To appear at the 9th USENIX Symposium on Operating Systems Design and Implementation (OSDI10)

TaintDroid: An Information-Flow Tracking System for Realtime Privacy Monitoring on Smartphones

William Enck The Pennsylvania State University Landon P. Cox Duke University Abstract
Todays smartphone operating systems frequently fail to provide users with adequate control over and visibility into how third-party applications use their private data. We address these shortcomings with TaintDroid, an efcient, system-wide dynamic taint tracking and analysis system capable of simultaneously tracking multiple sources of sensitive data. TaintDroid provides realtime analysis by leveraging Androids virtualized execution environment. TaintDroid incurs only 14% performance overhead on a CPU-bound micro-benchmark and imposes negligible overhead on interactive third-party applications. Using TaintDroid to monitor the behavior of 30 popular third-party Android applications, we found 68 instances of potential misuse of users private information across 20 applications. Monitoring sensitive data with TaintDroid provides informed use of third-party applications for phone users and valuable input for smartphone security service rms seeking to identify misbehaving applications.

Peter Gilbert Duke University

Byung-Gon Chun Intel Labs Anmol N. Sheth Intel Labs

Jaeyeon Jung Intel Labs

Patrick McDaniel The Pennsylvania State University

Introduction

A key feature of modern smartphone platforms is a centralized service for downloading third-party applications. The convenience to users and developers of such app stores has made mobile devices more fun and useful, and has led to an explosion of development. Apples App Store alone served nearly 3 billion applications after only 18 months [4]. Many of these applications combine data from remote cloud services with information from local sensors such as a GPS receiver, camera, microphone, and accelerometer. Applications often have legitimate reasons for accessing this privacy sensitive data, but users would also like assurances that their data is used properly. Incidents of developers relaying private information back to the cloud [35, 12] and the privacy risks posed by seemingly innocent sensors like accelerometers [19] illustrate the danger. 1

Resolving the tension between the fun and utility of running third-party mobile applications and the privacy risks they pose is a critical challenge for smartphone platforms. Mobile-phone operating systems currently provide only coarse-grained controls for regulating whether an application can access private information, but provide little insight into how private information is actually used. For example, if a user allows an application to access her location information, she has no way of knowing if the application will send her location to a location-based service, to advertisers, to the application developer, or to any other entity. As a result, users must blindly trust that applications will properly handle their private data. This paper describes TaintDroid, an extension to the Android mobile-phone platform that tracks the ow of privacy sensitive data through third-party applications. TaintDroid assumes that downloaded, third-party applications are not trusted, and monitorsin realtimehow these applications access and manipulate users personal data. Our primary goals are to detect when sensitive data leaves the system via untrusted applications and to facilitate analysis of applications by phone users or external security services [33, 55]. Analysis of applications behavior requires sufcient contextual information about what data leaves a device and where it is sent. Thus, TaintDroid automatically labels (taints) data from privacy-sensitive sources and transitively applies labels as sensitive data propagates through program variables, les, and interprocess messages. When tainted data are transmitted over the network, or otherwise leave the system, TaintDroid logs the datas labels, the application responsible for transmitting the data, and the datas destination. Such realtime feedback gives users and security services greater insight into what mobile applications are doing, and can potentially identify misbehaving applications. To be practical, the performance overhead of the TaintDroid runtime must be minimal. Unlike existing so-

To appear at the 9th USENIX Symposium on Operating Systems Design and Implementation (OSDI10) lutions that rely on heavy-weight whole-system emulaMonitoring network disclosure of privacy sensitive intion [7, 57], we leveraged Androids virtualized archiformation on smartphones presents several challenges: tecture to integrate four granularities of taint propaga Smartphones are resource constrained. The retion: variable-level, method-level, message-level, and source limitations of smartphones precludes the use le-level. Though the individual techniques are not of heavyweight information tracking systems such new, our contributions lie in the integration of these as Panorama [57]. techniques and in identifying an appropriate trade-off between performance and accuracy for resource con Third-party applications are entrusted with several strained smartphones. Experiments with our prototype types of privacy sensitive information. The monfor Android show that tracking incurs a runtime overitoring system must distinguish multiple informahead of less than 14% for a CPU-bound microbenchtion types, which requires additional computation mark. More importantly, interactive third-party applicaand storage. tions can be monitored with negligible perceived latency. Context-based privacy sensitive information is dyWe evaluated the accuracy of TaintDroid using 30 rannamic and can be difcult to identify even when domly selected, popular Android applications that use losent in the clear. For example, geographic locations cation, camera, or microphone data. TaintDroid correctly are pairs of oating point numbers that frequently agged 105 instances in which these applications transchange and are hard to predict. mitted tainted data; of the 105, we determined that 37 Applications can share information. Limiting the were clearly legitimate. TaintDroid also revealed that 15 monitoring system to a single application does not of the 30 applications reported users locations to remote account for ows via les and IPC between applicaadvertising servers. Seven applications collected the detions, including core system applications designed vice ID and, in some cases, the phone number and the to disseminate privacy sensitive information. SIM card serial number. In all, two-thirds of the applications in our study used sensitive data suspiciously. Our We use dynamic taint analysis [57, 44, 8, 61, 39] (also ndings demonstrate that TaintDroid can help expose pocalled taint tracking) to monitor privacy sensitive intential misbehavior by third-party applications. formation on smartphones. Sensitive information is rst Like similar information-ow tracking systems [7, identied at a taint source, where a taint marking indi57], a fundamental limitation of TaintDroid is that it can cating the information type is assigned. Dynamic taint be circumvented through leaks via implicit ows. The analysis tracks how labeled data impacts other data in a use of implicit ows to avoid taint detection is, in and of way that might leak the original sensitive information. itself, an indicator of malicious intent, and may well be This tracking is often performed at the instruction level. detectable through other techniques such as automated Finally, the impacted data is identied before it leaves static code analysis [14, 46] as we discuss in Section 8. the system at a taint sink (usually the network interface). Existing taint tracking approaches have several limThe rest of this paper is organized as follows: Secitations. First and foremost, approaches that rely on tion 2 provides a high-level overview of TaintDroid, Secinstruction-level dynamic taint analysis using whole systion 3 describes background information on the Android tem emulation [57, 7, 26] incur high performance penalplatform, Section 4 describes our TaintDroid design, ties. Instruction-level instrumentation incurs 2-20 times Section 5 describes the taint sources tracked by Taintslowdown [57, 7] in addition to the slowdown introduced Droid, Section 6 presents results from our Android apby emulation, which is not suitable for realtime analysis. plication study, Section 7 characterizes the performance Second, developing accurate taint propagation logic has of our prototype implementation, Section 8 discusses the proven challenging for the x86 instruction set [40, 48]. limitations of our approach, Section 9 describes related Implementations of instruction-level tracking can experiwork, and Section 10 summarizes our conclusions. ence taint explosion if the stack pointer becomes falsely tainted [49] and taint loss if complicated instructions 2 Approach Overview such as CMPXCHG, REP MOV are not instrumented properly [61]. While most smartphones use the ARM We seek to design a framework that allows users to instruction set, similar false positives and false negatives monitor how third-party smartphone applications handle could arise. their private data in realtime. Many smartphone applications are closed-source, therefore, static source code Figure 1 presents our approach to taint tracking on analysis is infeasible. Even if source code is available, smartphones. We leverage architectural features of virruntime events and conguration often dictate informatual machine-based smartphones (e.g., Android, Blacktion use; realtime monitoring accounts for these environBerry, and J2ME-based phones) to enable efcient, ment specic dependencies. system-wide taint tracking using ne-grained labels with 2

