What's in Your Dongle and Bank Account? Mandatory and Discretionary Protection of Android External Resources