an analysis of the privacy and security risks of android ... · android vpn permission-enabled apps...

www.data61.csiro.au

AnAnalysisofthePrivacyandSecurityRisksofAndroidVPNPermission-enabledAppsMuhammadIkram(UNSW,Data61,CSIRO)NarseoVallina-Rodriguez(ICSI,IMDEANetworks)SurangaSeneviratne(Data61,CSIRO)MohamedAliKaafar(Data61,CSIRO)VernPaxson(UCBerkeley,ICSI)

PrivacyandSecurityRisksofAndroidVPNPermission-enabledApps|MuhammadIkram

TypicalVPNUseCases

2

VPNTunnel

• Geo-filteredcontent• Anti-surveillance• Censorship• Untrustednetworks


AndroidVPNAPI• AvailablesinceAndroid≧ 4.0(IceCreamSandwich)• HighlysensitiveAPI

+ ProtectedbyBIND_VPN_SERVICE+ Requiresuser’sdirectaction

3

- UsersmaynotunderstandVPNtechnology- Lackofapps’vettingprocess

4 PrivacyandSecurityRisksofAndroidVPNPermission-enabledApps|MuhammadIkram


AreVPNAndroidappstrustworthy?


1.StaticAnalysis

2.NetworkMeasurements

Approach

Somesalientresults


•Malwarepresence• Trafficleak• JavascriptinjectionandTLSinterception

38%ofVPNappshavemalwarepresence(VirusTotal)18%ofVPNappsdonotuseencryptedtunnels

84%leakIPv6traffic66%leakDNStraffic

2appsinjectJavaScriptcode4appsimplementTLSinterception

Agenda

• VPNAppDetectionandMethodology

• PassiveAnalysis

• NetworkMeasurements

• Summary

• Developer’sfeedback


Methodology

9

Google Play Crawl (1.4M+ Apps) Static

AnalysisNetwork

Measurements

VPNAppDetectionandClassification

Executablesandmetadata(appsdescription,reviews,etc)


10

AppCategory #ofappsfound(N=283)

FreeVPNappswithFreeservices 130

FreeVPNappswithPremiumservices 153

IdentifiedVPNApp


AnalyzedVPNApps- Evolution

11

Android4.0releasedate

Estimated ReleaseDate


Userinstallsandratings

12

37%ofapps>500Kinstalls

55%ofapps>4-starrating


StaticAnalysis


67%ofAndroidVPNappsclaimprivacyandsecurityenhancementfeatures


AccesstoSensitiveDataandResources

• 82%oftheVPNappsrequestsensitivepermissions

• READ_LOGS(14%)

• READ_SMS(6%)

• READ_CONTACTS(6%)

• WRITE_SMS(4%)


Limitation:istheuseofthosepermissionslegitimate?

3rd-partyTrackingLibraries

• 67%ofVPNappsinclude3rd-partytrackinglibraries


MalwarePresence• Scanner:VirusTotalaggregator• AV-rank: numberofAVtoolsreportingmalware• 38%ofVPNappscontainmalwarewith4%haveAV-rank≧ 5


NetworkMeasurements


Testbed


Trafficmanipulations

• Testedmanuallyeachvantagepointreportedintheapp

• 18%ofappsdonotinformabouttheterminatingend-point

• 4%ofVPNappsintercepttrafficonlocalhost

• 16%usevantagepointshostedonresidentialnetworks(SpamhausPBL)

20

Forwardingmodels

1lt.su



USERSHAVENOCONTROL!

maxhane.comqudosteam.com

DNSandIPv6Leakages

22

• 18%ofappsdonotuseencryptedtunnels

• 84%ofVPNappsleakIPv6traffic

• 66%ofVPNappsleaksDNSqueries

Userscanbepotentiallysubjecttoin-pathmodification,profiling,redirection,andcensorship.


AdblockingandJavaScriptInjection

• DOM-basedanalysis

• Top30Alexasites,referencewebsiteandsevene-commercesites


TLSInterception

• Analysedcertificatesfrom60websites/domains

• Appscompromiserootstore

24

Domain(port) Neopard DashVPN DashNet PacketCapture

amazon.com ❌ ✅ ❌ ✅

gmail.com ✅ ✅ ✅ ✅

orcart.facebook.com(8883) ✅ ❌ ❌ ✅

bankofamerica.com ✅ ✅ ✅ ✅

hsbc.com ❌ ✅ ❌ ✅


Moredetails:


“Andisn’titironic?”

26

• Douserscare?

• Manuallyanalysednegativereviews(4.5K)(1- and2-Stars)

• < 1%ofthenegativereviewsraisedprivacyandsecurityconcerns


Summary

• 38%ofappshavemalwarepresence

• 67%ofappshaveatleastonethird-partytrackinglibrary

• 66%ofVPNappshaveDNSleakagesand84%haveIPv6Leakages

• 2VPNappsperformJS-injectionforads,tracking,andredirections

• 4VPNappsperformTLSinterception


DeveloperFeedbackandReactions

28

“…Appflood[third-partylibrary]wasthebestchoicetomonetizetheapp”.

Now:ads- andtrackingfreeapp

ConfirmedJS-Injectionsfortrackingusersandshowingtheirownadvertisements

Now:statusquo


29

November2015 October2016


“…wewillpromisetheseproblemsneveroccuragain.”

15AV-RANK 1AV-RANK

DeveloperFeedbackandReactions

www.data61.csiro.au

Thanks

Q&A

[email protected]

an analysis of the privacy and security risks of android ... · android vpn permission-enabled apps...

Documents