To appear at the 9th USENIX Symposium on Operating Systems Design and Implementation (OSDI10) Message-level tracking plications using native third-party libraries, but that the number of affected applications remains small. Application Code Msg Application Code In summary, we provide a novel, efcient, systemVirtual Virtual Variable-level wide, multiple-marking, taint tracking design by comMachine Machine tracking bining multiple granularities of information tracking. Method-level Native System Libraries While some techniques such as variable tracking within tracking an interpreter have been previously proposed (see SecFile-level Network Interface Secondary Storage tracking tion 9), to our knowledge, our approach is the rst to extend such tracking system-wide. By choosing a mulFigure 1: Multi-level approach for performance efcient tiple granularity approach, we balance performance and taint tracking within a common smartphone architecture. accuracy. As we show in Sections 6 and 7, our systemwide approach is both highly efcient (14% CPU overhead and 4.4% memory overhead for simultaneously clear semantics. First, we instrument the VM interpreter tracking 32 taint markings per data unit) and accurately to provide variable-level tracking within untrusted apdetects many suspicious network packets. plication code.1 Using variable semantics provided by the interpreter provides valuable context for avoiding 3 Background: Android the taint explosion observed in the x86 instruction set. Android [1] is a Linux-based, open source, mobile Additionally, by tracking variables, we maintain taint phone platform. Most core phone functionality is implemarkings only for data and not code. Second, we use mented as applications running on top of a customized message-level tracking between applications. Tracking middleware. The middleware itself is written in Java taint on messages instead of data within messages miniand C/C++. Applications are written in Java and commizes IPC overhead while extending the analysis systempiled to a custom byte-code known as the Dalvik EXewide. Third, for system-provided native libraries, we use cutable (DEX) byte-code format. Each application exemethod-level tracking. Here, we run native code withcutes within its Dalvik VM interpreter instance. Each inout instrumentation and patch the taint propagation on stance executes as unique UNIX user identities to isolate return. These methods accompany the system and have applications within the Linux platform subsystem. Apknown information ow semantics. Finally, we use leplications communicate via the binder IPC mechanism. level tracking to ensure persistent information conservaBinder provides transparent message passing based on tively retains its taint markings. parcels. We now discuss topics necessary to understand To assign labels, we take advantage of the wellour tracking system. dened interfaces through which applications access senDalvik VM Interpreter: DEX is a register-based masitive data. For example, all information retrieved from chine language, as opposed to Java byte-code, which is GPS hardware is location-sensitive, and all informastack-based. Each DEX method has its own predened tion retrieved from an address book database is contactnumber of virtual registers (which we frequently refer to sensitive. This avoids relying on heuristics [10] or manas simply registers). The Dalvik VM interpreter manual specication [61] for labels. We expand on informaages method registers with an internal execution state tion sources in Section 5. stack; the current methods registers are always on the In order to achieve this tracking at multiple granularitop stack frame. These registers loosely correspond to ties, our approach relies on the rmwares integrity. The local variables in the Java method and store primitive taint tracking systems trusted computing base includes types and object references. All computation occurs the virtual machine executing in userspace and any naon registers, therefore values must be loaded from and tive system libraries loaded by the untrusted interpreted stored to class elds before use and after use. Note that application. However, this code is part of the rmware, DEX uses class elds for all long term storage, unlike and is therefore trusted. Applications can only escape hardware register-based machine languages (e.g., x86), the virtual machine by executing native methods. In our which store values in arbitrary memory locations. target platform (Android), we modied the native library loader to ensure that applications can only load native liNative Methods: The Android middleware provides acbraries from the rmware and not those downloaded by cess to native libraries for performance optimization and the application. Note that an early 2010 survey of the top third-party libraries such as OpenGL and Webkit. An50 most popular free applications in each category of the droid also uses Apache Harmony Java [3], which freAndroid Market [2] (1100 applications in total) revealed quently uses system libraries (e.g., math routines). Nathat less than 4% included a .so le. A similar survey tive methods are written in C/C++ and expose functionconducted in mid 2010 revealed this fraction increased to ality provided by the underlying Linux kernel and ser5%, which indicates there is growth in the number of apvices. They can also access Java internals, and hence are 3

ow Dalvik how Dalvik how Dalvik d. internal ed. ed. internal VM (more ll VM (more ll bridge] all callbridge] ds:internal : internal ds: internal M methods MM methods methods Is,whereas Is, whereas whereas estandards standards e standards passingJava ssing Java passing Java s, which is which is es, which is vik. Internal k. Internal vik. Internal nually parse ally parse nuallyby the ated parse ed by the ated by the

requent use quent use methodsuse requent are unctionality ethods are methods are rvices. Annctionality unctionality of Java Anvices. Anervices. [12] Portions of Java [12] of Java [12] em libraries ortions of Portions of he Android m libraries em libraries f JNI. Furehe Android Android nterfaces to JNI. Furf JNI.Furkit. Finally, erfaces to nterfaces to lkit (NDK) t.implement Finally, kit. Finally, pplications. kit (NDK) olkit (NDK) it impedes mplement implement on different plications. applications. tditx86. The impedes impedes ding better n different

on different x86. The nd x86.The ing better iding better

m-wide taint TaintDroid within an

computing em applicaracking to tracking to oid distribuplications. applications. int tracking computing computing assume all m theapplicaemapplican Dalvik d distribuoid distribunative code, t tracking int modify uslytracking

wide taint m-widetaint tracking to TaintDroid TaintDroid pplications. within an within an

from it (6). The remote Dalvik VM instance propagates (7) identically for the untrusted application. untrusted application invokes a library specBinder Hook (5) ied as a taint sink (8), e.g., network send, the library Binder Kernel Module BinderBinder Kernel Module Kernel Module Binder Kernel Module retrieves the taint tag for the data in question (9) and reports the event. Figure architecture Architecture Figure 2: TaintDroid2. TaintDroidwithin Android. Implementing this architecture requires addressing Figure TaintDroid Architecture Figure 2. 2.TaintDroid Architecture several system challenges, including: a) taint tag storincluded in our trusted computing base (see Section 2). age, b) interpreted code taint propagation, c) native code Dalvik VM interpreter,types of native methods: intertaint propagation, d) IPC taint propagation, and e) secAndroid contains two storing the specied taint marking(s) Dalvikvirtualinterpreter, As the trusted internal VM uses the storage taint propagation. The remainder of this in the VM interpreter, storing the the specied taint marking(s) ondary nal VM methods and JNI storing The application Dalvik VM taint map. methods. specied taint marking(s) methodsinformation, map. the structures and APIs. uses the access taint the Dalvik VM application tainted virtual interpreter-specic trustedpropagates taintsection the in the virtual taint map. AsAs the trusted application tags describes our design. uses in the JNI according to our to the ow rules. When the trusted ap- tags methods conform data Dalvik VM propagates taint Java native interface standards (3) tainted information, the Dalvik VM propagates taint tags Taint Tag Storage tainted information, 4.1 specications which plication uses[32], tainted requires Dalvik to separate trusted ap(3) according to our data information When IPC trusted apto variables ow JNI an the transaction, (3) accordingthe our data using arules.call bridge. ow rules. in When the Java arguments The choice of how to store taint tags inuences perthe modied into library (4) ensures the an parcel plication uses bindertainted informationan IPC IPCmessage and memory overhead. Dynamic taint trackthe plication usesthe tainted informationmanually parse transaction, transaction, Conversely, internal VM methods must in in formance carries a taint tag the modied binderreecting byte array ofthe parcel markings modied the interpreters the combined taint message arguments from binder arguments. ing systems the all contained data.library (4) ensures thetransparently library (4) ensures passed parcel message commonly store tags for every data byte or of The parcel is carries a taint tag reecting thethe through binder.markings [57, 7]. Tracked memory is unstructured and witha taint tag reecting combined taint taint word combined markings Binder carries the All Android IPC occurs through IPC:kernel (5) and received by the remote untrusted out content semantics. Frequently taint tags are stored Binder contained data. of all is a component-basedThe parcel passed transparently of all contained that theprocessingis interpreted code is parcel and IPC frameapplication. Notedata. The third-party is passed transparently shadow memory [57] and tag maps [61]. work designed for BeOS, and received by Inc., remote in non-adjacent extended by Palm the and through the kernel (5) and received by the remote untrusted untrusted through the kernel (5) binder library retrieves untrusted. The modiedby Google. Fundamental the taint tag TaintDroid uses variable semantics within the Dalvik incustomized for Android to application. Noteandthat the itthird-partyand read from the is store taint tags adjacent to variables in Notethat the third-party values stan- code code We interpreted is application. from the parcel which serialize both active assigns to all interpreted terpreter. binder are parcels, untrusted.objects. The Dalvik includes retrieves the taint taint tag The modied binder instance propagates taint parcel (6). The modiedformer VMlibrary retrieves the tag untrusted. The remote binder library references to memory, providing spatial locality. dard data from(7) identically for assignsframework to manageWhenfrom the ve variable types that require taint stortags the parcel and allows the to all application. read the the binder objects, which assigns it it to all values from the parcel and the untrusted values read from Dalvik has shared data objects between processes. A instance propagates untrusted The remote Dalvik a library specied as a taint taint taint parcel (6). application invokes VM instance propagates age: method local variables, method arguments, class (6). The remote Dalvik VM binder kernel parcel static module e.g., sending a data buffer over the sink (7) identically messages between application. When the the tags (7)passes parcel for the untrusted processes. network, the elds, class instance elds, and arrays. In all cases, When tags (8), identically for the untrusted application. we store a 32-bit bitvector with each variable to encode library retrieves the invokes a thelibrary specied taint 4 TaintDroid untrusted applicationtaint tag for library specied as a(9-11) taint allowing 32 different taint markings. application invokes a data in question the taint tag, as a untrusted and makese.g., sending a data buffer over the network, the a policy decision. sink (8), e.g., sending a dataour multiple granularity sink (8), is a realization of buffer over the network, the TaintDroid Dalvik stores method local variables and arguments At a high level, taint tracking approach taint Android. data in question (9-11) library retrieves the TaintDroid architecture enables system- internal stack. When an application invokes a library retrieves the within tag for the data in questionan taint tag for the TaintDroid uses on (9-11) wide tracking by combining execution taint tracking, IPC variable-level policy decision. and makes aatrackingdecision. VM interpreter. Mul- method, a new stack frame is allocated for all local variand makes policy within the taint taint markings areinterface taint taint tag. When tiple tracking, native stored as one tracking, and secondary Method arguments are also passed via the internal ables. At a taint tracking. a high level, TaintDroid variable enables stack. storage highexecute TaintDroid architecturetaint tags system- Before calling a method, the callee places the arapplications level, native methods, architecture enables systemwide tracking by combining execution previous approaches IPC the top of the stack such that they become wide tracking taint Finally, taint tags tainttaint IPC are patched on by combining execution tracking, guments Variable-level return. tracking While are assignedtracking, on to parcels and native interface taint tracking, and secondary numbered registers in the callees stack frame. We propagated through taint tracking, and secondary binder. Note that taint tracking, native interface TaintBochs [taintbochs] high taint tracking, such as Panorama [panorama] and the Technical tracking. storage taint Report [17] version of this paper contains allocate taint tag storage by doubling the size of the stack storage tainttracking. taint tracking via instruction-level provide high-accuracy more implementation details. taint propagation, performance is While previous frame allocation. Taint tags are interleaved between valother Variable-leveltaint tracking While previousOn theapproaches Variable-level taint tracking sacriced. approaches that register v originally accessed via f p[i] is Figure 2 depicts TaintDroids architecture. Informaues such i end of tainted (1) in[panorama] andsuch TaintBochs [taintbochs]f p[2 i] after modication. Note that Dalvik the spectrum,trusted application with sufcient [precip] as approaches and as PRECIP suchis Panorama a[panorama] TaintBochs [taintbochs] such as Panorama tion as accessed consider high-accuracy taint trackinginto the interprovide(e.g., the location system callsThe taint kernel, trading 64-bit variables as two adjacent 32-bit registers on provide only high-level provider). via instruction-level context high-accuracy taint tracking via instruction-level stores off accuracyafor performance; that interfaces with the On nomi-other stack. While the byte-code interprets these thus,sacriced. On only other they provide the the internal face propagation, performance taint invokes nativeperformance is is sacriced. the taint propagation, method (2) nal advantage over OSstoring specied taintthose implemented registers as a single 64-bit value, the interpreter Dalvik VM spectrum, approaches such as PRECIP [precip] interpreter, permissions (e.g., markings adjacent end of the spectrum, approaches such as PRECIP [precip] end of the in the virtual taint map. The Dalvik VM propagates taint in Android). manages these registers as separate values. Therefore, consider only high-level system calls intointo kernel, trading only high-level system calls the the kernel, modied consideraccording to data ow rules as the trusted ap- our trading stack transparently stores and retrieves 64tags (3) In TaintDroid, we choose a middle ground, variableoff accuracy for performance; thus, theythey provide nomi-nomi- and from separate 32-bit registers (at f p[2i] off accuracy the tainted information. Everyprovide only only plication uses for performance; thus, interpreter bit values level taint tracking. TaintDroid is designed to taint primitive to nal advantage over OSint, permissions Our When the implemented + 2]). Finally, native method targets require nal advantage over OS oat, etc). tags.those implemented p[2 i permissions (e.g., taint source and instance simultaneously propagates taint (e.g., those and f type variables (e.g., trusted application in Android). uses the tainted information in an IPC a slightly different stack frame organization for reasons in Android).

