text:
This action might not be possible to undo. Are you sure you want to continue?
William Enck, Damien Octeau, Patrick McDaniel, and Swarat Chaudhuri Systems and Internet Infrastructure Security Laboratory Department of Computer Science and Engineering The Pennsylvania State University {enck, octeau, mcdaniel, firstname.lastname@example.com Abstract
The fluidity of application markets complicate smartphone security. Although recent efforts have shed light on particular security issues, there remains little insight into broader security characteristics of smartphone applications. This paper seeks to better understand smartphone application security by studying 1,100 popular free Android applications. We introduce the ded decompiler, which recovers Android application source code directly from its installation image. We design and execute a horizontal study of smartphone applications based on static analysis of 21 million lines of recovered code. Our analysis uncovered pervasive use/misuse of personal/phone identifiers, and deep penetration of advertising and analytics networks. However, we did not find evidence of malware or exploitable vulnerabilities in the studied applications. We conclude by considering the implications of these preliminary findings and offer directions for future analysis. ingly desire it, markets are not in a position to provide security in more than a superficial way [30]. The lack of a common definition for security and the volume of applications ensures that some malicious, questionable, and vulnerable applications will find their way to market. In this paper, we broadly characterize the security of applications in the Android Market. In contrast to past studies with narrower foci, e.g., [14, 12], we consider a breadth of concerns including both dangerous functionality and vulnerabilities, and apply a wide range of analysis techniques. In this, we make two primary contributions: • We design and implement a Dalvik decompilier, ded. ded recovers an application's Java source solely from its installation image by inferring lost types, performing DVM-to-JVM bytecode retargeting, and translating class and method structures. • We analyze 21 million LOC retrieved from the top 1,100 free applications in the Android Market using automated tests and manual inspection. Where possible, we identify root causes and posit the severity of discovered vulnerabilities. Our popularity-focused security analysis provides insight into the most frequently used applications. Our findings inform the following broad observations. 1. Similar to past studies, we found wide misuse of privacy sensitive information—particularly phone identifiers and geographic location. Phone identifiers, e.g., IMEI, IMSI, and ICC-ID, were used for everything from "cookie-esque" tracking to accounts numbers. 2. We found no evidence of telephony misuse, background recording of audio or video, abusive connections, or harvesting lists of installed applications. 3. Ad and analytic network libraries are integrated with 51% of the applications studied, with Ad Mob (appearing in 29.09% of apps) and Google Ads (appearing in 18.72% of apps) dominating. Many applications include more than one ad library.
The rapid growth of smartphones has lead to a renaissance for mobile services. Go-anywhere applications support a wide array of social, financial, and enterprise services for any user with a cellular data plan. Application markets such as Apple's App Store and Google's Android Market provide point and click access to hundreds of thousands of paid and free applications. Markets streamline software marketing, installation, and update—therein creating low barriers to bring applications to market, and even lower barriers for users to obtain and use them. The fluidity of the markets also presents enormous security challenges. Rapidly developed and deployed applications [40], coarse permission systems [16], privacyinvading behaviors [14, 12, 21], malware [20, 25, 38], and limited security models [36, 37, 27] have led to exploitable phones and applications. Although users seem-
