Blackdroid: A black-box way for Android plaintext and ciphertext privacy leaks detecting and guarding

Constantly emerging third-party apps bring huge convenience and enjoyment to Android users. However, vulnerabilities of Android´s own permission management mechanism allow apps to read user´s privacy data and send them outside without the user´s consent. In this paper, we provide Blackdroid, a light weight plaintext and ciphertext privacy leaks detecting and controlling solution for Android. Based on preset labels, Blackdroid tracks the flow of text privacy data in third-party apps via a black-box way, and drops the bad packages containing privacy if necessary. We tested 4428 popular apps from Chinese Android market Gfan using Blackdroid. Of the tested apps, 21.7% send out packages carrying sensitive contents. In performance experiments, we observed only 4.5% time overload gain in internet package sending out phase.