Virtual Taint Map

Trusted Application transaction, the modied binder library (4) ensures the Untrusted Application Trusted Application Untrusted Application Trusted Application Untrusted Application Untrusted Application Trusted Application parcel has a taint tag reecting the combined taint mark (8) (8) ings of all contained data. The parcel is passed transpar (8) (8) Taint Source Taint Source Taint Source Taint Source (1) Trusted LibraryTaint Sink Taint Sink Trusted Library Trusted Library Taint Sink (1) ently through the kernel (5) and received by the remote Trusted Library Taint Sink (1) (9) (11) (11) (9) (9) (11) untrusted application. Note that only the interpreted code JNIHook Hook Binder Hook JNI JNI Hook Binder Hook Binder Hook JNI Hook Hook (7)Binder (3) JNI (2) Binder Hook Binder Hook Hook JNI Hook untrusted. The modied binder library retrieves the (9) is (3) (7) (7) (3)(3) (4) taint(10) from the parcel and assigns it to all values read tag (7) (10) (6) (6) (4)
(4) (4) (2) (2) (2) Dalvik VM Virtual Taint Map Interpreter Virtual Taint Map (6) (5)

To appear at the 9th USENIX Symposium on Operating Systems Design and Implementation (OSDI10)

Userspace Userspace Userspace Userspace

InterpretedCode Code Interpreted Code InterpretedCode Interpreted

(5)

(5)

(6)

ssume all assume all he Dalvik n the Dalvik TaintDroid. cation code, ative code, native with

. The taint

sink libraries (Section VI) provide an easy interface to set In TaintDroid, we choose on a middletypes. However, TaintDroid, markings a primitive ground, variableand check the taint we choose middle ground, variablelevel taintcases when object references must become4 tainted there tainttracking. TaintDroid is designed to taint taint primitive level are tracking. TaintDroid is designed to primitive to ensure taint propagation operates Our Our Applications type variables (e.g., int, oat, etc). correctly. taint source and type variables (e.g., int, oat, etc). taint source and are compiled into the Dalvik EXecutable (DEX) byte-code

Kernel Kernel Kernel Kernel

Virtual Taint Map Virtual Taint Map DVM Intepreter Binder IPC Library Binder DVMIntepreter Hook DVM Intepreter

taint tags Virtual Taint Virtual Taint Map Map DVM Interpreter When the Binder IPC Library DVM Interpreter DVM Interpreter

(10) Dalvik VM Interpreter Virtual Taint Map

To appear at the 9th USENIX Symposium on Operating Systems Design and Implementation (OSDI10) Interpreted Targets Native Targets propriate propagation logic. We use a data ow logic, as out0 tracking implicit ows requires static analysis and causes stack pointer (top) VM goop signicant performance overhead and overestimation in frame pointer (current) tracking [29] (see Section 8). We begin by dening taint v0 == local0 v0 taint tag markings, taint tags, variables, and taint propagation. We out0 v1 == in0 arg0 then present our logic rules for DEX. out0 taint tag v1 taint tag arg1 Let L be the universe of taint markings for a particular out1 v2 == in1 return taint out1 taint tag v2 taint tag arg0 taint tag system. A taint tag t is a set of taint markings, t L. (unused) arg1 taint tag Each variable has an associated taint tag. A variable is an VM goop instance of one of the ve types described in Section 4.1. frame pointer (previous) We use a different representation for each type. The local v0 == local0 variable v0 taint tag variable taint tag and argument variables correspond to virtual registers, v1 == local1 denoted vx . Class eld variables are denoted as fx to inv1 taint tag dicate a eld variable with class index x. Instance elds v2 == in0 require an instance object and are denoted vy (fx ), where v4 taint tag vy is the instance object reference (note that both the obHigh Addresses (0xffffffff) ject reference and the dereferenced value are variables). Static elds are denoted as fx alone, which is shorthand Figure 3: Modied Stack Format. Taint tags are interfor S(fx ), where S() is the static scope. Finally, vx [] leaved between registers for interpreted method targets denotes an array, where vx is an array object reference and appended for native methods. Dark grayed boxes variable. represent taint tags. Our virtual taint map function is (). (v) returns the discussed in Section 4.3. The modied stack format is taint tag t for variable v. (v) is also used to assign a shown in Figure 3. taint tag to a variable. Retrieval and assignment are disTaint tags are stored adjacent to class elds and artinguished by the position of () w.r.t. the symbol. rays inside the VM interpreters internal data structures. When (v) appears on the right hand side of , (v) reTaintDroid stores only one taint tag per array to minimize trieves the taint tag for v. When (v) appears on the left storage overhead. Per-value taint tag storage is severely hand side, (v) assigns the taint tag for v. For example, inefcient for Java String objects, as all characters have (v1 ) (v2 ) copies the taint tag from v2 to v1 . the same tag. Unfortunately, storing one taint tag per arTable 1 captures our propagation logic. The table enuray may result in false positives during taint propagation. merates abstracted versions of the byte-code instructions For example, if untainted variable u is stored into array A specied in the DEX documentation. Register variables at index 0 (A[0]) and tainted variable t is stored into A[1], and class elds are referenced by vX and fX , respecthen array A is tainted. Later, if variable v is assigned tively. R and E are the return and exception variables to A[0], v will be tainted, even though u was untainted. maintained within the interpreter, respectively. A, B, and Fortunately, Java frequently uses objects, and object refC are constants in the byte-code. The table does not list erences are infrequently tainted (see Section 4.2), thereinstructions that clear the taint tag of the destination regfore this coding practice leads to less false positives. ister. For example, we do not consider the array-length 4.2 Interpreted Code Taint Propagation instruction to return a tainted value even if the array is tainted. Note that the array length is sometimes used to Taint tracking granularity and ow semantics inuaid direct control ow propagation (e.g., Vogt et al. [53]). ence performance and accuracy. TaintDroid implements variable-level taint tracking within the Dalvik VM in4.2.2 Tainting Object References terpreter. Variables provide valuable semantics for taint The propagation rules in Table 1 are straightforward propagation, distinguishing data pointers from scalar valwith two exceptions. First, taint propagation logics comues. TaintDroid primarily tracks primitive type variables monly include the taint tag of an array index during (e.g., int, oat, etc); however, there are cases when object lookup to handle translation tables (e.g., ASCII/UNIreferences must become tainted to ensure taint propagaCODE or character case conversion). For example, contion operates correctly; this section addresses why these sider a translation table from lowercase to upper case cases exist. However, rst we present taint tracking in characters: if a tainted value a is used as an array index, the Dalvik machine language as a formal logic. the resulting A value should be tainted even though the 4.2.1 Taint Propagation Logic A value in the array is not. Hence, the taint logic for The Dalvik VM operates on the unique DEX machine aget-op uses both the array and array index taint. Seclanguage instruction set, therefore we must design an apond, when the array contains object references (e.g., an
Low Addresses (0x00000000)

