A team of cybersecurity researchers has discovered that a large number of cell phone applications contain hardcoded secrets allowing others to access private data or block content provided by users.
The studys findings: that the apps on mobile phones might have hidden or harmful behaviors about which end users know little to nothing, said Zhiqiang Lin, an associate professor of computer science and engineering at The Ohio State University and senior author of the study.
The study has been accepted for publication by the 2020 IEEE Symposium on Security and Privacy in May. The conference has moved online because of the global coronavirus (COVID-19) outbreak.
Typically, mobile apps engage with users by processing and responding to user input, Lin said. For instance, users often need to type certain words or sentences, or click buttons and slide screens. Those inputs prompt an app to perform different actions.
For this study, the research team evaluated 150,000 apps. They selected the top 100,000 based on the number of downloads from the Google Play store, the top 20,000 from an alternative market, and 30,000 from pre-installed apps on Android smartphones.
They found that 12,706 of those apps, about 8.5 percent, contained something the research team labeled backdoor secrets hidden behaviors within the app that accept certain types of content to trigger behaviors unknown to regular users. They also found that some apps have built-in master passwords, which allow anyone with that password to access the app and any private data contained within it. And some apps, they found, had secret access keys that could trigger hidden options, including bypassing payment.
Both users and developers are all at risk if a bad guy has obtained these backdoor secrets, Lin said. In fact, he said, motivated attackers could reverse engineer the mobile apps to discover them.
Qingchuan Zhao, a graduate research assistant at Ohio State and lead author of this study, said that developers often wrongly assume reverse engineering of their apps is not a legitimate threat.
A key reason why mobile apps contain these backdoor secrets is because developers misplaced the trust, Zhao said. To truly secure their apps, he said, developers need to perform security-relevant user-input validations and push their secrets on the backend servers.
The team also found another 4,028 apps about 2.7 percent that blocked content containing specific keywords subject to censorship, cyber bullying or discrimination. That apps might limit certain types of content was not surprising but the way that they did it was: validated locally instead of remotely, Lin said.
On many platforms, user-generated content may be moderated or filtered before it is published, he said, noting that several social media sites, including Facebook, Instagram and Tumblr, already limit the content users are permitted to publish on those platforms.
Unfortunately, there might exist problems for example, users know that certain words are forbidden from a platforms policy, but they are unaware of examples of words that are considered as banned words and could result in content being blocked without users knowledge, he said. Therefore, end users may wish to clarify vague platform content policies by seeing examples of banned words.
In addition, he said, researchers studying censorship may wish to understand what terms are considered sensitive.
The team developed an open source tool, named InputScope, to help developers understand weaknesses in their apps and to demonstrate that the reverse engineering process can be fully automated.
Other authors on this work include Chaoshun Zuo at Ohio State, Brendan Dolan-Gavitt at New York University, and Giancarlo Pellegrino at CISPA Helmholtz Center for Information Security.
See the rest here:
- Russian Censorship: Tor, Anonymous VPNs Could Be Target Of Next Crackdown, MP Warns - February 12th, 2015 [February 12th, 2015]
- Russian Censorship: Tor, Anonymous VPNs Could Be Target Of Next Crackdown, Kremlin Warns - February 12th, 2015 [February 12th, 2015]
- Censorship is no way to hold a debate - February 12th, 2015 [February 12th, 2015]
- Irreverent: A Celebration of Censorship - February 12th, 2015 [February 12th, 2015]
