Dr. android and Mr. hide: Fine-grained permissions in android applications

Google's Android platform includes a permission model that protects access to sensitive capabilities, such as Internet ac-cess, GPS use, and telephony. While permissions provide an important level of security, for many applications they allow broader access than actually required. In this paper, we introduce a novel framework that addresses this issue by adding finer-grained permissions to Android. Under-lying our framework is a taxonomy of four major groups of Android permissions, each of which admits some com-mon strategies for deriving sub-permissions. We used these strategies to investigate fine-grained versions of five of the most common Android permissions, including access to the Internet, user contacts, and system settings. We then de-veloped a suite of tools that allow these fine-grained per-missions to be inferred on existing apps; to be enforced by developers on their own apps; and to be retrofitted by users on existing apps. We evaluated our tools on a set of top apps from Google Play, and found that fine-grained permissions are applicable to a wide variety of apps and that they can be retrofitted to increase security of existing apps without affecting functionality.