number of DVM registers used. local variable table. The phone comes pre-installed with a selection of system applications. Binder acts as a mediation point for all IPC. The following sections reflect the two thrusts of this work: Sections 2 and 3 provide background and detail our decompilation process.psu. and operand stack sizes) and to class and instance variables. and numerical constants. email) and IPC is governed by permissions assigned at install time. This process consists of the translation. The Dalvik opcodes directly manipulate registers. a Dalvik application consists of a single . These failures generally fall into the classification of insufficient protection of privacy sensitive information. one should be circumspect about any interpretation of the following results as a definitive statement about how secure applications are today. The DVM and Java bytecode run-time environments differ substantially: Application Structure. A constant pool describes. the Dalvik dx compiler consumes the . Java bytecode can assign local variables to a local variable table before pushing them onto an operand stack for manipulation by opcodes. Register architecture.class file as it is referenced at run time. Background services provide RPC and callback interfaces that applications use to trigger actions or access data. Intents are typed interprocess messages that are directed to particular applications or systems services.edu/ded/ to aid the broader security community in understanding Android security. but it can also just work on the stack without explicitly storing variables in the table.cse. data (e. Dalvik Virtual Machine: Android applications are written in Java. and the data segment. references to other classes. and writes the resulting application into a single .. The DVM is register-based. not surprisingly. and interpretation of three basic elements of the application: the constant pools. method names.g. Many developers fail to securely use Android APIs.dex file.. an application is allowed to access a resource or interface if the required permission allows . but run in the DVM. address books. Rather. Each application is executed within a Dalvik Virtual Machine (DVM) running under a unique UNIX uid. whereas existing JVMs are stack-based. However. Java applications are composed of one or more . Dalvik bytecode assigns local variables to any of the 216 available registers.g. The Dalvik bytecode instruction set is Application DVM Application DVM Application DVM Binder Embedded Linux Application DVM DVM DVM DVM 2 Background Android: Android is an OS designed for smartphones. The remaining sections discuss our limitations and interpret the results. and the Internet). reconstruction.class files. Installed Applications System Applications Application Application Application Display Bluetooth GPS Receiver Cellular Radio Figure 1: The Android system architecture it. we believe these results are indicative of the current state. To simplify.g. address book. Android provides a sandboxed application execution environment... we found no exploitable vulnerabilities that can lead malicious control of the phone. Finally user interface activities receive named action signals from the system and other applications. e. After the Java compiler creates JVM bytecode. This includes. among other items. one file per class. The JVM loads the bytecode for a Java class from the associated . Applications interact with each other and the phone through different forms of IPC. Conversely. We plan to continue with this analysis in the future and have made the decompiler freely available at http://siis. phone dialer. The class definitions consist in the basic information such as access flags and class names. This paper is an initial but not final word on Android application security. Figure 2 provides a conceptual view of the compilation process for DVM applications. but there remain many aspects of the applications that warrant deeper analysis. or broadcast to applications subscribing to a particular intent type. GPS receivers.dex file containing all application classes. Instruction set. A customized embedded Linux system interacts with the phone hardware and an off-processor cellular radio. text messaging. as well as other information related to methods (e. and Sections 4 and 5 detail the application study. Permission assignment—and indirectly the security policy for the phone—is largely delegated to the phone's owner: the user is presented a screen listing the permissions an application requests at install time. Persistent content provider data stores are queried through SQL-like interfaces. recompiles them to Dalvik bytecode. To simplify. rather than accessing elements on a program stack. which they can accept or reject. The data element contains the method code executed by the target VM. Depicted in Figure 1.4. Access to system resources (e. Thus. phone services.class files. The permissions requested by the application and the permissions required to access the application's interfaces/data are defined in its manifest file. the constants used by a class. an application's only interface to the phone is through these APIs.g. The Binder middleware and application API runs on top of Linux. the class definitions.
