Samsung LN40C650 “failing” with black vertical stripes (SOLVED)

Correct Diagnosis

  • Faulty seating on HDMI1 affects video arriving from HDMI4.

See Configuration and Specification below.

Remediation

  • Reseat HDMI1 (independent input from TiVo).
  • See the signal from HDMI4 (the Xbox) clear up.

Observation

  • HDMI1, HDMI2, HDMI3 are all “horizontal”.
  • Connections into these sockets have a tendancy to “droop” and place pressure on the female side of the connector.
  • Unless the inbound connector and wire is supported, the force of gravity, over time, will cause these connections to become loose and failure prone.
  • HDMI4 is “vertical” and will have less of this effect.

Actualities

These are barely acceptable when they are black.  When they become white, the display is unwatchable.

Indications

  • The behavior commenced after The Focus Group rerouted some video inputs and then replace them “as they were before.” See History below.
  • The behavior occurs independent of any video input signal; with no input video signal.
  • It occurs even in “Self Diagnosis” mode where the TV exhibits its own internally-supplied image.
  • There has been no internal intervention (never opened up the back).
  • The device has been mounted on a wall and cannot be jostled or insulted. But see History below.

Did you reboot?

Well, first of all, the display devices don’t run Windows, they run Linux. Rebooting isn’t generally remediatory for anything. But of course, I did a hard powercycle and replugged the power cables.

Therefore

  • The behavior occurs without a video signal => it’s not an HDMI decode issue.
  • Tough to believe that internal cables became spontaneously unseated.

History

  • Recently, The Focus Group decided to experiment with daisy chaining the video signal as Comast->TiVo->XBox->Samsung to give XBox One the pride of place
  • That’s the product vision/promise/aspiration for the XBox One: “The One Box for the living room” (think: as with the Windows monopoly; one ring to rule them all).
  • Of course this failed.
    • XBox One can’t control the DVR features of the TiVo.
    • XBox One can barely redisplay the live TV;
      It can redisplay a signal only if it’s previously decoded with the CableCARD that’s in the TiVo.
    • XBox One can’t play recorded programs or direct the TiVo to run its applications.
  • Thus, the XBox One, again, stands alone feeding HDMI to the Master Display. It is the Master Display that rules them all; as that is what provides ultimate the value.

Teaser

What are the chances that during this plugging, unplugging, replugging of HDMI cables, that some aspect of the HDMI male/female seating in HDMI1 through HDMI3 became loose enough?

Complete

  • Run (ahem) daily 8+ hours with sporadic intermissions.
  • Purchased 2013-08-01 (TV is 3.5 years old)

Configuration

Specifications

Samsung Series 6, Model L40C650; User Manual; 60 pages (10MB, huge)


But what did “the net” say?  Anything helpful? [tl;dr => Not really]

Consensus Diagnosis

  • The LCD is failing => it is not fixable, throw out the unit.
  • The LCD builds of that era were low quality and/or had low lifespan anyway.
  • Samsung makes “cheap TVs” and this is the best that can be hoped for, or something like that.

Rebuttals

  • Rly? => TVs should last “a decade” or so; that’s a problem that the TV vendors are actively trying to deal with … that people buy cars more often than they buy a new TV.
  • ahem => Isn’t it the case that the “cheapie TV makers” just buy their parts from Samsung’s remainders, not the other way around?