To appear at the 9th USENIX Symposium on Operating Systems Design and Implementation (OSDI10) Table 1: DEX Taint Propagation Logic. Register variables and class elds are referenced by vX and fX , respectively. R and E are the return and exception variables maintained within the interpreter. A, B, and C are byte-code constants.
Op Format const-op vA C move-op vA vB move-op-R vA return-op vA move-op-E vA throw-op vA unary-op vA vB binary-op vA vB vC binary-op vA vB binary-op vA vB C aput-op vA vB vC aget-op vA vB vC sput-op vA fB sget-op vA fB iput-op vA vB fC iget-op vA vB fC Op Semantics vA C vA vB vA R R vA vA E E vA vA vB vA vB vC vA vA vB v A vB C vB [vC ] vA vA vB [vC ] fB vA vA fB vB (fC ) vA vA vB (fC ) Taint Propagation (vA ) (vA ) (vB ) (vA ) (R) (R) (vA ) (vA ) (E) (E) (vA ) (vA ) (vB ) (vA ) (vB ) (vC ) (vA ) (vA ) (vB ) (vA ) (vB ) (vB []) (vB []) (vA ) (vA ) (vB []) (vC ) (fB ) (vA ) (vA ) (fB ) (vB (fC )) (vA ) (vA ) (vB (fC )) (vB ) Description Clear vA taint Set vA taint to vB taint Set vA taint to return taint Set return taint ( if void) Set vA taint to exception taint Set exception taint Set vA taint to vB taint Set vA taint to vB taint vC taint Update vA taint with vB taint Set vA taint to vB taint Update array vB taint with vA taint Set vA taint to array and index taint Set eld fB taint to vA taint Set vA taint to eld fB taint Set eld fC taint to vA taint Set vA taint to eld fC and object reference taint

public static Integer valueOf(int i) { if (i < -128 || i > 127) { return new Integer(i); } return valueOfCache.CACHE [i+128]; } static class valueOfCache { static final Integer[] CACHE = new Integer[256]; static { for(int i=-128; i<=127; i++) { CACHE[i+128] = new Integer(i); } } }

only by including the object reference taint tag when the value eld is read from the Integer (i.e., the iget-op propagation rule), will the correct taint tag of TAG be assigned to out.

4.3

Native Code Taint Propagation

Figure 4: Excerpt from Androids Integer class illustrating the need for object reference taint propagation. Integer array), the index taint tag is propagated to the object reference and not the object value. Therefore, we include the object reference taint tag in the instance get (iget-op) rule. The code listed in Figure 4 demonstrates a real instance of where object reference tainting is needed. Here, valueOf() returns an Integer object for a passed int. If the int argument is between 128 and 127, valueOf() returns reference to a statically dened Integer object. valueOf() is implicitly called for conversion to an object. Consider the following denition and use of a method intProxy().
Object intProxy(int val) { return val; } int out = (Integer) intProxy(tVal);

Native code is unmonitored in TaintDroid. Ideally, we achieve the same propagation semantics as the interpreted counterpart. Hence, we dene two necessary postconditions for accurate taint tracking in the Javalike environment: 1) all accessed external variables (i.e., class elds referenced by other methods) are assigned taint tags according to data ow rules; and 2) the return value is assigned a taint tag according to data ow rules. TaintDroid achieves these postconditions through an assortment of manual instrumentation, heuristics, and method proles, depending on situational requirements. Internal VM Methods: Internal VM methods are called directly by interpreted code, passing a pointer to an array of 32-bit register arguments and a pointer to a return value. The stack augmentation shown in Figure 3 provides access to taint tags for both Java arguments and the return value. As there are a relatively small number of internal VM methods which are infrequently added between versions,2 we manually inspected and patched them for taint propagation as needed. We identied 185 internal VM methods in Android version 2.1; however, only 5 required patching: the System.arraycopy() native method for copying array contents, and several native methods implementing Java reection. JNI Methods: JNI methods are invoked through the JNI call bridge. The call bridge parses Java arguments and assigns a return value using the methods descriptor string. We patched the call bridge to provide taint propagation for all JNI methods. When a JNI method returns, TaintDroid consults a method prole table for tag propa-

Consider the case where tVal is an int with value 1 and taint tag TAG. When intProxy() is passed tVal, TAG is propagated to val. When intProxy() returns val, it calls Integer.valueOf() to obtain an Integer instance corresponding to the scalar variable val. In this case, Integer.valueOf() returns a reference to the static Integer object with value 1. The value eld (of the Integer class) in the object has taint tag of ; however, since the aget-op propagation rule includes the taint of the index register, the object reference has a taint tag of TAG. Therefore, 6

To appear at the 9th USENIX Symposium on Operating Systems Design and Implementation (OSDI10) gation updates. A method prole is a list of (f rom, to) However, this additional complexity will negatively impairs indicating ows between variables, which may be pact IPC performance. method parameters, class variables, or return values. 4.5 Secondary Storage Taint Propagation Enumerating the information ows for all JNI methods is a time consuming task best completed automatically Taint tags may be lost when data is written to a le. using source code analysis (a task we leave for future Our design stores one taint tag per le. The taint tag work). We currently include an additional propagation is updated on le write and propagated to data on le heuristic patch. The heuristic is conservative for JNI read. TaintDroid stores le taint tags in the le sysmethods that only operate on primitive and String artems extended attributes. To do this, we implemented guments and return values. It assigns the union of the extended attribute support for Androids host le system method argument taint tags to the taint tag of the return (YAFFS2) and formatted the removable SDcard with the value. While the heuristic has false negatives for methext2 le system. As with arrays and IPC, storing one ods using objects, it covers many existing methods. taint tag per le leads to false positives and limits the granularity of taint markings for information databases We performed a survey of the JNI methods included (see Section 5). Alternatively, we could track taint tags in the ofcial Android source code (version 2.1) to deat a ner granularity at the expense of added memory and termine specic properties. We found 2,844 JNI methperformance overhead. ods with a Java interface and C or C++ implementation.3 Of these methods, 913 did not reference objects (as argu4.6 Taint Interface Library ments, return value, or method body) and hence are autoTaint sources and sinks dened within the virtualized matically covered by our heuristic. The remaining methenvironment must communicate taint tags with the trackods may or may not have information ows that produce ing system. We abstract the taint source and sink logic false negatives. Currently, we dene method proles as into a single taint interface library. The interface perneeded. For example, methods in the IBM NativeConforms two functions: 1) add taint markings to variables; verter class require propagation for conversion between and 2) retrieve taint markings from variables. The library character and byte arrays. only provides the ability to add and not set or clear taint 4.4 IPC Taint Propagation tags, as such functionality could be used by untrusted Java code to remove taint markings. Taint tags must propagate between applications when they exchange data. The tracking granularity affects Adding taint tags to arrays and strings via internal VM performance and memory overhead. TaintDroid uses methods is straightforward, as both are stored in data obmessage-level taint tracking. A message taint tag reprejects. Primitive type variables, on the other hand, are sents the upper bound of taint markings assigned to varistored on the interpreters internal stack and disappear ables contained in the message. We use message-level after a method is called. Therefore, the taint library uses granularity to minimize performance and storage overthe method return value as a means of tainting primitive head during IPC. type variables. The developer passes a value or variable into the appropriate add taint method (e.g., addTaintInt()) We chose to implement message-level over variableand the returned variable has the same value but additionlevel taint propagation, because in a variable-level sysally has the specied taint tag. Note that the stack storage tem, a devious receiver could game the monitoring by does not pose complications for taint tag retrieval. unpacking variables in a different way to acquire values without taint propagation. For example, if an IPC 5 Privacy Hook Placement parcel message contains a sequence of scalar values, the Using TaintDroid for privacy analysis requires idenreceiver may unpack a string instead, thereby acquiring tifying privacy sensitive sources and instrumenting taint values without propagating all the taint tags on scalar valsources within the operating system. Historically, dyues in the sequence. Hence, to prevent applications from namic taint analysis systems assume taint source and sink removing taint tags in this way, the current implementaplacement is trivial. However, complex operating systion protects taint tags at the message-level. tems such as Android provide applications information Message-level taint propagation for IPC leads to false in a variety of ways, e.g., direct access, and service interpositives. Similar to arrays, all data items in a parcel face. Each potential type of privacy sensitive information share the same taint tag. For example, Section 8 dismust be studied carefully to determine the best method of cusses limitations for tracking the IMSI that results from dening the taint source. passing as portions the value as conguration parameters in parcels. Future implementations will consider wordTaint sources can only add taint tags to memory for level taint tags along with additional consistency checks which TaintDroid provides tag storage. Currently, taint to ensure accurate propagation for unpacked variables. source and sink placement is limited to variables in in7

To appear at the 9th USENIX Symposium on Operating Systems Design and Implementation (OSDI10) terpreted code, IPC messages, and les. This section 6 Application Study discusses how valuable taint sources and sinks can be imThis section reports on an application study that uses plemented within these restrictions. We generalize such TaintDroid to analyze how 30 popular third-party Antaint sources based on information characteristics. droid applications use privacy sensitive user data. Existing applications acquire a variety of user data along with Low-bandwidth Sensors: A variety of privacy sensitive permissions to access the Internet. Our study nds that information types are acquired through low-bandwidth two thirds of these applications expose detailed location sensors, e.g., location and accelerometer. Such informadata, the phones unique ID, and the phone number using tion often changes frequently and is simultaneously used the combination of the seemingly innocuous access perby multiple applications. Therefore, it is common for missions granted at install. This nding was made possia smartphone OS to multiplex access to low-bandwidth ble by TaintDroids ability to monitor runtime access of sensors using a manager. This sensor manager represents sensitive user data and to precisely relate the monitored an ideal point for taint source hook placement. For our accesses with the data exposure by applications. analysis, we placed hooks in Androids LocationManager and SensorManager applications.

