Attacks on Android clipboard

Xiao Zhang; Wenliang Du

doi:10.1007/978-3-319-08509-8_5

Attacks on Android clipboard

Xiao Zhang, Wenliang Du

Department of Electrical Engineering & Computer Science

Research output: Chapter in Book/Entry/Poem › Conference contribution

14 Scopus citations

Abstract

In this paper, we perform a thorough study on the risks imposed by the globally accessible Android Clipboard. Based on the risk assessment, we formulate a series of attacks and categorize them into two groups, i.e., manipulation and stealing. Clipboard data manipulation may lead to common code injection attacks, like JavaScript injection and command injection. Furthermore, it can also cause phishing attacks, including web phishing and app phishing. Data stealing happens when sensitive data copied into the clipboard is accessed by malicious applications. For each category of attack, we analyze a large number of candidate apps and show multiple case studies to demonstrate its feasibility. Also, our app analysis process is formulated to benefit future app development and vulnerability detection. After a comprehensive exposure of the risk, we briefly discuss some potential solutions.

Original language	English (US)
Title of host publication	Detection of Intrusions and Malware, and Vulnerability Assessment - 11th International Conference, DIMVA 2014, Proceedings
Publisher	Springer Verlag
Pages	72-91
Number of pages	20
ISBN (Print)	9783319085081
DOIs	https://doi.org/10.1007/978-3-319-08509-8_5
State	Published - 2014
Event	11th International Conference on Detection of Intrusions and Malware, and Vulnerability Assessment, DIMVA 2014 - Egham, United Kingdom Duration: Jul 10 2014 → Jul 11 2014

Publication series

Name	Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)
Volume	8550 LNCS
ISSN (Print)	0302-9743
ISSN (Electronic)	1611-3349

Other

Other	11th International Conference on Detection of Intrusions and Malware, and Vulnerability Assessment, DIMVA 2014
Country/Territory	United Kingdom
City	Egham
Period	7/10/14 → 7/11/14

ASJC Scopus subject areas

Theoretical Computer Science
General Computer Science

Access to Document

10.1007/978-3-319-08509-8_5

Cite this

Zhang, X., & Du, W. (2014). Attacks on Android clipboard. In Detection of Intrusions and Malware, and Vulnerability Assessment - 11th International Conference, DIMVA 2014, Proceedings (pp. 72-91). (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics); Vol. 8550 LNCS). Springer Verlag. https://doi.org/10.1007/978-3-319-08509-8_5

Attacks on Android clipboard. / Zhang, Xiao; Du, Wenliang.
Detection of Intrusions and Malware, and Vulnerability Assessment - 11th International Conference, DIMVA 2014, Proceedings. Springer Verlag, 2014. p. 72-91 (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics); Vol. 8550 LNCS).

Research output: Chapter in Book/Entry/Poem › Conference contribution

Zhang, X & Du, W 2014, Attacks on Android clipboard. in Detection of Intrusions and Malware, and Vulnerability Assessment - 11th International Conference, DIMVA 2014, Proceedings. Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics), vol. 8550 LNCS, Springer Verlag, pp. 72-91, 11th International Conference on Detection of Intrusions and Malware, and Vulnerability Assessment, DIMVA 2014, Egham, United Kingdom, 7/10/14. https://doi.org/10.1007/978-3-319-08509-8_5

Zhang X, Du W. Attacks on Android clipboard. In Detection of Intrusions and Malware, and Vulnerability Assessment - 11th International Conference, DIMVA 2014, Proceedings. Springer Verlag. 2014. p. 72-91. (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)). doi: 10.1007/978-3-319-08509-8_5

@inproceedings{137881476100404c9fc800699d84f976,

title = "Attacks on Android clipboard",

abstract = "In this paper, we perform a thorough study on the risks imposed by the globally accessible Android Clipboard. Based on the risk assessment, we formulate a series of attacks and categorize them into two groups, i.e., manipulation and stealing. Clipboard data manipulation may lead to common code injection attacks, like JavaScript injection and command injection. Furthermore, it can also cause phishing attacks, including web phishing and app phishing. Data stealing happens when sensitive data copied into the clipboard is accessed by malicious applications. For each category of attack, we analyze a large number of candidate apps and show multiple case studies to demonstrate its feasibility. Also, our app analysis process is formulated to benefit future app development and vulnerability detection. After a comprehensive exposure of the risk, we briefly discuss some potential solutions.",

author = "Xiao Zhang and Wenliang Du",

year = "2014",

doi = "10.1007/978-3-319-08509-8_5",

language = "English (US)",

isbn = "9783319085081",

series = "Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)",

publisher = "Springer Verlag",

pages = "72--91",

booktitle = "Detection of Intrusions and Malware, and Vulnerability Assessment - 11th International Conference, DIMVA 2014, Proceedings",

note = "11th International Conference on Detection of Intrusions and Malware, and Vulnerability Assessment, DIMVA 2014 ; Conference date: 10-07-2014 Through 11-07-2014",

}

TY - GEN

T1 - Attacks on Android clipboard

AU - Zhang, Xiao

AU - Du, Wenliang

PY - 2014

Y1 - 2014

N2 - In this paper, we perform a thorough study on the risks imposed by the globally accessible Android Clipboard. Based on the risk assessment, we formulate a series of attacks and categorize them into two groups, i.e., manipulation and stealing. Clipboard data manipulation may lead to common code injection attacks, like JavaScript injection and command injection. Furthermore, it can also cause phishing attacks, including web phishing and app phishing. Data stealing happens when sensitive data copied into the clipboard is accessed by malicious applications. For each category of attack, we analyze a large number of candidate apps and show multiple case studies to demonstrate its feasibility. Also, our app analysis process is formulated to benefit future app development and vulnerability detection. After a comprehensive exposure of the risk, we briefly discuss some potential solutions.

AB - In this paper, we perform a thorough study on the risks imposed by the globally accessible Android Clipboard. Based on the risk assessment, we formulate a series of attacks and categorize them into two groups, i.e., manipulation and stealing. Clipboard data manipulation may lead to common code injection attacks, like JavaScript injection and command injection. Furthermore, it can also cause phishing attacks, including web phishing and app phishing. Data stealing happens when sensitive data copied into the clipboard is accessed by malicious applications. For each category of attack, we analyze a large number of candidate apps and show multiple case studies to demonstrate its feasibility. Also, our app analysis process is formulated to benefit future app development and vulnerability detection. After a comprehensive exposure of the risk, we briefly discuss some potential solutions.

UR - http://www.scopus.com/inward/record.url?scp=84904105959&partnerID=8YFLogxK

UR - http://www.scopus.com/inward/citedby.url?scp=84904105959&partnerID=8YFLogxK

U2 - 10.1007/978-3-319-08509-8_5

DO - 10.1007/978-3-319-08509-8_5

M3 - Conference contribution

AN - SCOPUS:84904105959

SN - 9783319085081

T3 - Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)

SP - 72

EP - 91

BT - Detection of Intrusions and Malware, and Vulnerability Assessment - 11th International Conference, DIMVA 2014, Proceedings

PB - Springer Verlag

T2 - 11th International Conference on Detection of Intrusions and Malware, and Vulnerability Assessment, DIMVA 2014

Y2 - 10 July 2014 through 11 July 2014

ER -

Attacks on Android clipboard

Abstract

Publication series

Other

ASJC Scopus subject areas

Access to Document

Other files and links

Fingerprint

Cite this