Alternate Diagnosis

From random prattle on the forums; it’s fixable, but …

  • It’s some fuse, caused by a “voltage surge.”
  • It’s some (internal) “tab” connecting to the LCD.
  • It’s some (internal) ribbon cable that as come loose.
  • It’s a “T-Con” board (every poster spells & abbreviates this part name differently).
  • It’s a firmware issue.
  • It’s an HDMI decode issue => replug the cables, powercycle (these were perilously close to correct)

Background

Apache Cordova

Apache Cordova

Code

<!DOCTYPE html>
<html>
<head>
<title>Device Properties Example</title>
<script type="text/javascript" charset="utf-8" src="cordova.js"></script>
<script type="text/javascript" charset="utf-8">
// Wait for device API libraries to load
document.addEventListener("deviceready", onDeviceReady, false);
// device APIs are available
function onDeviceReady() {
var element = document.getElementById('deviceProperties');
        element.innerHTML = 'Device Model: ' + device.model + '<>' +
                'Device Cordova: ' + device.cordova + '<br />' +
                'Device Platform: ' + device.platform + '<br />' +
                'Device UUID: ' + device.uuid + '<br/>' +
                'Device Version: ' + device.version + '<br />';
        }
</script>
</head>
<body>
<p id="deviceProperties">Loading device properties...</p>
</body>
</html>

Naturally Rehearsing Passwords | Blocki, Blum, Datta

Jeremiah Blocki, Manuel Blum, Anupam Datta; Naturally Rehearsing Passwords; In arXiv; 2013-09-11; 34 pages.

Abstract

We introduce quantitative usability and security models to guide the design of password management schemes — systematic strategies to help users create and remember multiple passwords. In the same way that security proofs in cryptography are based on complexity-theoretic assumptions (e.g., hardness of factoring and discrete logarithm), we quantify usability by introducing usability assumptions . In particular, password management relies on assumptions about human memory, e.g., that a user who follows a particular rehearsal schedule will successfully maintain the corresponding memory. These assumptions are inform ed by research in cognitive science and can be tested empirically. Given rehearsal requirement s and a user’s visitation schedule for each account, we use the total number of extra rehearsals that the user would have to do to remember all of his passwords as a measure of the usability of the password scheme. Our usability model leads us to a key observation: password reuse benefits users not only by reducing the number of passwords that the user has to memorize, but more importantly by increasing the natural rehearsal rate for each password. We also present a security model which accounts for the complexity of password management with multiple accounts and associated threats, including online, offline, and plaintext password leak attacks. Observing that current password management schemes are either insecure or unusable, we present Shared Cues — a new scheme in which the underlying secret is strategically shared across accounts to ensure that most rehearsal requirements are satisfied naturally while simultaneously providing strong security. The construction uses the Chinese Remainder Theorem to achieve these competing goals.

Promotions

mobile.verge.com | This Connection is Untrusted

Nothing says “The Web is Misconfigured” quite like a security protocol failure notice: some link bait.

Making the Web Faster with HTTP 2.0 | Ilya Grigorik

Ilya Grigorik; Making the Web Faster with HTTP 2.0; In ACM Queue; 2013-12-03.

References

Via: backfill

Intel Cloud Services Platform

Intel Cloud Services Platform, version 6.0, 2013-11-21

Release Notes

  • Intel Identity Services => FedID
  • Cultures
    • Android (2.2, Froyo onward)
    • iOS
    • JavaScript, HTML5
    • Windows
  • Baseline RESTful API
    • XML
    • JSON
  • Services
    • Analytics
    • Catalog,
    • Commerce
    • Curation,
    • Recommendation

Identity Services

  • Social Integration
    • Facebook API tokens
    • Yahoo! Social Login
  • Regulatory: COPPA
  • REST Developer’s Guide
  • Intel Identity Services REST API Reference
  • OAuth 2.0
    • ClientID + Client Secret
    • Access Token
    • https://api.intel.com/identityui/v2/auth
  • Concepts
    • Scopes
    • Redirect
    • Sync vs Async (urn:intel:identity:oauth:oob:async)
      • Web App Synchronous => http://localhost/callback.html
      • Mobile App Synchronous => (deep link) myapp://action
      • Web App Asynchronous => urn:intel:identity:
        oauth:oob:async
  • URN Support (i.e. deep links)
  • Badging