6.1

Experimental Setup

High-bandwidth Sensors: Privacy sensitive information sources such as the microphone and camera are high-bandwidth. Each request from the sensor frequently returns a large amount of data that is only used by one application. Therefore, the smartphone OS may share sensor information via large data buffers, les, or both. When sensor information is shared via les, the le must be tainted with the appropriate tag. Due to exible APIs, we placed hooks for both data buffer and le tainting for tracking microphone and camera information. Information Databases: Shared information such as address books and SMS messages are often stored in lebased databases. This organization provides a useful unambiguous taint source similar to hardware sensors. By adding a taint tag to such database les, all information read from the le will be automatically tainted. We used this technique for tracking address book information. Note that while TaintDroids le-level granularity was appropriate for these valuable information sources, others may exist for which les are too coarse grained. However, we have not yet encountered such sources. Device Identiers: Information that uniquely identies the phone or the user is privacy sensitive. Not all personally identiable information can be easily tainted. However, the phone contains several easily tainted identiers: the phone number, SIM card identiers (IMSI, ICC-ID), and device identier (IMEI) are all accessed through well-dened APIs. We instrumented the APIs for the phone number, ICC-ID, and IMEI. An IMSI taint source has inherent limitations discussed in Section 8. Network Taint Sink: Our privacy analysis identies when tainted information transmits out the network interface. The VM interpreter-based approach requires the taint sink to be placed within interpreted code. Hence, we instrumented the Java framework libraries at the point the native socket library is invoked. 8

An early 2010 survey of the 50 most popular free applications in each category of the Android Market [2] (1,100 applications, in total) revealed that roughly a third of the applications (358 of the 1,100 applications) require Internet permissions along with permissions to access either location, camera, or audio data. From this set, we randomly selected 30 popular applications (an 8.4% sample size), which span twelve categories. Table 2 enumerates these applications along with permissions they request at install time. Note that this does not reect actual access or use of sensitive data. We studied each of the thirty downloaded applications by starting the application, performing any initialization or registration that was required, and then manually exercising the functionality offered by the application. We recorded system logs including detailed information from TaintDroid: tainted binder messages, tainted le output, and tainted network messages with the remote address. The overall experiment (conducted in May 2010) lasted slightly over 100 minutes, generating 22,594 packets (8.6MB) and 1,130 TCP connections. To verify our results, we also logged the network trafc using tcpdump on the WiFi interface and repeated experiments on multiple Nexus One phones, running the same version of TaintDroid built on Android 2.1. Though the phones used for experiments had a valid SIM card installed, the SIM card was inactivate, forcing all the packets to be transmitted via the WiFi interface. The packet trace was used only to verify the exposure of tainted data agged by TaintDroid. In addition to the network trace, we also noted whether applications acquired user consent (either explicit or implicit) for exporting sensitive information. This provides additional context information to identify possible privacy violations. For example, by selecting the use my location option in a weather application, the user implicitly consents to disclosing geographic coordinates to the weather server.

To appear at the 9th USENIX Symposium on Operating Systems Design and Implementation (OSDI10) Table 2: Applications grouped by the requested permissions (L: location, C: camera, A: audio, P: phone state). Android Market categories are indicated in parenthesis, showing the diversity of the studied applications.
Applications The Weather Channel (News & Weather); Cestos, Solitaire (Game); Movies (Entertainment); Babble (Social); Manga Browser (Comics) Bump, Wertago (Social); Antivirus (Communication); ABC Animals, Trafc Jam, Hearts, Blackjack, (Games); Horoscope (Lifestyle); Yellow Pages (Reference); 3001 Wisdom Quotes Lite, Dastelefonbuch, Astrid (Productivity), BBC News Live Stream (News & Weather); Ringtones (Entertainment) Layar (Lifestyle); Knocking (Social); Coupons (Shopping); Trapster (Travel); Spongebob Slide (Game); ProBasketBall (Sports) MySpace (Social); Barcode Scanner, ixMAT (Shopping) Evernote (Productivity)

# 6 14

L x x

Permissions C A P

6 3 1

x x x

Listed names correspond to the name displayed on the phone and not necessarily the name listed in the Android Market. All listed applications also require access to the Internet.

Table 3: Potential privacy violations by 20 of the studied applications. Note that three applications had multiple violations, one of which had a violation in all three categories. Observed Behavior (# of apps) Details Phone Information to Content Servers (2) 2 apps sent out the phone number, IMSI, and ICC-ID along with the geo-coordinates to the apps content server. Device ID to Content Servers (7) 2 Social, 1 Shopping, 1 Reference and three other apps transmitted the IMEI number to the apps content server. Location to Advertisement Servers (15) 5 apps sent geo-coordinates to ad.qwapi.com, 5 apps to admob.com, 2 apps to ads.mobclix.com (1 sent location both to admob.com and ads.mobclix.com) and 4 apps sent location to data.urry.com.
To

TaintDroid agged nine applications in this category, but only seven transmitted the raw IMEI without mentioning such practice in the EULA. the best of our knowledge, the binary messages contained tainted location data (see the discussion below).

6.2

Findings

Table 3 summarizes our ndings. TaintDroid agged 105 TCP connections as containing tainted privacy sensitive information. We manually labeled each message based on available context, including remote server names and temporally relevant application log messages. We used remote hostnames as an indication of whether data was being sent to a server providing application functionality or to a third party. Frequently, messages contained plaintext that aided categorization, e.g., an HTTP GET request containing geographic coordinates. However, 21 agged messages contained binary data. Our investigation indicates these messages were generated by the Google Maps for Mobile [21] and FlurryAgent [20] APIs and contained tainted privacy sensitive data. These conclusions are supported by message transmissions immediately after the application received a tainted parcel from the system location manager. We now expand on our ndings for each category and reect on potential privacy violations. Phone Information: Table 2 shows that 20 out of the 30 applications require permissions to read phone state and the Internet. We found that 2 of the 20 applications transmitted to their server (1) the devices phone num9

ber, (2) the IMSI which is a unique 15-digit code used to identify an individual user on a GSM network, and (3) the ICC-ID number which is a unique SIM card serial number. We veried messages were agged correctly by inspecting the plaintext payload.4 In neither case was the user informed that this information was transmitted off the phone. This nding demonstrates that Androids coarsegrained access control provides insufcient protection against third-party applications seeking to collect sensitive data. Moreover, we found that one application transmits the phone information every time the phone boots. While this application displays a terms of use on rst use, the terms of use does not specify collection of this highly sensitive data. Surprisingly, this application transmits the phone data immediately after install, before rst use. Device Unique ID: The devices IMEI was also exposed by applications. The IMEI uniquely identies a specic mobile phone and is used to prevent a stolen handset from accessing the cellular network. TaintDroid ags indicated that nine applications transmitted the IMEI. Seven out of the nine applications either do not present an End User License Agreement (EULA) or do not specify IMEI collection in the EULA. One of the seven ap-

To appear at the 9th USENIX Symposium on Operating Systems Design and Implementation (OSDI10) plications is a popular social networking application and TaintDroid, 37 were deemed clearly legitimate use. The another is a location-based search application. Furtherags resulted from four applications and the OS itself more, we found two of the seven applications include the while using the Google Maps for Mobile (GMM) API. IMEI when transmitting the devices geographic coordiThe TaintDroid logs indicate an HTTP request with the nates to their content server, potentially repurposing the User-Agent: GMM . . . header, but a binary payIMEI as a client ID. load. Given that GMM functionality includes downloading maps based on geographic coordinates, it is obvious In comparison, two of the nine applications treat the that TaintDroid correctly identied location information IMEI with more care, thus we do not classify them as in the payload. Our manual inspection of each message potential privacy violators. One application displays a along with the network packet trace conrmed that there privacy statement that clearly indicates that the applicawere no false positives. We note that there is a possibiltion collects the device ID. The other uses the hash of ity of false negatives, which is difcult to verify with the the IMEI instead of the number itself. We veried this lack of the source code of the third-party applications. practice by comparing results from two different phones. Location Data to Advertisement Servers: Half of the Summary: Our study of 30 popular applications shows studied applications exposed location data to third-party the effectiveness of the TaintDroid system in accuadvertisement servers without requiring implicit or exrately tracking applications use of privacy sensitive data. plicit user consent. Of the fteen applications, only two While monitoring these applications, TaintDroid generpresented a EULA on rst run; however neither EULA ated no false positives (with the exception of the IMSI indicated this practice. Exposure of location informataint source which we disabled for experiments, see Section occurred both in plaintext and in binary format. tion 8). The ags raised by TaintDroid helped to identify The latter highlights TaintDroids advantages over simpotential privacy violations by the tested applications. ple pattern-based packet scanning. Applications sent loHalf of the studied applications share location data with cation data in plaintext to admob.com, ad.qwapi.com, advertisement servers. Approximately one third of the ads.mobclix.com (11 applications) and in binary format applications expose the device ID, sometimes with the to FlurryAgent (4 applications). The plaintext location phone number and the SIM card serial number. The analexposure to AdMob occurred in the HTTP GET string: ysis was simplied by the taint tag provided by TaintDroid that precisely describes which privacy relevant ...&s=a14a4a93f1e4c68&..&t=062A1CB1D476DE85 B717D9195A6722A9&d%5Bcoord%5D=47.6612278900 data is included in the payload, especially for binary payloads. We also note that there was almost no perceived 00006%2C-122.31589477&... latency while running experiments with TaintDroid. Investigating the AdMob SDK revealed the s= parameter 7 Performance Evaluation is an identier unique to an application publisher, and the coord= parameter provides the geographic coordinates. We now study TaintDroids taint tracking overhead. For FlurryAgent, we conrmed location exposure by Experiments were performed on a Google Nexus One the following sequence of events. First, a component running Android OS version 2.1 modied for TaintDroid. named FlurryAgent registers with the location manWithin the interpreted environment, TaintDroid incurs ager to receive location updates. Then, TaintDroid log the same performance and memory overhead regardless messages show the application receiving a tainted parof the existence of taint markings. Hence, we only need cel from the location manager. Finally, the application to ensure le access includes appropriate taint tags. reports sending report to http://data.flurry. 7.1 Macrobenchmarks com/aar.do after receiving the tainted parcel. Our experimentation indicates these fteen applicaDuring the application study, we anecdotally observed tions collect location data and send it to advertisement limited performance overhead. We hypothesize that this servers. In some cases, location data was transmitted is because: 1) most applications are primarily in a wait to advertisement servers even when no advertisement state, and 2) heavyweight operations (e.g., screen upwas displayed in the application. However, we note that dates and webpage rendering) occur in unmonitored naTaintDroid helped us verify that three of the studied aptive libraries. plications (not included in the Table 3) only transmitted To gain further insight into perceived overhead, we location data per users request to pull localized content devised ve macrobenchmarks for common high-level from their servers. This nding demonstrates the imporsmartphone operations. Each experiment was measured tance of monitoring exercised functionality of an appli50 times and observed 95% condence intervals at least cation that reects how the application actually uses or an order of magnitude less than the mean. In each case, abuses the granted permissions. we excluded the rst run to remove unrelated initializaLegitimate Flags: Out of 105 connections agged by tion costs. Experimental results are shown in Table 4. 10