and (3) retargeting the bytecode.. 1]. and a comparison of an integer and zero. The Dalvik bytecode uses a more simplistic integer compar- 3 The ded decompiler Building a decompiler from DEX to Java for the study proved to be surprisingly challenging. Type Inference: The first step in retargeting is to identify class and method constants and variables. perform manual confirmation. However.g.java files) ClassN. b) optimization. The Dalvik bytecode uses ambiguous opcodes to store and retrieve elements in arrays of primitive types (e. switch statements and exception handlers are structured differently in Dalvik and Java bytecode. Comparison of object references. However. 32 or 64 bits). the Dalvik bytecode does not always provide enough information to determine the type of a variable or constant from its register declaration. Constant pool structure. Type inference has been widely studied [44]. 3. There are two generalized cases where variable types are ambiguous: 1) constant and variable declaration only specifies the variable width (e. however. they often include the source and destination registers. Ambiguous primitive types. Control flow Structure. In Dalvik bytecode. the nature of the opcodes is very different..class Constant Pool Class Info Data Java Source Code (. On the one hand.1 Because of the vast differences between JVM and DVM. This choice to decompile the Java source rather than operate on the DEX opcodes directly was grounded in two reasons.g. constant zero values present in the Dalvik bytecode have ambiguous typing that must be recovered. simple modification of existing decompilers was not possible.class Constant Pool Class Info Data dx . 32. The Dalvik bytecode does not specify a null type. Java has tens of opcodes dedicated to moving elements between the stack and local variable table. Storage of primitive types in arrays. and 2) comparison operators do not distinguish between integer and object reference comparison (i. aget for int/float and aget-wide for long/double) whereas the corresponding Java bytecode is unambiguous. but have a 35% larger code size (bytes) [9]. integers.1 Application Retargeting The initial stage of decompilation retargets the application . instead opting to use a zero value constant. and single and double precision floatingpoint elements disappear during this process. and concludes with a brief discussion of its validation. Java applications replicate elements in constant pools within the multiple . The dx compiler eliminates much of this replication. Control flow elements such as loops.g.class files.dex file to Java classes. e. 3.. long integers. e. dx eliminates some constants by inlining their values directly into the bytecode. Additionally..Java Compiler Class1. 31. applications have on average 30% fewer instructions than in Java. The Java bytecode uses typed opcodes for the comparison of object references (if acmpeq and if acmpne) and for null comparison of object references (ifnull and ifnonnull). Dalvik uses a single pool that all classes simultaneously reference. Dalvik assignments (int/float and long/double) use the same opcodes for integers and floats. The array type must be recovered for correct translation. referrer and referent method names. ClassN definition Data Figure 2: Compilation process for DVM applications substantially different than that of Java.e.g. Dalvik instructions tend to be longer than Java instructions. Java bytecode variable assignments distinguish between integer (int) and single-precision floating-point (float) constants and between long integer (long) and double-precision floatingpoint (double) constants. ded extraction occurs in three stages: a) retargeting. respectively. integer. Java bytecode structure loosely mirrors the source code. whereas Dalvik bytecode does not. For example. (2) translating the constant pool. the opcodes are untyped beyond specifying precision. or null reference. there existed no functional tool for the Dalvik bytecode. Java decompilation has been studied since the 1990s— tools such as Mocha [5] date back over a decade. Dalvik applications require fewer instructions. Second. Thus. but not whether it is a float. Null references. with many other techniques being developed [39. In practice. null reference checks). Unfortunately. This requires the decompilation process to recover types for integer comparisons used in DVM bytecode. 4. we wanted to leverage existing tools for code analysis.. First. prior to our work. Interested readers are referred to [35] for a thorough treatment. and c) decompilation. Dalvik has 218 opcodes while Java has 200. e.dex file Header Constant Pool Class1 definition ison for these purposes: a comparison between two integers. This section presents the challenges and process of ded. we required access to source code to identify false-positives resulting from automated code analysis.g. As a result.. Figure 3 overviews this process: (1) recovering typing information. The seminal Hindley-Milner [33] algorithm provides the basis for type inference algorithms used by many languages such .
