2018/10/31 by Davino Mauro Junior, Kiev Gama, Junior, Davino Mauro +3
Computer Science · #Advanced Malware Detection Techniques #Cryptography and Security (cs.CR) #FOS: Computer and information sciences #Network Security and Intrusion Detection #Security and Verification in Computing #cs.CR
paper · pdf · doi:10.48550/arxiv.1810.13367
Paper accepted for publication in the XVIII Brazilian Symposium On Information and Computational Systems Security
openalex publication_date 2018/10/31 · arxiv created 2018/11/03 · arxiv updated 2018/11/06 · openalex created_date 2018/11/09 · openalex updated_date 2026/07/28
Internet of Things is growing rapidly, with many connected devices now available to consumers. With this growth, the IoT apps that manage the devices from smartphones raise significant security concerns. Typically, these apps are secured via sensitive credentials such as email and password that need to be validated through specific servers, thus requiring permissions to access the Internet. Unfortunately, even when developers are well-intentioned, such apps can be non-trivial to secure so as to guarantee that user's credentials do not leak to unauthorized servers on the Internet. For example, if the app relies on third-party libraries, as many do, those libraries can potentially capture and leak sensitive credentials. Bugs in the applications can also result in exploitable vulnerabilities that leak credentials. This paper presents our work in-progress on a prototype that enables developers to control how information flows within the app from sensitive UI data to specific servers. We extend FlowFence to enforce fine-grained information flow policies on sensitive UI data.