cynicalsecurity 
Q. Wang et al., "EavesDroid: Eavesdropping User Behaviors via OS Side-Channels on Smartphones"¹
As the Internet of Things (IoT) continues to grow, smartphones have become an integral part of IoT systems. However, with the increasing amount of personal information stored on smartphones, users' privacy is at risk of being compromised by malicious attackers. Malware detection engines are commonly installed on smartphones to defend against these attacks, but new attacks that can evade these defenses may still emerge. In this paper, we present EavesDroid, a new side-channel attack on Android smartphones that allows an unprivileged attacker to accurately infer fine-grained user behaviors (e.g. viewing messages, playing videos) through the on-screen operations. Our attack relies on the correlation between user behaviors and the return values of system calls. The fact that these return values are affected by many factors, resulting in fluctuation and misalignment, makes the attack more challenging. Therefore, we build a CNN-GRU classification model, apply min-max normalization to the raw data and combine multiple features to identify the fine-grained user behaviors. A series of experiments on different models and systems of Android smartphones show that, EavesDroid can achieve an accuracy of 98% and 86% for already considered user behaviors in test set and real-world settings. To prevent this attack, we recommend malware detection, obfuscating return values or restricting applications from reading vulnerable return values.
#ResearchPapers #arXiv #IoT #OSSideChannels #Smartphone #UserBehaviour
__
¹ https://arxiv.org/abs/2303.03700
EavesDroid: Eavesdropping User Behaviors via OS Side-Channels on Smartphones
As the Internet of Things (IoT) continues to evolve, smartphones have become essential components of IoT systems. However, with the increasing amount of personal information stored on smartphones, user privacy is at risk of being compromised by malicious attackers. Although malware detection engines are commonly installed on smartphones against these attacks, attacks that can evade these defenses may still emerge. In this paper, we analyze the return values of system calls on Android smartphones and find two never-disclosed vulnerable return values that can leak fine-grained user behaviors. Based on this observation, we present EavesDroid, an application-embedded side-channel attack on Android smartphones that allows unprivileged attackers to accurately identify fine-grained user behaviors (e.g., viewing messages and playing videos) via on-screen operations. Our attack relies on the correlation between user behaviors and the return values associated with hardware and system resources. While this attack is challenging since these return values are susceptible to fluctuation and misalignment caused by many factors, we show that attackers can eavesdrop on fine-grained user behaviors using a CNN-GRU classification model that adopts min-max normalization and multiple return value fusion. Our experiments on different models and versions of Android smartphones demonstrate that EavesDroid can achieve 98% and 86% inference accuracy for 17 classes of user behaviors in the test set and real-world settings, highlighting the risk of our attack on user privacy. Finally, we recommend effective malware detection, carefully designed obfuscation methods, or restrictions on reading vulnerable return values to mitigate this attack.