Method Code Retargeting: The final stage of the retargeting process is the translation of the method code.g. Third. There are three ways ded infers a register's type.class Conversion Constant Pool Conversion Constant Pool Translation Method Code Retargeting Bytecode Reorganization (3) Java .dex and . Hence legal Dalvik comparisons always involve registers of the same type. ded walks the instructions in the control flow graph starting from its declaration. In this case. any comparison of a variable or constant with a known type exposes the type.. however.. and b) Dalvik bytecode places primitive type constants directly in the bytecode. all paths leading to an integer comparison originate with registers assigned a constant zero). and a default type (e. Once ded identifies the constants required by a class. Constant Pool Conversion: The . This algorithm resolves all ambiguous primitive types. i. and instance variable references. through the control flow graph from each register declaration to all subsequent ambiguous uses.g. ded maps each referenced register to a Java local variable table index. and instance variables. and c) when an exception is thrown. ded traverses the bytecode for each method in a class. one Dalvik instruction frequently expands to multiple Java instructions. which is propagated to the Dalvik bytecode. First. Second. Constants include references to classes.class Optimization Instruction Set Translation minate: a) when the register is reassigned to another variable (e. After reconstructing the control flow graph. we must evaluate the register type within its context of the method control flow. e. method. Perl. type information is forward propagated. modulo register reassignment. ded performs an instruction translation for each encountered Dalvik instruction. the created Java constant pool entries are based on the Dalvik constant pool entries. instructions such as add-int only operate on specific types. Third. If a type-exposing instruction is encountered. The preprocessing phase addresses multidimensional arrays.g. Second.class file. we preprocess the bytecode to reorganize structures that cannot be directly retargeted. Both Dalvik and Java use blocks of bytecode instructions to create multidimensional arrays. Similar techniques are used by languages with strong type inference.class file. the next branch is popped off the stack and the search continues. As Dalvik bytecode is more compact and takes more arguments. Dalvik registers loosely correspond to Java variables.. the variable is labeled and the process is complete for that variable. We convert constant pool information in two steps. These approaches determine unknown types by observing how variables are used in operations with known type operands.g. For class. ded Figure 3: Dalvik bytecode retargeting as Haskell and ML. e. Lastly. After a branch is abandoned. ded performs a depth-first search of the control flow graph looking for type-exposing instructions. The first step is to identify which constants are needed for a .(1) DEX Parsing CFG Construction Type Inference Processing Missing Type Inference Constant Identification (2) Java . The ded type inference algorithm proceeds as follows. the instructions have different semantics and layout. whereas Java bytecode uses the constant pool for most references. Each branch of the control flow encountered is pushed onto an inference stack. ded also identifies all constant primitives. integer) can be assigned. The constant pool formats differ in complexity.g. ded identifies any ambiguous register declaration. Because the types of passed parameters and return values are identified by method signatures. Second. b) when a return function is encountered. OCAML. it adds them to the target . e. manifestly exposing typing information. For each such register. ded adopts the accepted approach: it infers register types by observing how they are used in subsequent operations with known type operands. Comparison of dissimilar types requires type coercion in Java. there is no need to search outside the method.e. a new declaration is encountered). except for one isolated case when all paths leading to a type ambiguous instruction originate with ambiguous constant instructions (e.2 There are three events that cause a branch search to ter- .g. methods.. For primitive type constants. as well weaker inference. inference must be path-sensitive. Note further that ded type inference is also method-local. Dalvik constant pool entries use significantly more references to reduce memory overhead. First. noting such references. Specifically. The bytecode translation linearly processes each Dalvik instruction. Because Dalvik bytecode reuses registers whose variables are no longer in scope. instructions that pass registers to methods or use a return value expose the type via the method signature.. the type does not impact decompilation.. First. we linearly traverse the DVM bytecode and translate to the JVM. new entries are created. ded reorders and annotates the bytecode with array size and type information for translation..class file constant pools differ in that: a) Dalvik maintains a single constant pool for the application and Java maintains one for each class.
