849-1856
Number of pages	8
ISBN (Electronic)	9781665403924
DOIs	https://doi.org/10.1109/TrustCom50675.2020.00253
Publication status	Published - 2021
Event	19th IEEE International Conference on Trust, Security and Privacy in Computing and Communications: TrustCom 2020 - Guangdong Hotel, Hybrider Event, Guangzhou, China Duration: 29 Dec 2020 → 1 Jan 2021 http://ieee-trustcom.org/TrustCom2020/

Conference

Conference	19th IEEE International Conference on Trust, Security and Privacy in Computing and Communications
Abbreviated title	IEEE TrustCom 2020
Country/Territory	China
City	Hybrider Event, Guangzhou
Period	29/12/20 → 1/01/21
Internet address	http://ieee-trustcom.org/TrustCom2020/

Access to Document

10.1109/TrustCom50675.2020.00253

Cite this

Palfinger, G., Prünster, B., & Ziegler, D. (2021). AndroTIME: Identifying Timing Side Channels in the Android API. In G. Wang, R. Ko, M. Z. A. Bhuiyan, & Y. Pan (Eds.), Proceedings - 2020 IEEE 19th International Conference on Trust, Security and Privacy in Computing and Communications, TrustCom 2020 (pp. 1849-1856). Article 9343137. https://doi.org/10.1109/TrustCom50675.2020.00253

AndroTIME: Identifying Timing Side Channels in the Android API. / Palfinger, Gerald; Prünster, Bernd; Ziegler, Dominik.
Proceedings - 2020 IEEE 19th International Conference on Trust, Security and Privacy in Computing and Communications, TrustCom 2020. ed. / Guojun Wang; Ryan Ko; Md Zakirul Alam Bhuiyan; Yi Pan. China, 2021. p. 1849-1856 9343137.

Research output: Chapter in Book/Report/Conference proceeding › Conference paper › peer-review

Palfinger, G, Prünster, B & Ziegler, D 2021, AndroTIME: Identifying Timing Side Channels in the Android API. in G Wang, R Ko, MZA Bhuiyan & Y Pan (eds), Proceedings - 2020 IEEE 19th International Conference on Trust, Security and Privacy in Computing and Communications, TrustCom 2020., 9343137, China, pp. 1849-1856, 19th IEEE International Conference on Trust, Security and Privacy in Computing and Communications, Hybrider Event, Guangzhou, China, 29/12/20. https://doi.org/10.1109/TrustCom50675.2020.00253

@inproceedings{0f89cf5a2c8b4a3b84578a3162c0b8e5,

title = "AndroTIME: Identifying Timing Side Channels in the Android API",

abstract = "The permission system of Android has continuously evolved to better guard the privacy of users. New permissions have been introduced and existing methods which were abused now require a permission or have been entirely removed. Retrieving private data about users without their consent is thus getting continuously harder for applications.In this paper, we systematically analyse how timing-based side channels in the Android API can be used to circumvent this tight permission system. We introduce AndroTIME, a framework to automatically detect such side channels in the Android API. Using this automated approach, we were able to identify several new timing-based side-channel leaks in Android 10 and Android 11. The detected side channels enable querying for installed applications, active accounts, files, and browser logins. The leaked information could be used to fingerprint users, detect secret user habits, or even infer a concrete user identity.",

author = "Gerald Palfinger and Bernd Pr{\"u}nster and Dominik Ziegler",

year = "2021",

doi = "10.1109/TrustCom50675.2020.00253",

language = "English",

pages = "1849--1856",

editor = "Guojun Wang and Ryan Ko and Bhuiyan, {Md Zakirul Alam} and Yi Pan",

booktitle = "Proceedings - 2020 IEEE 19th International Conference on Trust, Security and Privacy in Computing and Communications, TrustCom 2020",

note = "19th IEEE International Conference on Trust, Security and Privacy in Computing and Communications : TrustCom 2020, IEEE TrustCom 2020 ; Conference date: 29-12-2020 Through 01-01-2021",

url = "http://ieee-trustcom.org/TrustCom2020/",

}

TY - GEN

T1 - AndroTIME: Identifying Timing Side Channels in the Android API

AU - Palfinger, Gerald

AU - Prünster, Bernd

AU - Ziegler, Dominik

PY - 2021

Y1 - 2021

N2 - The permission system of Android has continuously evolved to better guard the privacy of users. New permissions have been introduced and existing methods which were abused now require a permission or have been entirely removed. Retrieving private data about users without their consent is thus getting continuously harder for applications.In this paper, we systematically analyse how timing-based side channels in the Android API can be used to circumvent this tight permission system. We introduce AndroTIME, a framework to automatically detect such side channels in the Android API. Using this automated approach, we were able to identify several new timing-based side-channel leaks in Android 10 and Android 11. The detected side channels enable querying for installed applications, active accounts, files, and browser logins. The leaked information could be used to fingerprint users, detect secret user habits, or even infer a concrete user identity.

AB - The permission system of Android has continuously evolved to better guard the privacy of users. New permissions have been introduced and existing methods which were abused now require a permission or have been entirely removed. Retrieving private data about users without their consent is thus getting continuously harder for applications.In this paper, we systematically analyse how timing-based side channels in the Android API can be used to circumvent this tight permission system. We introduce AndroTIME, a framework to automatically detect such side channels in the Android API. Using this automated approach, we were able to identify several new timing-based side-channel leaks in Android 10 and Android 11. The detected side channels enable querying for installed applications, active accounts, files, and browser logins. The leaked information could be used to fingerprint users, detect secret user habits, or even infer a concrete user identity.

UR - http://www.scopus.com/inward/record.url?scp=85101263138&partnerID=8YFLogxK

U2 - 10.1109/TrustCom50675.2020.00253

DO - 10.1109/TrustCom50675.2020.00253

M3 - Conference paper

SP - 1849

EP - 1856

BT - Proceedings - 2020 IEEE 19th International Conference on Trust, Security and Privacy in Computing and Communications, TrustCom 2020

A2 - Wang, Guojun

A2 - Ko, Ryan

A2 - Bhuiyan, Md Zakirul Alam

A2 - Pan, Yi

CY - China

T2 - 19th IEEE International Conference on Trust, Security and Privacy in Computing and Communications

Y2 - 29 December 2020 through 1 January 2021

ER -

AndroTIME: Identifying Timing Side Channels in the Android API

Abstract

Conference

Access to Document

Other files and links

Fingerprint

A-SIT - Secure Information Technology Center Austria

Cite this

AndroTIME: Identifying Timing Side Channels in the Android API

Abstract

Conference

Access to Document

Other files and links

Fingerprint

Projects

A-SIT - Secure Information Technology Center Austria

Cite this