To appear at the 9th USENIX Symposium on Operating Systems Design and Implementation (OSDI10)
2000

Table 4: Macrobenchmark Results

App Load Time Address Book (create) Address Book (read) Phone Call Take Picture Android 63 ms 348 ms 101 ms 96 ms 1718 ms

CaffeineMark 3.0 Score

TaintDroid 65 ms 367 ms 119 ms 106 ms 2216 ms

1800 1600 1400 1200 1000 800 600 400 200 sieve loop logic string float

Android TaintDroid

Application Load Time: The application load time measures from when Androids Activity Manager receives a command to start an activity component to the time the activity thread is displayed. This time includes application resolution by the Activity Manager, IPC, and graphical display. TaintDroid adds only 3% overhead, as the operation is dominated by native graphics libraries. Address Book: We built a custom application to create, read, and delete entries for the phones address book, exercising both le read and write. Create used three SQL transactions while read used two SQL transactions. The subsequent delete operation was lazy, returning in 0 ms, and hence was excluded from our results. TaintDroid adds approximately 5.5% and 18% overhead for address book entry creates and reads, respectively. The additional overhead for reads can be attributed to le taint propagation. The data is not tainted before create, hence no le propagation is needed. Note that the user experiences less than 20 ms overhead when creating or viewing a contact. Phone Call: The phone call benchmark measured the time from pressing dial to the point at which the audio hardware was recongured to in call mode. TaintDroid only adds 10 ms per phone call setup (10% overhead), which is signicantly less than call setup in the network, which takes on the order of seconds. Take Picture: The picture benchmark measures from the time the user presses the take picture button until the preview display is re-enabled. This measurement includes the time to capture a picture from the camera and save the le to the SDcard. TaintDroid adds 498 ms to the 1718 ms needed by Android to take a picture (an overhead of 29%). A portion of this overhead can be attributed to to additional le operations required for taint propagation (one getxattr/setxattr pair per written data buffer). Note that some of this overhead can be reduced by eliminating redundant taint propagation. That is, only the taint tag for the rst data buffer written to le needs to be propagated. For example, the current taint tag could be associated with the le descriptor.

method Overall

CaffeineMark 3.0 Benchmark

Figure 5: Microbenchmark of Java overhead. Error bars indicate 95% condence intervals. scoring metric only useful for relative comparisons. The results are consistent with implementationspecic expectations. The overhead incurred by TaintDroid is smallest for the benchmarks dominated by arithmetic and logic operations. The taint propagation for these operations is simple, consisting of an additional copy of spatially local memory. The string benchmark, on the other hand, experiences the greatest overhead. This is most likely due to the additional memory comparisons that occur when the JNI propagation heuristic checks for string objects in method prototypes. The overall results indicate cumulative score across individual benchmarks. CaffeineMark documentation states that scores roughly correspond to the number of Java instructions executed per second. Here, the unmodied Android system had an average score of 1121, and TaintDroid measured 967. TaintDroid has a 14% overhead with respect to the unmodied system. We also measured memory consumption during the CaffeineMark benchmark. The benchmark consumed 21.28 MB on the unmodied system and 22.21 MB while running on TaintDroid, indicating a 4.4% memory overhead. Note that much of an Android processs memory is used by the zygote runtime environment. These native library memory pages are shared between applications to reduce the overall system memory footprint and require taint tracking. Given that TaintDroid stores 32 taint markings (4 bytes) for each 32-bit variable in the interpreted environment (regardless of taint state), this overhead is expected.

7.2

Java Microbenchmark

7.3

IPC Microbenchmark

Figure 5 shows the execution time results of a Java microbenchmark. We used an Android port of the standard CaffeineMark 3.0 [43]. CaffeineMark uses an internal 11

The IPC benchmark considers overhead due to the parcel modications. For this experiment, we developed client and service applications that perform binder transactions as fast as possible. The service manipulates ac-

To appear at the 9th USENIX Symposium on Operating Systems Design and Implementation (OSDI10) or write direct variant is used, which anecdotally ocTable 5: IPC Throughput Test (10,000 msgs). curred with minimal frequency. Similar implementation Android TaintDroid limitations exist with the sun.misc.Unsafe class, which Time (s) 8.58 10.89 also operates on native addresses.
Memory (client) Memory (service) 21.06MB 18.92MB 21.88MB 19.48MB

count objects (a username string and a balance integer) and provides two interfaces: setAccount() and getAccount(). The experiment measures the time for the client to invoke each interface pair 10,000 times. Table 5 summarizes the results of the IPC benchmark. TaintDroid was 27% slower than Android. TaintDroid only adds four bytes to each IPC object, therefore overhead due to data size is unlikely. The more likely cause of the overhead is the continual copying of taint tags as values are marshalled into and out of the parcel byte buffer. Finally, TaintDroid used 3.5% more memory than Android, which is comparable to the consumption observed during the CaffeineMark benchmarks.

Discussion

Taint Source Limitations: While TaintDroid is very effective for tracking sensitive information, it causes signicant false positives when the tracked information contains conguration identiers. For example, the IMSI numeric string consists of a Mobile Country Code (MCC), Mobile Network Code (MNC), and Mobile Station Identier Number (MSIN), which are all tainted together.5 Android uses the MCC and MNC extensively as conguration parameters when communicating other data. This causes all information in a parcel to become tainted, eventually resulting in an explosion of tainted information. Thus, for taint sources that contain conguration parameters, tainting individual variables within parcels is more appropriate. However, as our analysis results in Section 6 show, message-level taint tracking is effective for the majority of our taint sources.

Related Work

Approach Limitations: TaintDroid only tracks data ows (i.e., explicit ows) and does not track control ows (i.e., implicit ows) to minimize performance overhead. Section 6 shows that TaintDroid can track applications expected data exposure and also reveal suspicious actions. However, applications that are truly malicious can game our system and exltrate privacy sensitive information through control ows. Fully tracking control ow requires static analysis [14, 37], which is not applicable to analyzing third-party applications whose source code is unavailable. Direct control ows can be tracked dynamically if a taint scope can be determined [53]; however, DEX does not maintain branch structures that TaintDroid can leverage. On-demand static analysis to determine method control ow graphs (CFGs) provides this context [39]; however, TaintDroid does not currently perform such analysis in order to avoid false positives and signicant performance overhead. Our data ow taint propagation logic is consistent with existing, well known, taint tracking systems [7, 57]. Finally, once information leaves the phone, it may return in a network reply. TaintDroid cannot track such information. Implementation Limitations: Android uses the Apache Harmony [3] implementation of Java with a few custom modications. This implementation includes support for the PlatformAddress class, which contains a native address and is used by DirectBuffer objects. The le and network IO APIs include write and read direct variants that consume the native address from a DirectBuffer. TaintDroid does not currently track taint tags on DirectBuffer objects, because the data is stored in opaque native data structures. Currently, TaintDroid logs when a read 12

Mobile phone host security is a growing concern. OS-level protections such as Kirin [18], Saint [42], and Security-by-Contract [15] provide enhanced security mechanisms for Android and Windows Mobile. These approaches prevent access to sensitive information; however, once information enters the application, no additional mediation occurs. In systems with larger displays, a graphical widget [27] can help users visualize sensor access policies. Mulliner et al. [36] provide information tracking by labeling smartphone processes based on the interfaces they access, effectively limiting access to future interfaces based on acquired labels. Decentralized information ow control (DIFC) enhanced operating systems such as Asbestos [52] and HiStar [60] label processes and enforce access control based on Dennings lattice model for information ow security [13]. Flume [30] provides similar enhancements for legacy OS abstractions. DEFCon [34] uses a logic similar to these DIFC OSes, but focuses on events and modies a Java runtime with lightweight isolation. Related to these system-level approaches, PRECIP [54] labels both processes and shared kernel objects such as the clipboard and display buffer. However, these process-level information ow models are coarse grained and cannot track sensitive information within untrusted applications. Tools that analyze applications for privacy sensitive information leaks include Privacy Oracle [28] and TightLip [59]. These tools investigate applications while treating them as a black box, thus enabling analysis of off-the-shelf applications. However, this black-box analysis tool becomes ineffective when applications use encryption prior to releasing sensitive information.

