Exploitation and Defense against Android Collusion

Abstract

Each app in a mobile requires a certain type of user’s data in order to function for example WhatsApp requires contacts, Facebook requires access to Gallery/Camera. Applications ask for permissions to its users before accessing their personal data saved in mobile and users can allow or deny these permissions, however, denying these permissions will limit app’s functionality. Since almost every app is accessing some level of user’s private data saved on mobile, it is difficult to classify which app is benign and which one is malicious. Android Collusion is a new type of attack where two or more apps collude to access user’s data illicitly or perform malicious activity. It is not necessary that every app involved in this attack is malicious. The aim of this research is to determine new ways of application collusion between two apps in android and find possible ways to avert from such attacks occurring.