12% 92. which are not included in the bytecode).30% 310203 9696 99. While Soot is centrally an optimization tool with the ability to recover source code in most cases.16% 766045 9809 99.patches the relative offsets used for branches based on preprocessing annotations.30% 778446 15539 99. and Fernflower [1]. The included tests recovered the source code for small.32% 1832514 8012 99. 1) interactions between synchronized blocks and exception handling.class files can be decompiled using existing tools.g. the retargeted . JD [3]. and we expect further improvements in the near future.g. s0 .64% 96.41% 21734202 where ded creates a Java local variable for each regis ter. This represents about 94% of the total classes in the applications. Thus.class file. one to add. ded defines exception tables that describe try/catch/finally blocks. Fernflower [1] or Soot [45]. e.47% 1419783 262110 99. For example. The decompilation process was able to recover over 247 thousand classes spread over 21.27% 93. it is significantly more difficult to understand and analyze.87% 887794 15771 99. decompiled code is complex and frustrates analysis.25% 94. etc.39% 93. and one to pop the result. d0 → d0 .34% 94.54% 94. The resulting translated code is combined with the constant pool to creates a legal Java . Jad [4]. Furthermore. Java tools often optimize out unnecessary assignments to the local variable table.41% 94.38% 985423 8047 99. s0 → s . The application images were obtained from the market using a custom retrieval tool on September 1.41% 94.69% 95. we encountered two central problems involving.7 days) of compute time.97% of the total time was devoted to Soot optimization and decompilation. Soot dominated the processing time: 99. While the resulting source code is functionally equivalent to the original.64% 95. In particular. 3.30% 94.18% 182655 8509 99.100 applications took 497. medium and large open source applications and found no errors in recovery.69% 94.72% 415625 23000 99.38% 94.04% 93.90% 94.23% 2048177 2748 99.39% 709915 18375 99.55% 94. While the Java bytecode generated by ded is legal.58% 727642 10754 99. The translation creates 0 four Java instructions: two to push the variables onto the stack. we use Soot as a post-retargeting optimizer. Table 1 lists decompilation statistics.33% 93. There are two categories of failures: Retargeting Failures. Without optimization. In most cases the recovered code was virtually indistinguishable from the original source (modulo comments and method local-variable names. We also used ded to recover the source code for the top 50 free applications (as listed by the Android Market) from each of the 22 application categories—1.g.7 hours (about 20. 0.7 million lines of code. it does not process certain legal program idioms (bytecode structures) generated by ded...45% 94.29% 1556392 8508 99. . Recent efforts have focused on improving optimization.69% 847511 9548 99.28% 95. 2010. and thus are ignored for the study reported in the latter sections.2 Optimization and Decompilation At this stage. The need for bytecode optimization is easily demonstrated by considering decompiled loops. artifacts of the retargeting process can lead to decompilation errors in some decompilers. 5% of the classes were successfully retargeted. Parallel work on improving ded has been able to reduce these errors by a third. the source code failure rate reported in the following section is almost entirely due to Soot's inability to extract source code from these two cases. We will consider other decompilers in future work.87% 1443600 10596 99.46% 1323805 14297 99.20% 93.44% 651881 4806 99. i.3 Source Code Recovery Validation We have performed extensive validation testing of ded [35]. especially for nested loops. s1 Java iload s 0 iload s 1 iadd istore d0 Table 1: Studied Applications (from Android Market) Category Comics Communication Demo Entertainment Finance Games (Arcade) Games (Puzzle) Games (Casino) Games (Casual) Health Lifestyle Multimedia News/Weather Productivity Reference Shopping Social Libraries Sports Themes Tools Travel Total Total Retargeted Decompiled Classes Classes Classes LOC 5627 99. The decompilation of all 1.100 in total. e.. Most decompilers convert for loops into infinite loops with break instructions. ded's bytecode translation process yields unoptimized Java code. Finally.59% of classes were not retargeted. However. and 2) complex control flows caused by break statements. Decompilation Failures. but Soot failed to recover the source 3.49% 94.. as well as redesigning ded with a formally defined type inference apparatus.29% 839866 18791 99.69% 681429 11438 99.e. These errors fall into three classes: a) unresolved references which prevent optimization by Soot. The following is an example translation for add-int: Dalvik add-int d0 .57% 95.52% 1123674 14751 99. e.25% 1371351 23188 99. b) type violations caused by Android's dex compiler and c) extremely rare cases in which ded produces illegal bytecode. All decompilation errors are manifest during/after decompilation.75% 830471 10300 99. unneeded return values.
