{"title":"Towards application-centric implicit authentication on smartphones","authors":"Hassan Khan, U. Hengartner","doi":"10.1145/2565585.2565590","DOIUrl":"https://doi.org/10.1145/2565585.2565590","url":null,"abstract":"Implicit authentication schemes are a secondary authentication mechanism that provides authentication by employing unique patterns of device use that are gathered from smartphone users without requiring deliberate actions. Contemporary implicit authentication schemes operate at the device level such that they neither discriminate between data from different applications nor make any assumption about the nature of the application that the user is currently using. In this paper, we challenge the device-centric approach to implicit authentication on smartphones. We argue that the conventional approach of misuse detection at the device level has inherent limitations for mobile platforms. To this end, we analyze and empirically evaluate the device-centric nature of implicit authentication schemes to show their limitations in terms of detection accuracy, authentication overhead, and fine grained authentication control. To mitigate these limitations and for effective and pragmatic implicit authentication on the mobile platform, we propose a novel application-centric implicit authentication approach. We observe that for implicit authentication, an application knows best on when to authenticate and how to authenticate. Therefore, we delegate the implicit authentication task to the application and let the application provider decide when and how to authenticate a user in order to protect the owner's personal information. Our proposed application-centric implicit authentication approach improves accuracy and provides fine grained authentication control with low authentication overhead. Future research in this domain will benefit from our findings to provide pragmatic implicit authentication solutions.","PeriodicalId":360291,"journal":{"name":"Proceedings of the 15th Workshop on Mobile Computing Systems and Applications","volume":"1 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2014-02-26","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"115239879","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Information leakage through mobile analytics services","authors":"Terence Chen, Imdad Ullah, M. Kâafar, R. Boreli","doi":"10.1145/2565585.2565593","DOIUrl":"https://doi.org/10.1145/2565585.2565593","url":null,"abstract":"In this paper we investigate the risk of privacy leakage through mobile analytics services and demonstrate the ease with which an external adversary can extract individual's profile and mobile applications usage information, through two major mobile analytics services, i.e. Google Mobile App Analytics and Flurry. We also demonstrate that it is possible to exploit the vulnerability of analytics services, to influence the ads served to users' devices, by manipulating the profiles constructed by these services. Both attacks can be performed without the necessity of having an attacker controlled app on user's mobile device. Finally, we discuss potential countermeasures (from the perspectives of different parties) that may be utilized to mitigate the risk of individual's personal information leakage.","PeriodicalId":360291,"journal":{"name":"Proceedings of the 15th Workshop on Mobile Computing Systems and Applications","volume":"27 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2014-02-26","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"115580520","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
A. Sivakumar, V. Gopalakrishnan, Seungjoon Lee, Sanjay G. Rao, S. Sen, O. Spatscheck
{"title":"Cloud is not a silver bullet: a case study of cloud-based mobile browsing","authors":"A. Sivakumar, V. Gopalakrishnan, Seungjoon Lee, Sanjay G. Rao, S. Sen, O. Spatscheck","doi":"10.1145/2565585.2565601","DOIUrl":"https://doi.org/10.1145/2565585.2565601","url":null,"abstract":"In recent years, there has been growing interest in both industry and academia in augmenting mobile web browsing with support from the cloud [4, 1, 3, 16, 18]). These efforts are motivated by the goals of lowering costs of data transfer, and reducing web latencies and device energy consumption. While these efforts have adopted different approaches to cloud-based browsing, there isn't a systematic understanding of the rich design space due to the proprietary nature of many of the solutions. In this paper, we take a step towards obtaining a better understanding by evaluating an extreme point in the design space that involves cloud support for most browsing functionality including execution of JavaScript (JS), and for compaction of data (e.g., image transcoding and compression). Our study is conducted in the context of Cloud Browser (CB), a popular commercially available browser that embodies this design point. Our results indicate that CB does not provide clear benefits over Direct (a device-based browser) either in energy or download time. For e.g. while CB decreases the download time compared to Direct for 38.87% of pages, it increases it by as much as 29.8s for other pages. Similarly while CB decreases the total energy by up to 20.77J compared to Direct for 52.7% of the pages, it increases it by up to 21.31J for other pages. Interestingly, even though CB does JS execution in the cloud, it increases the CPU and network energy for close to 50% of the pages. Overall our study indicates that cloud-based browsing is not always a win, and there are important trade-offs that must be carefully considered when moving functionality to the cloud.","PeriodicalId":360291,"journal":{"name":"Proceedings of the 15th Workshop on Mobile Computing Systems and Applications","volume":"15 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2014-02-26","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"133636940","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Unveiling