- More online censorship coming to closed countries, says report - February 12th, 2015 [February 12th, 2015]
- New book retraces the idea of censorship - February 12th, 2015 [February 12th, 2015]
- Strike Against SOPA & PIPA - February 12th, 2015 [February 12th, 2015]
- Censorship - Wikipedia, the free encyclopedia - February 12th, 2015 [February 12th, 2015]
- Sonam Kapoor: I Don't Believe In Censorship! Supports AIB roast! - Video - February 12th, 2015 [February 12th, 2015]
- FINAL FANTASY XIV: Unnecessary Censorship #4 - Video - February 12th, 2015 [February 12th, 2015]
- China 'great firewall' expands to step up Internet censorship - Video - February 12th, 2015 [February 12th, 2015]
- DIRTY GUILD WARS 2: The Voice Cast - Unnecessary Censorship - Video - February 12th, 2015 [February 12th, 2015]
- Into the Fray Episode 47: NFL Censorship - Video - February 12th, 2015 [February 12th, 2015]
- Weekly Rewind "Feb 1st" Facebook Censorship? - Video - February 12th, 2015 [February 12th, 2015]
- Street Fighter 3 2nd Impact CENSORED - Akuma's Defeat Portrait's Blood - Video Game Censorship - Video - February 12th, 2015 [February 12th, 2015]
- Inside WM: Is Censorship Ever Okay? - Ep. 3 - Video - February 12th, 2015 [February 12th, 2015]
- China Targets Virtual Private Networks In Censorship Push - Video - February 12th, 2015 [February 12th, 2015]
- Tricks to Beat Internet Censorship (On Assignment) - Video - February 12th, 2015 [February 12th, 2015]
- Censorship and Anal Sex - Video Clip with Remi Newman - Video - February 12th, 2015 [February 12th, 2015]
- Censorship and Graphic Content Warnings - Video - February 12th, 2015 [February 12th, 2015]
- KIDS vs. FOOD - Unnecessary Censorship - Video - February 12th, 2015 [February 12th, 2015]
- Christian Censorship of Truthiracy - Video - February 12th, 2015 [February 12th, 2015]
- FaceBook Censorship Video Featuring The M48 War Hammer - Video - February 12th, 2015 [February 12th, 2015]
- Youtube Media Censorship - #NWO 134 - Video - February 12th, 2015 [February 12th, 2015]
- Listen To "Cyberspace Spirit," China's Anthem To Internet Censorship - February 12th, 2015 [February 12th, 2015]
- Facebook self-censorship: What happens to the posts you ... - February 12th, 2015 [February 12th, 2015]
- Unnecessary Censorship of a bunch of Cartoons! - Video - February 12th, 2015 [February 12th, 2015]
- DAT CENSORSHIP! - Let's Play Saints Row IV #3 (Playthrough) - Video - February 12th, 2015 [February 12th, 2015]
- The Rundown Live #414 Open Lines (Corruption,Waking Up,Censorship) - Video - February 12th, 2015 [February 12th, 2015]
- Facebook To Implement Chinese Style Internet Censorship - Video - February 12th, 2015 [February 12th, 2015]
- Paris Fashion Week Debuts Butt Plugs in Reaction to Censorship - Video - February 12th, 2015 [February 12th, 2015]
- Facebook Censorship: What They're Not Telling You - Video - February 12th, 2015 [February 12th, 2015]
- Best of Unnecessary Censorship Compilation by Jimmy Kimmel - Video - February 12th, 2015 [February 12th, 2015]
- Censorship: When Truth Becomes a Casualty - Video - February 12th, 2015 [February 12th, 2015]
- Ice Climber CENSORED - Yeti/Seal Enemy - Video Game Censorship - Video - February 12th, 2015 [February 12th, 2015]
- FaceBook Censorship Video Featuring The M48 Tomahawk - Video - February 12th, 2015 [February 12th, 2015]
- Censorship: The Story Telling Podcast #73 - Video - February 12th, 2015 [February 12th, 2015]
- Rape scene in Hotline Miami 2 and censorship - The Tara Show - Video - February 12th, 2015 [February 12th, 2015]
- FINAL FANTASY XIV: Unnecessary Censorship #3 - Video - February 12th, 2015 [February 12th, 2015]
- Destiny Unnecessary Censorship - Censored Cutscenes - Video - February 12th, 2015 [February 12th, 2015]
- What's Cool in China? Censorship, Teenage Couples, Gay Guys - Video - February 12th, 2015 [February 12th, 2015]
- YOUR Thumbs UP Vanish! + Google Censorship...a Way Around It - Video - February 12th, 2015 [February 12th, 2015]
- Zoom Censorship Examples 9-11 to Bosoms Version 2 - Video - February 12th, 2015 [February 12th, 2015]
- Let's Play The Forest | Part 2 | Censorship! - Video - February 12th, 2015 [February 12th, 2015]
- INTEL Museum censorship - Video - February 14th, 2015 [February 14th, 2015]