Future studies will investigate the fidelity of Fernflower's output and its appropriateness as input for program analysis. IMEI (device ID). Structural analysis.553 classes from a variety of packages.. Control flow analysis.$new(. Structural analysis allows for declarative pattern matching on the abstract syntax of the input source code.) p2 = i. IMSI (subscriber ID). Data flow analysis permits the declarative specification of problematic data flows in the input program.$set_class(. therefore.65 million retargeted methods–a significant improvement. we performed a parallel study to evaluate Soot on Java applications generated with traditional Java compilers.$new_action(.100 optimized applications using Fernflower and had a recovery rate of 98.. the rule monitors executions of P.) | i.e. Essentially..TelephonyManager. Semantic analysis allows the specification of a limited set of constraints on the values used by the input program.. Data flows between the sources and sinks are violations. For example... Semantic analysis.telephony.) p6 = $unprotected_send(i) | $protected_send(i. Figure 4 shows an example automaton for sending intents. data flow specification allows for a much easier encoding. b) searching for general coding security failures. an Android phone contains several pieces of private information that should never leave the phone: the user's phone number. and semantic analysis... a property of interest in our study was that an Android application does not send SMS messages to hard-coded targets.. The specification declaratively labels program statements matching certain syntactic patterns as data flow sources and sinks.. in our study. A possible way to improve this is to use a different decompiler. Structural analysis specifications are not concerned with program executions or data flow. The technical report [15] provides a detailed discussion of specifications. To statically detect violations specified by A. Since not all control flow paths in the model are feasible in concrete executions of P. data flow analysis. While this property can in principle be coded using automata.$set_component(. Semantic specifications permit us to directly specify that the first parameter in these calls (the phone number) is not a constant. Unless otherwise specified. Soot was able to decompile 94.04% of the 1. structural analysis. all tests used the Fortify SCA [2] static analysis suite.. We decompiled the same 1. false positives are possible.class files. The following discusses the general application of these approaches.$set_class(.) | i. synchronously "executing" A on the actions executed along this path. . which provides these four types of analysis.$put_extra(. though uncommon in practice.) | i.) p5 = i. a control flow rule is an automaton A whose input words are sequences of actions of P—i.59%. we only provide an overview of the specifications. null) p1 init p3 p2 p4 empty has_data p5 p6 Figure 4: Example control flow specification Data flow analysis.) p3 = i. Of 31. we defined a pattern matching calls to Android messaging methods such as sendTextMessage().. the program analysis traces each control flow path in the tool's model of P.. resulting in a potential unintended information leakage. and c) exploring misuse/security failures in the use of Android framework.code. analysis is local and straightforward. The details for our analysis specifications can be found in the technical report [15]. we wanted to specify a bug pattern where an Android application mines the device ID of the phone on which it runs. and ICC-ID (SIM card serial number). For example. Control flow analysis imposes constraints on the sequences of actions executed by an input program P. For example. This pattern was defined using a structural rule that stated that the input program called a method getDeviceId() whose enclosing class was android. To express this property...2 Analysis Overview Our analysis covers both dangerous functionality and vulnerabilities. False negatives are also possible in principle.) p4 = i. The analyzer detects violations to this property using constant propagation techniques well known in program analysis literature. indicating we cannot do better while using Soot for decompilation. 4 Evaluating Android Security Our Android application study consisted of a broad range of tests focused on three kinds of analysis: a) exploring issues uncovered in previous studies and malware advisories. For brevity. targeted error p1 = i. Selecting the properties for study was a significant challenge. The following discusses the process of identifying and encoding the tests. classifying some of them as errors. Here. Since our study. In order to understand the impact of decompiling ded retargeted classes verses ordinary Java . 4. Fernflower [1] was available for a short period as part of a beta test.1 Analysis Specification We used four approaches to evaluate recovered source code: control flow analysis.. In our study.$set_component(. An erroneous action sequence is one that drives A into a predefined error state. Here we are limited by the state of the art in decompilation. 4. the error state is reached if the intent contains data and is sent unprotected without specifying the target component.. we wanted to check that this information is not leaked to the network.$new_class(.