Analytics Services

  • Opt-Out
  • Session Tracking API
  • Custom Events API
  • Dashboards
  • Real-Time Analytics
  • User, device, session, and demographic Analysis

Commerce Services & API

  • Client ID
  • PayPal
  • Taxation computations
  • Subscription API
  • Cart & Order Management

Catalog Services

  • Datasets
  • Bulk Upload
  • POI Data
  • Schema Management

Context SDK

  • States
    • Location-based states:
      • Country,
      • City,
      • Semantic Place (Home/Work),
      • Nearby restaurants.
    • Time and date-based states:
      • Time zone,
      • Local time,
      • Weekday,
      • Part of day,
      • Holiday information in your location.
    • Device-based states:
      • Applications running,
      • Missed calls,
      • Battery level,
      • Music played.
  • Context states sensing
    • Environment weather.
    • Device terminal context.
    • Location semantic/geographic place.
    • Network connection.
    • Device contacts.
    • Device calendar.
    • Physical activity.
    • Audio classification.
    • Message (SMS).
    • Device information.
    • Installed applications.

Location-Based Services

  • Removed 2013-11-11

Miscellaneous

See Also

Genevieve Bell, Keynote Address; Intel IDF; 2013-09-12; 43 pages.

Via: backfill, backfill

User, device, session, and demographic Analysis

PIN Skimmer: Inferring PINs Through The Camera and Microphone | Simon, Anderson

Laurent Simon, Ross Anderson; PIN Skimmer: Inferring PINs Through The Camera and Microphone; In Proceedings of 3rd Annual ACM CCS Workshop on Security and Privacy in Smartphones and Mobile Devices (SPSM); 2013-11-08; 12 pages.

Abstract

Today’s smartphones provide services and uses that required a panoply of dedicated devices not so long ago. With them, we listen to music, play games or chat with our friends; but we also read our corporate email and documents, manage our online banking; and we have started to use them directly as a means of payment. In this paper, we aim to raise awareness of side-channel attacks even when strong isolation protects sensitive applications. Previous works have studied the use of the phone accelerometer and gyroscope as side channel data to infer PINs. Here, we describe a new side-channel attack that makes use of the video camera and microphone to infer PINs entered on a number-only soft keyboard on a smartphone. The microphone is used to detect touch events, while the camera is used to estimate the smartphone’s orientation, and correlate it to the position of the digit tapped by the user. We present the design, implementation and early evaluation of PIN Skimmer, which has a mobile application and a server component. The mobile application collects touch-event orientation patterns and later uses learnt patterns to infer PINs entered in a sensitive application. When selecting from a test set of 50 4-digit PINs, PIN Skimmer correctly infers more than 30% of PINs after 2 attempts, and more than 50% of PINs after 5 attempts on android-powered Nexus S and Galaxy S3 phones. When selecting from a set of 200 8-digit PINs, PIN Skimmer correctly infers about 45% of the PINs after 5 attempts and 60% after 10 attempts. It turns out to be difficult to prevent such side-channel attacks, so we provide guidelines for developers to mitigate present and future side-channel attacks on PIN input.

