Android application collusion attacks analysis

Abstract

Android applications can bypass current security model of Android OS, when working together which is said to be application collusion. Android has no special check for inter application communication. These capabilities can easily go unnoticed because only individual application's permissions are shown. To overcome this weakness we developed a mechanism which can detect intent based inter-application data flow and found if there is any collusion between applications. Our main focus is to detect data flow between applications and also extracts data which is being sent between applications. We develop a tool, IADF Analyzer, which tells us which applications are sending data to each other. After getting this information, we manually check if receiving application has permissions to receive that data. As a proof of concept, we analyse a potentially vulnerable application i.e. Sieve developed by MWRSecurity [15]. While analyzing real world application from Google Play store we found one activity of GroupMe application is prone to privacy leakage. IADF Analyzer can be used by developers and security analysts while developing or analysing applications, respectively.