Interactively Verifying Absence of Explicit Information Flows in Android Apps Osbert Bastani Saswat Anand Alex Aiken Stanford University Stanford University Stanford University
[email protected] [email protected] [email protected] Abstract Categories and Subject Descriptors F.3.2 [Semantics of App stores are increasingly the preferred mechanism for Programming Languages]: Program analysis; F.3.1 [Spec- distributing software, including mobile apps (Google Play), ifying and Verifying and Reasoning about Programs]: Me- desktop apps (Mac App Store and Ubuntu Software Center), chanical verification computer games (the Steam Store), and browser extensions Keywords interactive verification; abductive inference; (Chrome Web Store). The centralized nature of these stores specifications from tests has important implications for security. While app stores have unprecedented ability to audit apps, users now trust 1. Introduction hosted apps, making them more vulnerable to malware that Android malware has become increasingly problematic as evades detection and finds its way onto the app store. Sound the popularity of the platform has skyrocketed in the past static explicit information flow analysis has the potential to few years [67]. App stores currently identify malware using significantly aid human auditors, but it is handicapped by a two-step process: first, they use an automated malware de- high false positive rates. Instead, auditors currently rely on tection pipeline to flag suspicious apps, and then a human au- a combination of dynamic analysis (which is unsound) and ditor manually reviews flagged apps. The detection pipeline lightweight static analysis (which cannot identify informa- typically combines dynamic analysis (e.g., dynamic infor- tion flows) to help detect malicious behaviors.