the hidden dangers of public IP addresses in 4G/LTE cellular data networks","authors":"W. Leong, A. Kulkarni, Yin Xu, B. Leong","doi":"10.1145/2565585.2565599","DOIUrl":"https://doi.org/10.1145/2565585.2565599","url":null,"abstract":"While it is often convenient for mobile cellular devices to have a public IP address, we show that such devices are vulnerable to stealthy malicious attacks. In particular, we show with experiments on three 4G/LTE cellular data networks in Singapore that it is easy for an attacker to initiate three different types of attacks on such mobile devices: (i) data quota drain, (ii) DoS flooding, and (iii) battery drain. Our experiments show that a potential attacker can completely exhaust the monthly data quota within a few minutes, completely choke the data connection of a mobile subscriber with a data stream of just 3 Mb/s, and increase the battery drain rate by up to 24 times. Finally, we argue that a simple proxy-based firewall with a secret IP address would be an effective and feasible defense against such potential attacks.","PeriodicalId":360291,"journal":{"name":"Proceedings of the 15th Workshop on Mobile Computing Systems and Applications","volume":"55 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2014-02-26","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"126221395","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Geoffrey Challen, Scott Haseley, Anudipa Maiti, Anandatirtha Nandugudi, Guru Prasad Srinivasa, Mukta Puri, Junfei Wang
{"title":"The mote is dead: long live the discarded smartphone!","authors":"Geoffrey Challen, Scott Haseley, Anudipa Maiti, Anandatirtha Nandugudi, Guru Prasad Srinivasa, Mukta Puri, Junfei Wang","doi":"10.1145/2565585.2565598","DOIUrl":"https://doi.org/10.1145/2565585.2565598","url":null,"abstract":"As the rapid pace of smartphone improvements drives consumer appetites for the latest and greatest devices, the hidden cost is millions of tons of e-waste containing hazardous chemicals that are difficult to dispose of safely. Studies show that smartphone users are replacing their devices every 18 months, almost three times faster than desktop computers [1, 3], producing millions of discarded smartphones each year that end up lying in desk drawers, buried in landfills, or shipped to third-world countries where they are burned to extract precious metals, a process that damages both the health of those involved and the environment. Fortunately, the capabilities of discarded smartphones make them ideal for reuse. Instead of ending up in a landfill, a discarded smartphone could be integrated into a home security system or transformed into a health care device for the elderly. In this paper, we evaluate using discarded smartphones to replace traditional sensor network \"motes\". Compared with motes, discarded devices have many advantages: price, performance, connectivity, interfaces, and ease of programming. While the main question is whether their energy consumption is low enough to enable harvesting solutions to allow continuous operation, we present preliminary results indicating that this may be possible.","PeriodicalId":360291,"journal":{"name":"Proceedings of the 15th Workshop on Mobile Computing Systems and Applications","volume":"74 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2014-02-26","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"125878355","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Tao Feng, Jun Yang, Zhixian Yan, Emmanuel Munguia Tapia, W. Shi
{"title":"TIPS: context-aware implicit user identification using touch screen in uncontrolled environments","authors":"Tao Feng, Jun Yang, Zhixian Yan, Emmanuel Munguia Tapia, W. Shi","doi":"10.1145/2565585.2565592","DOIUrl":"https://doi.org/10.1145/2565585.2565592","url":null,"abstract":"Due to the dramatical increase in popularity of mobile devices in the last decade, more sensitive user information is stored and accessed on these devices everyday. However, most existing technologies for user authentication only cover the login stage or only work in restricted controlled environments or GUIs in the post login stage. In this work, we present TIPS, a Touch based Identity Protection Service that implicitly and unobtrusively authenticates users in the background by continuously analyzing touch screen gestures in the context of a running application. To the best of our knowledge, this is the first work to incorporate contextual app information to improve user authentication. We evaluate TIPS over data collected from 23 phone owners and deployed it to 13 of them with 100 guest users. TIPS can achieve over 90% accuracy in real-life naturalistic conditions within a small amount of computational overhead and 6% of battery usage.","PeriodicalId":360291,"journal":{"name":"Proceedings of the 15th Workshop on Mobile Computing Systems and Applications","volume":"37 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2014-02-26","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"128057808","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Noah Klugman, Javier Rosa, P. Pannuto, Matthew Podolsky, Will Huang, P. Dutta
