To protect user privacy, Android has been hardened to prevent apps from tracking users across apps. In particular, starting with Android 10, third-party apps have been restricted from accessing various non-resettable device identifiers. However, non-unique information accessible to apps can still be combined to create a fingerprint. Therefore, fingerprinting allows apps to circumvent these privacy protections. To address this problem, we introduce the AndroPROTECT patch creation pipeline. Essentially, AndroPROTECT automatically creates patches for the Android API to harden it against fingerprinting attempts. AndroPROTECT starts with a set of information sources that have been automatically detected to provide information which can be used for fingerprinting. From this set, it automatically generates patches that modify the values which can be obtained by third-party apps. AndroPROTECT creates patches for various types of information sources present in the API, in particular, for methods, fields, and content providers. The resulting patch package can be applied to individual apps without requiring modifications of the operating system. In our experiments, a total of 989 information sources were patched automatically, representing more than \(95\%\) of the detected information sources. By testing the patch package against a set of popular Android apps, we show that the created patches can be applied with minimal impact on compatibility compared to repackaging an application.

错误:搜索内容不能为空,请输入英文关键词
错误:关键词超出字数限制,请精简
高级检索

AndroPROTECT: Hardening the Android API Against Fingerprinting

  • Gerald Palfinger

摘要

To protect user privacy, Android has been hardened to prevent apps from tracking users across apps. In particular, starting with Android 10, third-party apps have been restricted from accessing various non-resettable device identifiers. However, non-unique information accessible to apps can still be combined to create a fingerprint. Therefore, fingerprinting allows apps to circumvent these privacy protections. To address this problem, we introduce the AndroPROTECT patch creation pipeline. Essentially, AndroPROTECT automatically creates patches for the Android API to harden it against fingerprinting attempts. AndroPROTECT starts with a set of information sources that have been automatically detected to provide information which can be used for fingerprinting. From this set, it automatically generates patches that modify the values which can be obtained by third-party apps. AndroPROTECT creates patches for various types of information sources present in the API, in particular, for methods, fields, and content providers. The resulting patch package can be applied to individual apps without requiring modifications of the operating system. In our experiments, a total of 989 information sources were patched automatically, representing more than \(95\%\) of the detected information sources. By testing the patch package against a set of popular Android apps, we show that the created patches can be applied with minimal impact on compatibility compared to repackaging an application.