References

  • Samsung KNOX
  • BlackBerry Enterprise Service 10
  • Xen project
  • Okl4 microvisor Open kernel labs.
  • Trustzone: ARM
  • Google Play
  • App store for Android, Amazon.com
  • Alcatel club games free download of games for Android.
  • Gfan
  • eoemarket
  • T. Anscombe; Social engineering still biggest threat to consumers; In Their Blog; 2012-07.
  • R. Naraine; Android drive-by download attack via phishing sms; In ZDNet; 2012-02.
  • D. Goodin; Android users targeted in drive-by download attacks; In Ars Technica; 2012-05.
  • J. Leyden; That square qr barcode on the poster? check it’s not a sticker; In The Register; 2012-12.
  • California prosecutors push for anti-phone theft moves; undated.
  • J. Davenport, W. Gant; iphone muggers on bikes plague london; In The Standard; 2012-11.
  • S. Das, L. Green, B. Perez, and M. Murphy, “Detecting User Activities Using the Accelerometer on Android Smartphones,” 2010.
  • R. Templeman, Z. Rahman, D. Crandall, and A. Kapadia, “PlaceRaider: Virtual theft in physical spaces with smartphones”; In Proceedings of The 20th Annual Network and Distributed System Security Symposium (NDSS); 2013-02.
  • Facetime “The easiest way to call face-to-face.”
  • Skype “Video chat – free online video calls – video calling – skype.”
  • Tor project
  • L. Constantin; Pushdo botnet is evolving, becomes more resilient to takedown attempts; In PC World; 2013-05.
  • “Rageagaisntthecage.”
  • Giesecke, Devrient; Creating Confidence
  • Z. Yaniv; Random Sample Consensus (RANSAC) Algorithm, A Generic Implementation; 2010-10.
  • G. Roth; Homography; Lecture Notes, Comp 4900d; Carleton University, 2013.
  • OpenCv; Willow Garage
  • A. Zisserman; The SVM classifier; Lecture 2; Oxford University; 2013.
  • LibSvm A Library for Support Vector Machines.
  • Weka 3: Data mining software in Java.
  • J. Bonneau, S. Preibusch, and R. Anderson, “A birthday present every eleven wallets? The security of customer-chosen banking PINs”; In Proceedings of FC ’12: The 16th International Conference on Financial Cryptography and Data Security; 2012-03.
  • J. Koetsier; “Pin Analysis”; 2013-09.
  • Alertdialog; In Android Developers Documentation
  • Sensor; In Android Developers Documentation.
  • C. Cachin, Entropy measures and unconditional security in cryptography; PhD Thesis, ETH Zurich, 1997.
  • S. Brostoff and M. A. Sasse, ““ten strikes and you’re out”: Increasing the number of login attempts can improve password usability”; In Proceedings of the CHI Workshop on HCI and Security Systems; John Wiley; 2003.
  • F. Stajano, “Pico: no more passwords!,” in Proceedings of the 19th International Conference on Security Protocols (SP’11); Berlin, Heidelberg; pp. 49–81, Springer-Verlag, 2011.
  • O. Riva, C. Qin, K. Strauss, and D. Lymberopoulos, “Progressive authentication: deciding when to authenticate on mobile phones”; In Proceedings of the 21st USENIX conference on Security Symposium (Security’12); Berkeley, CA, USA; pp. 15–15, USENIX Association, 2012.
  • S. Maggi, A. Volpatto, S. Gasparini, G. Boracchi, and S. Zanero, “Poster: fast, automatic iphone shoulder surfing,” in Proceedings of the 18th ACM Conference on Computer and Communications Security (CCS ’11); New York, NY, USA; pp. 805–808, ACM, 2011.
  • R. Raguram, A. M. White, D. Goswami, F. Monrose, and J.-M. Frahm; “ispy: automatic reconstruction of typed input from compromising reflections”; In Proceedings of the 18th ACM Conference on Computer and Communications Security (CCS ’11); New York, NY, USA; pp. 527–536, ACM; 2011.
  • A. J. Aviv, K. Gibson, E. Mossop, M. Blaze, and J. M. Smith, “Smudge attacks on smartphone touch screens,” in Proceedings of the 4th USENIX Conference on Offensive Technologies, WOOT’10, pp. 1–7, USENIX Association, 2010.
  • P. Marquardt, A. Verma, H. Carter, and P. Traynor, “(sp)iphone: decoding vibrations from nearby keyboards using mobile phone accelerometers,” in Proceedings of the 18th ACM conference on Computer and communications security, CCS ’11, (New York, NY, USA), pp. 551–562, ACM, 2011.
  • Z. Xu, K. Bai, and S. Zhu, “Taplogger: inferring user inputs on smartphone touchscreens using on-board motion sensors” In Proceedings of the Fifth ACM Conference on Security and Privacy in Wireless and Mobile Networks (WISEC ’12); New York, NY, USA; pp. 113–124, ACM; 2012.
  • L. Cai and H. Chen, “Touchlogger: inferring keystrokes on touch screen from smartphone motion”; In Proceedings of the 6th USENIX Conference on Hot Topics in Security (HotSec’11); Berkeley, CA, USA; pp. 9–9, USENIX Association; 2011.
  • L. Cai and H. Chen, “On the practicality of motion based keystroke inference attack”; In Proceedings of the 5th international conference on Trust and Trustworthy Computing (TRUST’12); Berlin, Heidelberg; pp. 273–290, Springer-Verlag; 2012.
  • A. J. Aviv, B. Sapp, M. Blaze, and J. M. Smith, “Practicality of accelerometer side channels on smartphones”; In Proceedings of the 28th Annual Computer Security Applications Conference (ACSAC ’12); New York, NY, USA; pp. 41–50, ACM; 2012.
  • E. Miluzzo, A. Varshavsky, S. Balakrishnan, R. R. Choudhury; “Tapprints: your finger taps have fingerprints”; In Proceedings of the 10th International Conference on Mobile Systems, Applications, and Services (MobiSys ’12); New York, NY, USA; pp. 323–336, ACM; 2012.