{"title":"Grid watch: mapping blackouts with smart phones","authors":"Noah Klugman, Javier Rosa, P. Pannuto, Matthew Podolsky, Will Huang, P. Dutta","doi":"10.1145/2565585.2565607","DOIUrl":"https://doi.org/10.1145/2565585.2565607","url":null,"abstract":"The power grid is one of humanity's most significant engineering undertakings and it is essential in developed and developing nations alike. Currently, transparency into the power grid relies on utility companies and more fine-grained insight is provided by costly smart meter deployments. We claim that greater visibility into power grid conditions can be provided in an inexpensive and crowd-sourced manner independent of utility companies by leveraging existing smartphones. Our key insight is that an unmodified smartphone can detect power outages by monitoring changes to its own power state, locally verifying these outages using a variety of sensors that reduce the likelihood of false power outage reports, and corroborating actual reports with other phones through data aggregation in the cloud. The proposed approach enables a decentralized system that can scale, potentially providing researchers and concerned citizens with a powerful new tool to analyze the power grid and hold utility companies accountable for poor power quality. This paper demonstrates the viability of the basic idea, identifies a number of challenges that are specific to this application as well as ones that are common to many crowd-sourced applications, and highlights some improvements to smartphone operating systems that could better support such applications in the future.","PeriodicalId":360291,"journal":{"name":"Proceedings of the 15th Workshop on Mobile Computing Systems and Applications","volume":"251 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2014-02-26","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"122391930","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Kartik Muralidharan, Azeem J. Khan, Archan Misra, R. Balan, S. Agarwal
{"title":"Barometric phone sensors: more hype than hope!","authors":"Kartik Muralidharan, Azeem J. Khan, Archan Misra, R. Balan, S. Agarwal","doi":"10.1145/2565585.2565596","DOIUrl":"https://doi.org/10.1145/2565585.2565596","url":null,"abstract":"The inclusion of the barometer sensor in smartphones signaled an opportunity for aiding indoor localization efforts. In this paper, we therefore investigate a possible use of the barometer sensor for detecting vertically oriented activities. We start by showing the accuracies of various commodity measurement devices and the challenges they bring forth. We then show how to use the barometer values to build a predictor that can detect floor changes and the mode (elevator, escalator, or stairs) used to change floors with nearly 100% accuracy. We validate these properties with data collected using 3 different measurement devices from 7 different buildings. Our investigation reveals that while the barometer sensor has potential, there is still a lot left to be desired.","PeriodicalId":360291,"journal":{"name":"Proceedings of the 15th Workshop on Mobile Computing Systems and Applications","volume":"12 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2014-02-26","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"116773881","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"All your network are belong to us: a transport framework for mobile network selection","authors":"Shuo Deng, Anirudh Sivaraman, H. Balakrishnan","doi":"10.1145/2565585.2565588","DOIUrl":"https://doi.org/10.1145/2565585.2565588","url":null,"abstract":"Mobile devices come with an assortment of networks: WiFi in two different frequency bands, each of which can run in infrastructure-mode, WiFi-Direct mode, or ad hoc mode; cellular radios, which can run in LTE/4G, 3G, or EDGE modes; and Bluetooth. But how should an app choose which network to use? There is no systematic solution to this problem today: in current practice the choice is almost always left to the user, who usually has no idea what's best. In fact, what's best for a user depends on the app's performance objectives (throughput, delay, object load time, etc.) and the user's constraints on cost and battery life. Besides, what's best for a single user or app must be balanced with what's best for the wireless network as a whole (individual optimality vs. social utility). This paper introduces Delphi, a transport-layer module to resolve these issues. Delphi has three noteworthy components: \"local learning\", in which a mobile device estimates or infers useful properties of different networks efficiently, \"property sharing\", in which mobile devices share what they learn with other nearby devices, and \"selection\", in which each node selects a network using what it has observed locally and/or from its neighbors.","PeriodicalId":360291,"journal":{"name":"Proceedings of the 15th Workshop on Mobile Computing Systems and Applications","volume":"19 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2014-02-26","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"121385779","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"RobinHood: sharing the happiness in a wireless jungle","authors":"T. Bansal, Wenjie Zhou, K. Srinivasan, P. Sinha","doi":"10.1145/2565585.2565604","DOIUrl":"https://doi.org/10.1145/2565585.2565604","url":null,"abstract":"Today's Enterprise Wireless LANs are comprised of densely deployed access points. This paper proposes RobinHood, an interference nulling scheme that leverages the high density of the access points to enable multiple mobile devices to transmit simultaneously to multiple access points (APs), all within a single collision domain. RobinHood also leverages the capability of the APs to communicate with each other on the wired backbone to migrate most of the complexity to the APs, while keeping the design at the mobile clients simpler. Finally, we leverage the static nature of the access points to make RobinHood more practical in networks where the mobility of clients inhibit the use of traditional interference alignment schemes. Results from our trace-driven simulations show that RobinHood obtains a throughput improvement of 6.08x and 24.2x over omniscient TDMA and IEEE 802.11, respectively.","PeriodicalId":360291,"journal":{"name":"Proceedings of the 15th Workshop on Mobile Computing Systems and Applications","volume":"78 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2014-02-26","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"123036756","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}