- Proxy Database - Access Restricted Information, Bypass Censorship! - Video - February 14th, 2015 [February 14th, 2015]
- Criminal Girls Invite Only CENSORED - Punish/Motivate Time/Spanking - Video Game Censorship - Video - February 14th, 2015 [February 14th, 2015]
- Let's Try: Stay Dead Evolution: Nazi Censorship - Video - February 14th, 2015 [February 14th, 2015]
- Loser Laowai on Censorship in China Part 1 - Video - February 14th, 2015 [February 14th, 2015]
- Censorship? - - Project Censored - February 15th, 2015 [February 15th, 2015]
- Censorship | American Civil Liberties Union - February 15th, 2015 [February 15th, 2015]
- Censorship Update: My channel is back! - Video - February 15th, 2015 [February 15th, 2015]
- Alex Kidd In The Enchanted Castle CENSORED - Rock Paper Scissors - Video Game Censorship - Video - February 15th, 2015 [February 15th, 2015]
- Internet Censorship - Big Brother is Watching Everything - YouTube - Video - February 15th, 2015 [February 15th, 2015]
- What is Censorship? - Global Internet Liberty Campaign ... - February 16th, 2015 [February 16th, 2015]
- GSC Owner Forces Censorship of Youtube Video - Video - February 16th, 2015 [February 16th, 2015]
- Before It's News Lisa Haven Used To Be A Skeptic! (On Chrislam, Facebook Censorship, The Madhi) - Video - February 16th, 2015 [February 16th, 2015]
- Mortal Kombat Shaolin Monks CENSORED - Intro Cutscene/Movie - Video Game Censorship - Video - February 16th, 2015 [February 16th, 2015]
- Top Censored Gaming - Sexy Edition Vol. 1 - Best Video Game Censorship - Video - February 16th, 2015 [February 16th, 2015]
- Soul Calibur CENSORED - Mitsurugi/Arthur Character - Video Game Censorship - Video - February 16th, 2015 [February 16th, 2015]
- Censorship Moments in Rooster Teeth - Video - February 17th, 2015 [February 17th, 2015]
- Chinas Internet Censorship Agency Has Its Own Anthem And We Translated It - Video - February 17th, 2015 [February 17th, 2015]
- Manga Censorship Discussion - Video - February 17th, 2015 [February 17th, 2015]
- Top Censored Covers - Gaming Box Art Vol. 1 - Best Video Game Censorship - Video - February 18th, 2015 [February 18th, 2015]
- Cars 2 CENSORED - Intro Cutscene/Movie - Video Game Censorship - Video - February 18th, 2015 [February 18th, 2015]
- Tuff E Nuff CENSORED - Gameplay's Blood - Video Game Censorship - Video - February 18th, 2015 [February 18th, 2015]
- Carmageddon (PC) CENSORED - Pedestrians & Blood - Video Game Censorship - Video - February 18th, 2015 [February 18th, 2015]
- Carmageddon (PC) CENSORED - Intro Cutscene/Movie - Video Game Censorship - Video - February 18th, 2015 [February 18th, 2015]
- Carmageddon 64 CENSORED - Pedestrians & Blood - Video Game Censorship - Video - February 18th, 2015 [February 18th, 2015]
- Evil Zone CENSORED - Erel Plowse's Outfit - Video Game Censorship - Video - February 18th, 2015 [February 18th, 2015]
- Pilotwings 64 CENSORED -Turin Shroud's Jesus Christ Face/Everfrost Island - Video Game Censorship - Video - February 18th, 2015 [February 18th, 2015]
- D2 CENSORED - Inro Cutscene/Movie - Video Game Censorship - Video - February 18th, 2015 [February 18th, 2015]
- Another World (Out Of This World) CENSORED - Nudity - Video Game Censorship - Video - February 18th, 2015 [February 18th, 2015]
- D2 CENSORED - Jannie's Grandpa Boss/Tentacle - Video Game Censorship - Video - February 18th, 2015 [February 18th, 2015]
- OBAMA WANTS INTERNET CENSORSHIP, START A NEW WAR, FORCIBLY VACCINATE YOU, AND SIGN THE TPP. - Video - February 18th, 2015 [February 18th, 2015]
- Silent Hill CENSORED - Grey Child/Mumbler Enemies - Video Game Censorship - Video - February 18th, 2015 [February 18th, 2015]
- Mario Party CENSORED - Mini Games/Luigi & Wario Losing - Video Game Censorship - Video - February 18th, 2015 [February 18th, 2015]
- Breath Of Fire 4 CENSORED - Ursula Dropping Pants For Sailors - Video Game Censorship - Video - February 18th, 2015 [February 18th, 2015]
- Breath Of Fire 4 CENSORED - Fou-Lu Decapitating Emperor Soniel - Video Game Censorship - Video - February 18th, 2015 [February 18th, 2015]
- Resident Evil 2 CENSORED - Player Death Scenes/Animations - Video Game Censorship - Video - February 18th, 2015 [February 18th, 2015]