ASU Electronic Theses and Dissertations
This collection includes most of the ASU Theses and Dissertations from 2011 to present. ASU Theses and Dissertations are available in downloadable PDF format; however, a small percentage of items are under embargo. Information about the dissertations/theses includes degree information, committee members, an abstract, supporting data or media.
In addition to the electronic theses found in the ASU Digital Repository, ASU Theses and Dissertations can be found in the ASU Library Catalog.
Dissertations and Theses granted by Arizona State University are archived and made available through a joint effort of the ASU Graduate College and the ASU Libraries. For more information or questions about this collection contact or visit the Digital Repository ETD Library Guide or contact the ASU Graduate College at gradformat@asu.edu.
Displaying 1 - 2 of 2
Filtering by
- All Subjects: Android Security
- All Subjects: Defect discovery
- Creators: Doupe, Adam
Description
One of the most common errors developers make is to provide incorrect string
identifiers across the HTML5-JavaScript-CSS3 stack. The existing literature shows that a
significant percentage of defects observed in real-world codebases belong to this
category. Existing work focuses on semantic static analysis, while this thesis attempts to
tackle the challenges that can be solved using syntactic static analysis. This thesis
proposes a tool for quickly identifying defects at the time of injection due to
dependencies between HTML5, JavaScript, and CSS3, specifically in syntactic errors in
string identifiers. The proposed solution reduces the delta (time) between defect injection
and defect discovery with the use of a dedicated just-in-time syntactic string identifier
resolution tool. The solution focuses on modeling the nature of syntactic dependencies
across the stack, and providing a tool that helps developers discover such dependencies.
This thesis reports on an empirical study of the tool usage by developers in a realistic
scenario, with the focus on defect injection and defect discovery times of defects of this
nature (syntactic errors in string identifiers) with and without the use of the proposed
tool. Further, the tool was validated against a set of real-world codebases to analyze the
significance of these defects.
identifiers across the HTML5-JavaScript-CSS3 stack. The existing literature shows that a
significant percentage of defects observed in real-world codebases belong to this
category. Existing work focuses on semantic static analysis, while this thesis attempts to
tackle the challenges that can be solved using syntactic static analysis. This thesis
proposes a tool for quickly identifying defects at the time of injection due to
dependencies between HTML5, JavaScript, and CSS3, specifically in syntactic errors in
string identifiers. The proposed solution reduces the delta (time) between defect injection
and defect discovery with the use of a dedicated just-in-time syntactic string identifier
resolution tool. The solution focuses on modeling the nature of syntactic dependencies
across the stack, and providing a tool that helps developers discover such dependencies.
This thesis reports on an empirical study of the tool usage by developers in a realistic
scenario, with the focus on defect injection and defect discovery times of defects of this
nature (syntactic errors in string identifiers) with and without the use of the proposed
tool. Further, the tool was validated against a set of real-world codebases to analyze the
significance of these defects.
ContributorsKalsi, Manit Singh (Author) / Gary, Kevin A (Thesis advisor) / Lindquist, Timothy E (Committee member) / Doupe, Adam (Committee member) / Arizona State University (Publisher)
Created2016
Description
Android is currently the most widely used mobile operating system. The permission model in Android governs the resource access privileges of applications. The permission model however is amenable to various attacks, including re-delegation attacks, background snooping attacks and disclosure of private information. This thesis is aimed at understanding, analyzing and performing forensics on application behavior. This research sheds light on several security aspects, including the use of inter-process communications (IPC) to perform permission re-delegation attacks.
Android permission system is more of app-driven rather than user controlled, which means it is the applications that specify their permission requirement and the only thing which the user can do is choose not to install a particular application based on the requirements. Given the all or nothing choice, users succumb to pressures and needs to accept permissions requested. This thesis proposes a couple of ways for providing the users finer grained control of application privileges. The same methods can be used to evade the Permission Re-delegation attack.
This thesis also proposes and implements a novel methodology in Android that can be used to control the access privileges of an Android application, taking into consideration the context of the running application. This application-context based permission usage is further used to analyze a set of sample applications. We found the evidence of applications spoofing or divulging user sensitive information such as location information, contact information, phone id and numbers, in the background. Such activities can be used to track users for a variety of privacy-intrusive purposes. We have developed implementations that minimize several forms of privacy leaks that are routinely done by stock applications.
Android permission system is more of app-driven rather than user controlled, which means it is the applications that specify their permission requirement and the only thing which the user can do is choose not to install a particular application based on the requirements. Given the all or nothing choice, users succumb to pressures and needs to accept permissions requested. This thesis proposes a couple of ways for providing the users finer grained control of application privileges. The same methods can be used to evade the Permission Re-delegation attack.
This thesis also proposes and implements a novel methodology in Android that can be used to control the access privileges of an Android application, taking into consideration the context of the running application. This application-context based permission usage is further used to analyze a set of sample applications. We found the evidence of applications spoofing or divulging user sensitive information such as location information, contact information, phone id and numbers, in the background. Such activities can be used to track users for a variety of privacy-intrusive purposes. We have developed implementations that minimize several forms of privacy leaks that are routinely done by stock applications.
ContributorsGollapudi, Narasimha Aditya (Author) / Dasgupta, Partha (Thesis advisor) / Xue, Guoliang (Committee member) / Doupe, Adam (Committee member) / Arizona State University (Publisher)
Created2014