Via: backfill, backfill

Black Code: Surveillance, Privacy, and the Dark Side of the Internet | Ronald J. Diebert


Ronald J. Deibert; Black Code: Surveillance, Privacy, and the Dark Side of the Internet; Signal; 2013-11-19; 336 pages; kindle: no; paperback: $14.


Ronald J. Deibert; Black Code: Inside the Battle for Cyberspace; Signal; 2013-05-21; 320 pages; kindle: $12.

Follow the Money: Understanding economics of online aggregation and advertising | Gill, Krishnamurthy, Erramilli, Papagiannaki, Ciantreau, Rodriguez

Phillipa Gill, Bala Krishnamurthy, Vijay Erramilli, Dina Papagiannaki, Augustin Chaintreau, Pablo Rodriguez; Follow the money: Understanding economics of online aggregation and advertising; In Proceedings of the ACM SIGCOMM Internet Measurement Conference; 2013-10-23; 6 pages.

Abstract

The large-scale collection and exploitation of personal information to drive targeted online advertisements has raised privacy concerns. As a step towards understanding these concerns, we study the relationship between how much information is collected and how valuable it is for advertising. We use HTTP traces consisting of millions of users to aid our study and also present the rst comparative study between aggregators. We develop a simple model that captures the various parameters of today’s advertising revenues, whose values are estimated via the traces. Our results show that per aggregator revenue is skewed (5% accounting for 90% of revenues), while the contribution of users to advertising revenue is much less skewed (20% accounting for 80% of revenue). Google is dominant in terms of revenue and reach (presence on 80% of publishers). We also show that if all 5% of the top users in terms of revenue were to install privacy protection, with no corresponding reaction from the publishers, then the revenue can drop by 30%.

Claims

<rephrased>

Observations
  • Google is a dominant player in the online ad industry, with presence on 80% of publishers in our datasets, with highest revenues as a demand aggregator but is not the top publisher in terms of revenue,
  • Facebook is increasing its presence around the Web with their `Like’ button, reaching 23% of publishers,
  • A few demand aggregators account for most of the revenue (5% accounting for 90% of revenues), however, users’ contribution to advertising revenue is much less skewed (20% accounting for 80% of revenue),
  • Popular publishers account for highest revenues, while less popular ones have low revenues.

Adoption of DNT and/or Ad Blocking can (has has the potential to)

  • decrease revenue by 75%
    • if blocking is adopted by all users
    • absent counter-countermeasures from aggregators & publishers; e.g. QpQ;
      (context & explanation in Section 5).
  • decrease revenue by 30%-60%
    • if blocking is adopted by the to 5% of users (the valuable users).