In total. however we identified a different data flow not found by program analysis. Finding 1 . but 1 application does not have the READ_ PHONE_STATE permission. Table 3 indicates the data flows that exfiltrate phone identifiers.4). 5. Harvesting Installed Applications (Section 5. We seek to identify not only the existence of data flows. but understand why they occur.1). Previous studies [14] identified location exposure to advertisement servers. the IMSI and ICC-ID are very rarely used (less than 3%). including: writing sensitive information to logs. Most applications use HTTP client wrappers for network connections. We look for general Java application vulnerabilities. we document the program analysis results and manual inspection of identified violations. Table 2: Access of Phone Identifier APIs Identifier # Calls # Apps # w/ Permission∗ Phone Number 167 129 105 IMEI 378 216 184† IMSI 38 30 27 ICC-ID 33 21 21 Total Unique 246 210† ∗ Defined as having the READ_PHONE_STATE permission. † Only 1 app did not also have the INTERNET permission. Due to space limitations. Many applications provide valuable locationaware utility. 246 applications (22. Previous studies [14. injection attacks on intent actions.Misuse of Phone Identifiers (Section 5.1. Smartphone malware has sent SMS messages to premium-rate numbers. We survey the use of APIs to retrieve this list to identify harvesting of installed applications. We studied four phone identifiers: phone number. 10]. Table 2 summarizes APIs calls that receive phone identifiers. Audio and video eavesdropping is a commonly discussed smartphone threat [41]. HTTP parameter names . IMSI (subscriber identifier). HTTP GET and POST parameters in HttpClient connections.2. Section 5. In this case. PC botnet clients historically use non-HTTP ports and protocols for command and control.Phone identifiers are frequently leaked through plaintext requests. 5 applications have IMSI data flows. Dangerous Developer Libraries (Section 5. We survey inclusion of ad and analytics libraries and the information they access.3. Abuse of Telephony Services (Section 5. as well as several additional applications that contain calls to identifier APIs. we seek to identify the portion of the application responsible for the exposure. The phone number is used second most (129 applications. Botnet Characteristics (Sockets) (Section 5. Exposure of Physical Location (Section 5. only 210 of these applications have the READ_PHONE_STATE permission required to obtain access. Eavesdropping on Audio/Video (Section 5. We study the use of hard-coded phone numbers to identify SMS and voice call abuse. Android-specific Vulnerabilities (Section 5. The 33 applications have the INTERNET permission. To gain a better understanding of how phone identifiers are used.2.7%). We confirmed exfiltration for all but one application.3. We performed two types of analysis: a) we scanned for APIs that access identifiers. 12] identified information exposure to ad and analytics networks. Future work may also include SMS as a sink. Finally. we observed dangerous functionality replicated between applications. We report on this replication and the implications. therefore. we examine Socket use for suspicious behavior. By manually inspecting code. During our manual source code inspection. The list of installed applications is a valuable demographic for marketing.3). IPC null checks. and b) we used data flow analysis to identify code capable of sending the identifiers to the network. which may be desired by the user.2). We found data flows for all four identifier types: 25 applications have IMEI data flows. 5. and delegation.2). We observe from Table 2 that applications most frequently access the IMEI (216 applications. misuse of cryptography. 14] through information sinks including OutputStream objects retrieved from URLConnections. Use of Advertisement Libraries (Section 5.3 discusses code that probes for permissions. 12] identified phone identifiers leaking to remote network servers.1).1. and ICCID (SIM card serial number).2.1 Information Misuse In this section. Previous studies [14. 10 applications have phone number data flows. We search for non-secure coding practices [17. IMEI (device identifier).6%). 11. we explore how sensitive information is being leaked [12. we manually inspected all 33 identified applications.1). including misuse of passwords. and traditional injection vulnerabilities. unprotected broadcasts of information.4%) included code to obtain a phone identifier. 19. and the string used for URL objects. individual results for the general vulnerability analysis are reported in the technical report [15]. The analysis informs the following findings. We examine cases where applications record audio or video without control flows to UI code.4). and 4 applications have ICC-ID data flows. code complexity hindered manual confirmation.1 Phone Identifiers 5 Application Analysis Results In this section. General Java Application Vulnerabilities. however.2.1. Most sinks are HTTP GET or POST parameters.2).
