![](https://cyberwatching.eu/sites/default/files/hero-bg.jpg)
Fausto Fasano, Fabio Martinelli, Francesco Mercaldo, Antonella Santone
Proceedings of the 6th International Conference on Information Systems Security and Privacy - Volume 1: ForSE, 804-814, 2020, Valletta, Malta
https://doi.org/10.5220/0009372308040814
Our mobile devices store a lot of sensitive and critical information. Moreover, considering the ability of smartphones and tables to detect the position and to record audio, it is not absolutely an exaggeration to admit that potentially our devices can easily spy on us. The ability to perform these crucial tasks must be granted by the user at the time of their first use by accepting the so-called permissions. The problem is that in Android, once these permissions are granted, the application can always use them without notifying the user. In this paper, we propose a methodology, based on formal methods, aimed to detect the exact point in the code (in term of package, class and method) of an Android application where a permission is invoked at run-time. Moreover we design a tool able to advise the user whether a permission is invoked, in this way the user can be informed about the application behaviour.
Cyberwatching.eu has received funding from the European Union’s Horizon 2020 research and innovation programme under grant agreement No 740129. The content of this website does not represent the opinion of the European Commission, and the European Commission is not responsible for any use that might be made of such content. Privacy Policy | Disclaimer / Terms and Conditions of Use