</rephrased>

<quote>Figure 5 shows how much value is currently derived from implicit intent which stands to be lost if users block. The average value of II(a, u) is 4.2 in the HTTP, 3.8 in mHTTP and 3.1 in the Univ traces, respectively. Indeed, when we compute revenue with all users blocking (i.e., I(a, u) = 1) revenue decreases by a factor of 4.2 in the HTTP, 3.8 in mHTTP, and 3.2 in the Univ traces, respectively. A large population of users blocking, in the worst case, if the Do Not Track (DNT) header became default, would represent a significant threat to advertising revenue. If proposals like DNT are honored by aggregators this may lead to lowered quality of service as the publisher will lose out on additional revenues. Blocking also poses the potential to decrease functionality of Web sites for users (e.g., blocking JavaScript via NoScript). Hence, for these reasons, it can be argued that most users will not take the extreme step of blocking entirely. However, we find that even if 5% of the top users (Figure 4) block, the revenue drop is between 35%-60%. Regarding obfuscation, assuming that incorrect targeting is worse than no targeting, the drop in revenues due to blocking will be a lower bound on revenue loss due to obfuscation.</quote>

Promotions

Terminology

  • An Aggregator is a generalized “Ad Exchange”; it’s a demand side actor.
  • Let there be
    • Users u in a set U
    • Publishers p in a set P
    • Aggregators (ad exchanges) a in a set A
  • RONa is run of network; it is a base price; it is the price at which one can buy knowing nothing.
  • TQMp is traffic quality multiplier
  • I is intent;
    • it is a multiplier over knowing nothing; a multiplier on RON.
    • Thus: I >= 1
    • With refinements, let
      • II(a, u) is the inferred intent on exchange a for user u.
      • EI(u) is the explicit intent of user u.; this is the universe of available information.
      • Assume: II(a, u) < EI(a, u); think about it, one can’t infer more than the available explicitness, were one to have a “god’s eye” view of the market.
      • I(a, u), therefore, is the practical available intent available on user u at exchange a
  • CPMu,p,a = RONa * TQMp * I(a, u)
  • REVENUE = ΣuεU ΣpεP ΣaεA VISIT(u,p) * CPM(u,p,a)

Method

  • Acquire HTTP traces
  • Anonymize users to innoculate against privacy concerns.
  • Group each user’s HTTP transactions in the HTTP traces into sessions
  • Identify publishers and aggregators within each session
  • Derive a set of publishers and aggregators per user.
  • The set of publishers to implicates user intent IIu and EIu.
  • Derive RONa
  • Derive TQMp
  • Compute CPMu,p,a for all (u,p,a)
  • Compute REVENUE
  • Then, the hypothetical treatment
    • Hypothesize about DNT and Ad Blocking wherein I(a, u) is modified;
      Either:

      • I(a, u) = II(a, u) meaning user u takes no countermeasures
      • I(a, u) = 1 meaning user u takes countermeasures (blocks)
    • Make claims about ΔREVENUE

Mentioned

Referenced

Click-to-Play in Mozilla’s Firefox

Promotions

Via: backfill, backfill

, Mozilla Wiki

; In Mozilla Support

ViewWho

ViewWho of AdDynamo

Status

  • Moribund since 2012-05
  • Has released no code.

Documentation

Who

Referenced

Device fingerprinting

Data matching

N3570: Quoted Strings Library Proposal

N3570; Quoted Strings Library Proposal; (Revision 1); Beman Dawes; 2013-03-14

Sample

std::stringstream ss;
std::string original = "fooled you";
std::string round_trip;

ss << quoted(original);
ss >> quoted(round_trip);

std::cout << quoted(original); // outputs: "fooled you"
std::cout << round_trip; // outputs: fooled you

assert(original == round_trip); // assert will not fire

Related

Via: backfill

gawker.com | This Connection is Untrusted

Nothing says “The Web is Misconfigured” quite like a security protocol failure notice: some link bait.