To appear at the 9th USENIX Symposium on Operating Systems Design and Implementation (OSDI10) Language-based information ow security [46] exfor les and SQL databases to serialize and de-serialize tends existing programming languages by labeling variobjects and policy with byte-level granularity. Taintables with security attributes. Compilers use the secuDroids interpreted code taint propagation bears similarrity labels to generate security proofs, e.g., Jif [37, 38] ity to some of these works. However, TaintDroid imand SLam [24]. Laminar [45] provides DIFC guarantees plements system-wide information ow tracking, seambased on programmer dened security regions. However, lessly connecting interpreter taint tracking with a range these languages require careful development and are ofof operating system sharing mechanisms. ten incompatible with legacy software designs [25]. 10 Conclusions Dynamic taint analysis provides information trackWhile some mobile phone operating systems allow ing for legacy programs. The approach has been used users to control applications access to sensitive informato enhance system integrity (e.g., defend against softtion, such as location sensors, camera images, and conware attacks [41, 44, 8]) and condentiality (e.g., distact lists, users lack visibility into how applications use cover privacy exposure [57, 16, 61]), as well as track their private data. To address this, we present TaintDroid, Internet worms [9]. Dynamic tracking approaches an efcient, system-wide information ow tracking tool range from whole-system analysis using hardware extenthat can simultaneously track multiple sources of sensisions [51, 11, 50] and emulation environments [7, 57] tive data. A key design goal of TaintDroid is efciency, to per-process tracking using dynamic binary translaand TaintDroid achieves this by integrating four grantion (DBT) [6, 44, 8, 61]. The performance and memularities of taint propagation (variable-level, messageory overhead associated with dynamic tracking has relevel, method-level, and le-level) to achieve a 14% persulted in an array of optimizations, including optimizing formance overhead on a CPU-bound microbenchmark. context switches [44], on-demand tracking [26] based We also used our TaintDroid implementation to study on hypervisor introspection, and function summaries for the behavior of 30 popular third-party applications, chocode with known information ow properties [61]. If sen at random from the Android Marketplace. Our study source code is available, signicant performance imrevealed that two-thirds of the applications in our study provements can be achieved by automatically instruexhibit suspicious handling of sensitive data, and that 15 menting legacy programs with dynamic tracking funcof the 30 applications reported users locations to remote tionality [56, 31]. Automatic instrumentation has also advertising servers. Our ndings demonstrate the effecbeen performed on x86 binaries [47], providing a comtiveness and value of enhancing smartphone platforms promise between source code translation and DBT. Our with monitoring tools such as TaintDroid. TaintDroid design was inspired by these prior works, but addressed different challenges unique to mobile phones. Acknowledgments To our knowledge, TaintDroid is the rst taint tracking We would like to thank Intel Labs, Berkeley and system for a mobile phone and is the rst dynamic taint Seattle for its support and feedback during the design analysis system to achieve practical system-wide analyand prototype implementation of this work. We thank sis through the integration of tracking multiple data obJayanth Kannon, Stuart Schechter, and Ben Greenstein ject granularities. for their feedback during the writing of this paper. We Finally, dynamic taint analysis has been applied to viralso thank Kevin Butler, Stephen McLaughlin, Machigar tual machines and interpreters. Haldar et al. [22] inOngtang, and the SIIS lab as a whole for their helpful strument the Java String class with taint tracking to precomments. This material is based upon work supported vent SQL injection attacks. WASP [23] has similar moby the National Science Foundation. William Enck and tivations; however, it uses positive tainting of individPatrick McDaniel were partially supported by NSF Grant ual characters to ensure the SQL query contains only No. CNS-0905447, CNS-0721579 and CNS-0643907. high-integrity substrings. Chandra and Franz [5] proLandon Cox and Peter Gilbert were partially supported pose ne-grained information ow tracking within the by NSF CAREER Award CNS-0747283. Any opinions, JVM and instrument Java byte-code to aid control ow ndings, and conclusions or recommendations expressed analysis. Similarly, Nair et al. [39] instrument the Kaffe in this material are those of the author(s) and do not necJVM. Vogt et al. [53] instrument a Javascript interpreter essarily reect the views of the National Science Founto prevent cross-site scripting attacks. Xu et al. [56] audation. tomatically instrument the PHP interpreter source code References with dynamic information tracking to prevent SQL injection attacks. Finally, the Resin [58] environment for [1] Android. http://www.android.com. PHP and Python uses data ow tracking to prevent an as[2] Android Market. http://market.android.com. sortment of Web application attacks. When data leaves [3] Apache Harmony Open Source Java Platform. http:// the interpreted environment, Resin implements lters harmony.apache.org. 13

To appear at the 9th USENIX Symposium on Operating Systems Design and Implementation (OSDI10)
[4] A PPLE , I NC . Apples App Store Downloads Top Three Billion. http://www.apple.com/pr/library/2010/ 01/05appstore.html, January 2010. [5] C HANDRA , D., AND F RANZ , M. Fine-Grained Information Flow Analysis and Enforcement in a Java Virtual Machine. In Proceedings of the 23rd Annual Computer Security Applications Conference (ACSAC) (December 2007). [6] C HENG , W., Z HAO , Q., Y U , B., AND H IROSHIGE , S. TaintTrace: Efcient Flow Tracing with Dyanmic Binary Rewriting. In Proceedings of the IEEE Symposium on Computers and Communications (ISCC) (June 2006), pp. 749754. [7] C HOW, J., P FAFF , B., G ARFINKEL , T., C HRISTOPHER , K., AND ROSENBLUM , M. Understanding Data Lifetime via Whole System Simulation. In Proceedings of the 13th USENIX Security Symposium (August 2004). [8] C LAUSE , J., L I , W., AND O RSO , A. Dytan: A Generic Dynamic Taint Analysis Framework. In Proceedings of the 2007 international symposium on Software testing and analysis (2007), pp. 196206. [9] C OSTA , M., C ROWCROFT, J., C ASTRO , M., ROWSTRON , A., Z HOU , L., Z HANG , L., AND BARHAM , P. Vigilante: End-toEnd Containment of Internet Worms. In Proceedings of the ACM Symposium on Operating Systems Principles (2005). [10] C OX , L. P., AND G ILBERT, P. RedFlag: Reducing Inadvertent Leaks by Personal Machines. Tech. Rep. TR-2009-02, Duke University, 2009. [11] C RANDALL , J. R., AND C HONG , F. T. Minos: Control Data Attack Prevention Orthogonal to Memory Model. In Proceedings of the International Symposium on Microarchitecture (December 2004), pp. 221232. [12] DAVIES , C. iPhone spyware debated as app library phones home. http://www.slashgear. com/iphone-spyware-debated-as-applibrary-phones-home-1752491/, August 17, 2009. [13] D ENNING , D. E. A Lattice Model of Secure Information Flow. Communications of the ACM 19, 5 (May 1976), 236243. [14] D ENNING , D. E., AND D ENNING , P. J. Certication of Programs for Secure Information Flow. Communications of the ACM 20, 7 (July 1977). [15] D ESMET, L., J OOSEN , W., M ASSACCI , F., P HILIPPAERTS , P., P IESSENS , F., S IAHAAN , I., AND VANOVERBERGHE , D. Security-by-contract on the .NET platform. Information Security Technical Report 13, 1 (January 2008), 2532. [16] E GELE , M., K RUEGEL , C., K IRDA , E., Y IN , H., AND S ONG , D. Dyanmic Spyware Analysis. In Proceedings of the USENIX Annual Technical Conference (June 2007), pp. 233246. [17] E NCK , W., G ILBERT, P., C HUN , B.-G., C OX , L. P., J UNG , J., M C DANIEL , P., AND S HETH , A. N. TaintDroid: An Information-Flow Tracking System for Realtime Privacy Monitoring on Smartphones. Tech. Rep. NAS-TR-0120-2010, Network and Security Research Center, Department of Computer Science and Engineering, Pennsylvania State University, University Park, PA, USA, August 2010. [18] E NCK , W., O NGTANG , M., AND M C DANIEL , P. On Lightweight Mobile Phone Application Certication. In Proceedings of the 16th ACM Conference on Computer and Communications Security (CCS) (November 2009). [19] F ITZPATRICK , M. Mobile that allows bosses to snoop on staff developed. BBC News, March 2010. http://news.bbc. co.uk/2/hi/technology/8559683.stm. [20] Flurry Mobile Application Analytics. http://www.flurry. com/product/technical-info.html. [21] Google Maps for Mobile. http://www.google.com/ mobile/products/maps.html. [22] H ALDAR , V., C HANDRA , D., AND F RANZ , M. Dynamic Taint Propagation for Java. In Proceedings of the 21st Annual Computer Security Applications Conference (ACSAC) (December 2005), pp. 303311. [23] H ALFOND , W. G., O RSO , A., AND M ANOLIOS , P. WASP: Protecting Web Applications Using Positive Tainting and SyntaxAware Evaluation. IEEE Transactions on Software Engineering 34, 1 (2008), 6581. [24] H EINTZE , N., AND R IECKE , J. G. The SLam Calculus: Programming with Secrecy and Integrity. In Proceedings of the Symposium on Principles of Programming Languages (POPL) (1998), pp. 365377. [25] H ICKS , B., A HMADIZADEH , K., AND M C DANIEL , P. Understanding practical application development in security-typed languages. In 22st Annual Computer Security Applications Conference (ACSAC) (2006), pp. 153164. [26] H O , A., F ETTERMAN , M., C LARK , C., WARFIELD , A., AND H AND , S. Practical Taint-Based Protection using Demand Emulation. In Proceedings of the European Conference on Computer Systems (EuroSys) (2006), pp. 2941. [27] H OWELL , J., AND S CHECHTER , S. What You See is What they Get: Protecting users from unwanted use of microphones, camera, and other sensors. In Proceedings of Web 2.0 Security and Privacy Workshop (2010). [28] J UNG , J., S HETH , A., G REENSTEIN , B., W ETHERALL , D., M AGANIS , G., AND KOHNO , T. Privacy Oracle: A System for Finding Application Leaks with Black Box Differential Testing. In Proceedings of ACM CCS (2008). [29] K ING , D., H ICKS , B., H ICKS , M., AND JAEGER , T. Implicit Flows: Cant Live with Em, Cant Live without Em. In Proceedings of the International Conference on Information Systems Security (2008). [30] K ROHN , M., Y IP, A., B RODSKY, M., C LIFFER , N., K AASHOEK , M. F., KOHLER , E., AND M ORRIS , R. Information Flow Control for Standard OS Abstractions. In Proceedings of ACM Symposium on Operating Systems Principles (2007). [31] L AM , L. C., AND CKER C HIUEH , T. A General Dynamic Information Flow Tracking Framework for Security Applications. In Proceedings of the Annual Computer Security Applications Conference (ACSAC) (2006). [32] L IANG , S. Java Native Interface: Programmers Guide and Specication. Prentice Hall PTR, 1999. [33] L OOKOUT. Introducing the App Genome http://blog.mylookout.com/2010/07/ introducing-the-app-genome-project/, 2010. Project. July

