ShamDroid: gracefully degrading functionality in the presence of limited resource access

Given a program whose functionality depends on access to certain external resources, we investigate the question of how to gracefully degrade functionality when a subset of those resources is unavailable. The concrete setting motivating this problem statement is mobile applications, which rely on contextual data (e.g., device identifiers, user location and contacts, etc.) to fulfill their functionality. In particular, we focus on the Android platform, which mediates access to resources via an installation-time permission model. On the one hand, granting an app the permission to access a resource (e.g., the device ID) entails privacy threats (e.g., releasing the device ID to advertising servers). On the other hand, denying access to a resource could render the app useless (e.g., if inability to read the device ID is treated as an error state). Our goal is to specialize an existing Android app in such a way that it is disabled from accessing certain sensitive resources (or contextual ...

• Type: Journal
• Year: 2015
• Where: OOPSLA
• Authors: Lucas Brutschy, Pietro Ferrara, Omer Tripp, Marco Pistoia
• Keywords: OOPSLA 2015, Security Privacy