How Much Can Behavioral Targeting Help Online Advertising? | Yan Liu, Wang, Zhang, Jiang, Chen

Jun Yan, Ning Liu, Gang Wang, Wen Zhang, Yun Jiang, Zheng Chen; How Much Can Behavioral Targeting Help Online Advertising?; In Proceedings of WWW; 2009; 10 pages

Abstract

Behavioral Targeting (BT) is a technique used by online advertisers to increase the effectiveness of their campaigns, and is playing an increasingly important role in the online advertising market. However, it is underexplored in academia how much BT can truly help online advertising in search engines. In this paper we provide an empirical study on the click-through log of advertisements collected from a commercial search engine. From the experiment results over a period of seven days, we draw three important conclusions:

  1. Users who clicked the same ad will truly have similar behaviors on the Web;
  2. Click-Through Rate (CTR) of an ad can be averagely improved as high as 670% by properly segmenting users for behavioral targeted advertising in a sponsored search;
  3. Using short term user behaviors to represent users is more effective than using long term user behaviors for BT.

We conducted statistical t-test which verified that all conclusions drawn in the paper are statistically significant. To the best of our knowledge, this work is the first empirical study for BT on the click-through log of real world ads.

AFrame: Isolating Advertisements From Mobile Applications in Android | Zhang, Ahlawat, Du

Xiao Zhang, Amit Ahlawat, Wenliang Du; AFrame: Isolating Advertisements From Mobile Applications in Android; In Proceedings of Annual Computer Security Applications Conference (ACSAC); 2013-12-09; 10 pages.

Abstract

Android uses a permission-based security model to restrict applications from accessing private data and privileged resources. However, the permissions are assigned at the application level, so even untrusted third-party libraries, such as advertisement, once incorporated, can share the same privileges as the entire application, leading to over-privileged problems.

We present AFrame, a developer friendly method to isolate untrusted third-party code from the host applications. The isolation achieved by AFrame covers not only the process/permission isolation, but also the display and input isolation. Our AFrame framework is implemented through a minimal change to the existing Android code base; our evaluation results demonstrate that it is effective in isolating the privileges of untrusted third-party code from applications with reasonable performance overhead.

Via: backfill

TaintDroid

TaintDroid Realtime Privacy Monitoring on Smartphones

William Enck, Peter Gilbert, Byung-Gon Chun, Landon P. Cox, Jaeyeon Jung, Patrick McDaniel, Anmol N. Sheth; Taintdroid: An Information-Flow Tracking System For Realtime Privacy Monitoring on Smartphones; In Proceedings of the 9th USENIX Conference On Operating Systems Design and Implementation (OSDI’10); 2010; conference version: pages 1–6, technical report version: 15 pages; landing

Abstract

Today’s smartphone operating systems frequently fail to provide users with adequate control over and visibility into how third-party applications use their private data. We address these shortcomings with TaintDroid, an efficient, system-wide dynamic taint tracking and analysis system capable of simultaneously tracking multiple sources of sensitive data. TaintDroid provides realtime analysis by leveraging Android’s virtualized execution environment. TaintDroid incurs only 14% performance overhead on a CPU-bound micro-benchmark and imposes negligible overhead on interactive third-party applications. Using TaintDroid to monitor the behavior of 30 popular third-party Android applications, we found 68 instances of potential misuse of users’ private information across 20 applications. Monitoring sensitive data with TaintDroid provides informed use of third-party applications for phone users and valuable input for smartphone security service firms seeking to identify misbehaving applications.

Concept

  • A contagion algebra on taint tags
  • A taint tag database
  • A special OS, special ROM
  • Updated to Android 4.1, released 2010-10-06.