[34] M IGLIAVACCA , M., PAPAGIANNIS , I., E YERS , D. M., S HAND , B., BACON , J., AND P IETZUCH , P. DEFCon: High-Performance Event Processing with Information Security. In PROCEEDINGS of the USENIX Annual Technical Conference (2010). [35] M OREN , D. Retrievable iPhone numbers mean potential privacy issues. http://www.macworld.com/article/ 143047/2009/09/phone_hole.html, September 29, 2009. [36] M ULLINER , C., V IGNA , G., DAGON , D., AND L EE , W. Using Labeling to Prevent Cross-Service Attacks Against Smart Phones. In Proceedings of Detection of Intrusions and Malware & Vulnerability Assessment (DIMVA) (2006). [37] M YERS , A. C. JFlow: Practical Mostly-Static Information Flow Control. In Proceedings of the ACM Symposium on Principles of Programming Langauges (POPL) (January 1999).

14

To appear at the 9th USENIX Symposium on Operating Systems Design and Implementation (OSDI10)
[38] M YERS , A. C., AND L ISKOV, B. Protecting Privacy Using the Decentralized Label Model. ACM Transactions on Software Engineering and Methodology 9, 4 (October 2000), 410442. [39] NAIR , S. K., S IMPSON , P. N., C RISPO , B., AND TANENBAUM , A. S. A Virtual Machine Based Information Flow Control System for Policy Enforcement. In the 1st International Workshop on Run Time Enforcement for Mobile and Distributed Systems (REM) (2007). [40] N EWSOME , J., M C C AMANT, S., AND S ONG , D. Measuring channel capacity to distinguish undue inuence. In ACM SIGPLAN Workshop on Programming Languages and Analysis for Security (2009). [41] N EWSOME , J., AND S ONG , D. Dynamic Taint Analysis for Automatic Detection, Analysis, and Signature Generation of Exploits on Commodity Software. In Proc. of Network and Distributed System Security Symposium (2005). [42] O NGTANG , M., M C L AUGHLIN , S., E NCK , W., AND M C DANIEL , P. Semantically Rich Application-Centric Security in Android. In Proceedings of the 25th Annual Computer Security Applications Conference (ACSAC) (2009). [43] P ENDRAGON S OFTWARE C ORPORATION. CaffeineMark 3.0. http://www.benchmarkhq.ru/cm30/. [44] Q IN , F., WANG , C., L I , Z., SEOP K IM , H., Z HOU , Y., AND W U , Y. LIFT: A Low-Overhead Practical Information Flow Tracking System for Detecting Security Attacks. In Proceedings of the 39th Annual IEEE/ACM International Symposium on Microarchitecture (2006), pp. 135148. [45] ROY, I., P ORTER , D. E., B OND , M. D., M C K INLEY, K. S., AND W ITCHEL , E. Laminar: Practical Fine-Grained Decentralized Information Flow Control. In Proceedings of Programming Language Design and Implementation (2009). [46] S ABELFELD , A., AND M YERS , A. C. Language-based information-ow security. IEEE Journal on Selected Areas in Communication 21, 1 (January 2003), 519. [47] S AXENA , P., S EKAR , R., AND P URANIK , V. Efcient FineGrained Binary Instrumentation with Applications to TaintTracking. In Proceedings of the IEEE/ACM symposium on Code Generation and Optimization (CGO) (2008). [48] S CHWARTZ , E. J., AVGERINOS , T., AND B RUMLEY, D. All You Ever Wanted to Know about Dynamic Taint Analysis and Forward Symbolic Execution (but might have been afraid to ask). In IEEE Symposium on Security and Privacy (2010). [49] S LOWINSKA , A., AND B OS , H. Pointless Tainting? Evaluating the Practicality of Pointer Tainting. In Proceedings of the European Conference on Computer Systems (EuroSys) (April 2009), pp. 6174. [50] S UH , G. E., L EE , J. W., Z HANG , D., AND D EVADAS , S. Secure Program Execution via Dynamic Information Flow Tracking. In Proceedings of Architectural Support for Programming Languages and Operating Systems (2004). [51] VACHHARAJANI , N., B RIDGES , M. J., C HANG , J., R ANGAN , R., OTTONI , G., B LOME , J. A., R EIS , G. A., VACHHARA JANI , M., AND AUGUST, D. I. RIFLE: An Architectural Framework for User-Centric Information-Flow Security. In Proceedings of the 37th annual IEEE/ACM International Symposium on Microarchitecture (2004), pp. 243254. [52] VANDEBOGART, S., E FSTATHOPOULOS , P., KOHLER , E., K ROHN , M., F REY, C., Z IEGLER , D., K AASHOEK , F., M OR ` RIS , R., AND M AZI E RES , D. Labels and Event Processes in the Asbestos Operating System. ACM Transactions on Computer Systems (TOCS) 25, 4 (December 2007). [53] VOGT, P., N ENTWICH , F., J OVANOVIC , N., K IRDA , E., K RUEGEL , C., AND V IGNA , G. Cross-Site Scripting Prevention with Dynamic Data Tainting and Static Analysis. In Proc. of Network & Distributed System Security (2007). [54] WANG , X., L I , Z., L I , N., AND C HOI , J. Y. PRECIP: Towards Practical and Retrottable Condential Information Protection. In Proceedings of 15th Network and Distributed System Security Symposium (NDSS) (2008). [55] WhatApp. 2010. http://www.whatapp.org. Accessed April

[56] X U , W., B HATKAR , S., AND S EKAR , R. Taint-Enhanced Policy Enforcement: A Practical Approach to Defeat a Wide Range of Attacks. In Proceedings of the USENIX Security Symposium (August 2006), pp. 121136. [57] Y IN , H., S ONG , D., E GELE , M., K RUEGEL , C., AND K IRDA , E. Panorama: Capturing System-wide Information Flow for Malware Detection and Analysis. In Proceedings of ACM Computer and Communications Security (2007). [58] Y IP, A., WANG , X., Z ELDOVICH , N., AND K AASHOEK , M. F. Improving Application Security with Data Flow Assertions. In Proceedings of the ACM Symposium on Operating Systems Principles (Oct. 2009). [59] Y UMEREFENDI , A. R., M ICKLE , B., AND C OX , L. P. TightLip: Keeping Applications from Spilling the Beans. In Proceedings of the 4th USENIX Symposium on Network Systems Design & Implementation (NSDI) (2007). [60] Z ELDOVICH , N., B OYD -W ICKIZER , S., KOHLER , E., AND ` M AZI E RES , D. Making Information Flow Explicit in HiStar. In Proceedings of the 7th symposium on Operating Systems Design and Implementation (OSDI) (2006). [61] Z HU , D., J UNG , J., S ONG , D., KOHNO , T., AND W ETHERALL , D. Privacy Scope: A Precise Information Flow Tracking System For Finding Application Leaks. Tech. Rep. EECS-2009-145, Department of Computer Science, UC Berkeley, 2009.

Notes
1 A similar approach can be applied to just-in-time compilation by inserting tracking code within the generated binary. 2 Only 11 internal VM methods were added between versions 1.5 and 2.1 (primarily for debugging and proling) 3 There was a relatively small number of JNI methods that did not either have a Java interface or C/C++ implementation. These unusable methods were excluded from our survey. 4 Because of the limitation of the IMSI taint source as discussed in Section 8, we disabled the IMSI taint source for experiments. Nonetheless, TaintDroids ag of the ICC-ID and the phone number led us to nd the IMSI contained in the same payload. 5 Regardless of the string separation, the MCC and MNC are identiers that warrant taint sources.

15