As the number of smartphone users has increased, so has the popularity of dating apps such as Tinder, Hinge, Grindr and Bumbler. At the same time, however, many users have growing privacy concerns about these applications disclosing their sensitive and private information to other service providers and/or strangers. This is particularly exacerbated due to the nature of dating apps requiring access to users’ personal contents such as chat messages, photos, video clips and locations. In this paper, we present an analysis of security and privacy issues in popular dating apps on Android. We carefully analyze the possibility of software vulnerabilities on the five most popular dating apps on Android through network traffic analyses and reverse engineering techniques for each dating app. Our experiment results demonstrate that user credential data can be stolen from all five applications; three apps may lead to the disclosure of user profiles, and one app may lead to the disclosure of chat messages.

When Harry Met Tinder: Security Analysis of Dating Apps on Android

Limited by the small keyboard, most mobile apps support the automatic login feature for better user experience. Therefore, users avoid the inconvenience of retyping their ID and password when an app runs in the foreground again. However, this auto-login function can be exploited to launch the so-called "data-clone attack": once the locally-stored, auto-login depended data are cloned by attackers and placed into their own smartphones, attackers can break through the login-device number limit and log in to the victim's account stealthily. A natural countermeasure is to check the consistency of device-specific attributes. As long as the new device shows different device fingerprints with the previous one, the app will disable the auto-login function and thus prevent data-clone attacks. In this paper, we develop VPDroid, a transparent Android OS-level virtualization platform tailored for security testing. With VPDroid, security analysts can customize different device artifacts, such as CPU model, Android ID, and phone number, in a virtual phone without user-level API hooking. VPDroid's isolation mechanism ensures that user-mode apps in the virtual phone cannot detect device-specific discrepancies. To assess Android apps' susceptibility to the data-clone attack, we use VPDroid to simulate data-clone attacks with 234 most-downloaded apps. Our experiments on five different virtual phone environments show that VPDroid's device attribute customization can deceive all tested apps that perform device-consistency checks, such as Twitter, WeChat, and PayPal. 19 vendors have confirmed our report as a zero-day vulnerability. Our findings paint a cautionary tale: only enforcing a device-consistency check at client side is still vulnerable to an advanced data-clone attack.

App's Auto-Login Function Security Testing via Android OS-Level Virtualization

With the advent of the era of the mobile Internet, Android smart phones have been widely used because of their powerful information processing abilities and convenient and fast characteristics. However, Android smart phones not only bring great convenience to people, but also face various security risks. Android smart phones store the address books and account passwords in the mobile phones. Once the important information is lost or leaked by the virus, the consequences are unthinkable. Based on the comprehensive analysis and study of various security risks faced by the Android smart phones, the corresponding preventive measures are put forward in order to ensure the security of the Android smart phones to some extent.

Research on the Security Risks and the Preventive Strategies of Android Smart-Phones

To avoid the inconvenience of retyping a user’s ID and password, most mobile apps now provide the automatic login feature for a better user experience. To this end, auto-login credential is stored locally on the smartphone. However, such sensitive credential can be stolen by attackers and placed into their smartphones via the well-known credential-clone attack. Then, attackers can imperceptibly log into the victim’s account, which causes more devastating and covert losses than merely intercepting the user’s password. In this article, we propose a generalized Android credential-clone attack, called data-clone attack. By exploiting the new-found vulnerabilities of original equipment manufacturer (OEM)-made phone clone apps, we design an identity theft method that overcomes the problem of incomplete credential extraction and eliminates the requirement of root authority. To evade the consistency check of device-specific attributes in apps, we design two environment customization methods for app-level and operating system (OS)-level, respectively. Especially, we develop a transparent Android OS customization solution, named CloneDroid, which simulates 101 special attributes of Android OS. We implement a prototype of CloneDroid and the experimental results show that 172 out of 175 most-downloaded apps’ accounts can be jeopardized, such as Facebook and WeChat. Moreover, our study has identified 18 confirmed zero-day vulnerabilities. Our findings paint a cautionary tale for the security community that billions of accounts are potentially exposed to Android OS customization-assisted data-clone attacks.

/pdf/android-data-clone-attack-via-operating-system-customization-2wknzq3eg7.pdf

Android Data-Clone Attack via Operating System Customization

Limited by the small keyboard, most mobile apps support the automatic login feature for better user experience. Therefore, users avoid the inconvenience of retyping their ID and password when an app runs in the foreground again. However, this auto-login function can be exploited to launch the so-called "data-clone attack": once the locally-stored, auto-login depended data are cloned by attackers and placed into their own smartphones, attackers can break through the login-device number limit and log in to the victim's account stealthily. A natural countermeasure is to check the consistency of devicespecific attributes. As long as the new device shows different device fingerprints with the previous one, the app will disable the auto-login function and thus prevent data-clone attacks. In this paper, we develop VPDroid, a transparent Android OS-level virtualization platform tailored for security testing. With VPDroid, security analysts can customize different device artifacts, such as CPU model, Android ID, and phone number, in a virtual phone without user-level API hooking. VPDroid's isolation mechanism ensures that user-mode apps in the virtual phone cannot detect device-specific discrepancies. To assess Android apps' susceptibility to the data-clone attack, we use VPDroid to simulate data-clone attacks with 234 most-downloaded apps. Our experiments on five different virtual phone environments show that VPDroid's device attribute customization can deceive all tested apps that perform device-consistency checks, such as Twitter, WeChat, and PayPal. 19 vendors have confirmed our report as a zero-day vulnerability. Our findings paint a cautionary tale: only enforcing a device-consistency check at client side is still vulnerable to an advanced data-clone attack.

App's Auto-Login Function Security Testing via Android OS-Level Virtualization.

Automatic login is a commonly used feature of smartphones, because their small keyboards make it difficult to key in user credential information. However, this feature may pose a serious risk to smartphone users? privacy. The stored data for automatic login could be stolen by an attacker, resulting in identity theft. In this article, we demonstrate an execution of this attack in a systematic manner through two real-world Android application case studies by implementing a prototype. We also discuss five possible defense strategies to mitigate the risk of user credential data being stolen from the application files.

User Credential Cloning Attacks in Android Applications: Exploiting Automatic Login on Android Apps and Mitigating Strategies

Feed-forward control paradigms currently domi-nate upper limb prosthesis research. Electromyographic (EMG) signals measured from muscles in a user's residual limb are filtered and processed before becoming the input to a machine learning algorithm. The output of this algorithm is sent directly as a command to a prosthetic. Despite advances in feed-forward methods, upper limb prostheses remain difficult for amputee users to control, and abandonment rates are high [1]. In this paper, we present a novel shared control paradigm that uses a hybrid gaze/EMG interface to control prosthetic hand and wrist movements. Six subjects used a virtual prosthesis to perform a pick-and-place task in an augmented reality (AR) environment using both a semi-autonomous (SA) controller and a feedforward (FF) controller representative of the current state of the art. Results show a 75% increase in average successful task completion rate when using the SA controller instead of the FF controller. The SA controller was found to be more robust against variation in object type and orientation, scored significantly higher on subjective usability metrics (p ≤ 0.05), and resulted in a dramatic decrease in user frustration during the task (p <. 01).

Dayeon Kim

Papers

User Credential Cloning Attacks in Android Applications: Exploiting Automatic Login on Android Apps and Mitigating Strategies

Shared Control of Upper Limb Prosthesis for Improved Robustness and Usability