Thwarting Data Exfiltration by Repackaged Applications

Abstract

Android applications are subject to repackaging attacks, where popular applications are modified, often by inserting malicious logic, re-signed, and then uploaded to an online store to be later on downloaded and installed by unsuspicious users. This paper presents a set of protocols for increasing trust in special-purpose Android applications, termed secured trusted applications, during communication with a trustworthy external hardware device for storing sensitive end user data, termed secured personal device. The proposed approach requires neither operating system modification nor root privileges. The evaluation of our solution shows that the authenticity and integrity of applications, and the confidentiality and integrity of communication, is ensured as long as Android operates correctly.