The IMEI is tied to personally identifiable information (PII).zxing. specifically the IMEI. While the intent is not clear. com. we found two applications (com. Another application (com. Several applications that access phone identifiers did not exfiltrate the values." "deviceId.kring.g.9%) attempt to access location. These behaviors indicate that the IMEI is used as a form of "tracking cookie".2 Location Information Location information is accessed in two ways: (1) calling getLastKnownLocation().tubeLondonCity). For example." "deviceSerialNumber. cn.Phone identifiers are sent to advertisement and analytics servers.statefarm. The method sendDeviceInfos() sends this information to a server. device model. Due to code recovery failures. com. The fingerprint is kept in "secure storage" and does not appear to leave the phone. we found one application (com. which is an IMEI data flow sink. which defined the former but has no calls to the latter.android).g.google.discount). In another application (com.. the user can easily change or remove it. which also includes the phone number) and retrieving advertisements (see Finding 6). This difference is likely due to libraries that probe for permissions.superdroid. For example.g.eoeandroid.guarder and com.wny).g.Not all phone identifier use leads to exfiltration.tao and raker. Finding 3 . 505 applications (45. not all LocationListener objects have corresponding requestLocationUpdates() calls..andoop. # Flows # Apps 0 0 12 4 49 10 13 for the IMEI include: "uid. platform. In another application (com. and (2) defining callbacks in a LocationListener object passed to requestLocationUpdates(). Several applications contain code that binds the IMEI as a unique identifier to network requests. Finally. Many applications have custom ad and analytics functionality.slacker." Finding 2 .froogloid.Phone identifiers are used as device fingerprints. in a travel application (com. but the developer mislabeled it "imei. We also found functionality that includes the IMEI when checking for updates (e.ewc). We scanned for all three constructs." "devicePrint.store) with network access wrapper methods that include the IMEI for all connections.. phone number names include "phone" and "mdn". com. Phone identifier data flows also occur in ad libraries. Table 4 summarizes the access of location information.fm207.highscore) that appears to bundle the IMEI when submitting high scores for games.morbe. Finding 4 .pocketagent) include the IMEI in account registration and login requests.client.webascender.3 discusses ad libraries in more detail. The common belief that the IMEI to phone owner mapping is not visible outside the cellular network is no longer true.cartoon) contains a class named SyncDeviceInfosService that collects the IMEI and attributes such as the OS version and device hardware.3.sqd. we found a phone number data flow sink in the com/wooboo/adlib_android library used by several applications (e. and application name.Table 3: Detected Data Flows to Network Sinks Sink OutputStream HttpClient Param URL Object Total Unique Phone Identifiers # Flows # Apps 10 9 24 9 59 19 33 Location Info. While the value is sent to the network during registration. one application (com. Code inspection indicated that this method is called when the user chooses to "Enter a claim code" to redeem gift cards.g.radio and com.Qunar and com.callerid. applications (e.visualit. Finding 6 .ecook. the method linkDevice() includes the IMEI.6%) have the permission to do so. For example. the class ACCUWX AdRequest is an IMEI data flow sink. For example.mp3). Several data flows directed us towards code that reports not only phone identifiers. and com. Section 5. In total. as discussed in Section 5." "user-id.matchmobile) assigns the phone number to a text field used for account registration. and a "keyring" application (com.kindle) creates a device fingerprint for a verification check.accuweather. such fingerprinting indicates that phone identifiers are used for more than a unique identifier. The separation between LocationListener and requestLocationUpdates() is primarily due to the AdMob library. For example.taobo.duobao.android. Another application (com.Phone identifiers.eWallpapers. the method PhoneStats. com. Thus. but also other phone properties to a remote server. We also found IMEI use in code for sending comments and reporting problems (e. and IMSI names include "did" and "imsi.superdroid. it seems clear that databases containing mappings between physical users and IMEIs are being created.amazon.nextmobileweb. For example." In one case we identified an HTTP parameter for the ICC-ID.android) appends the IMEI to a variable named retailerLookupCmd. .amazon.amazon.mp3) defines Android service component AndroidMetricsManager. some applications (e. in one application (com. the method refreshLiveInfo() includes the IMEI in a URL. we found code that bound the IMEI to account information and other PII.1. Furthermore." "X-DSN. a wallpaper application (com.match. are used to track individual users.avantar." "imei. In several cases. only 304 (27.craigsphone) appear to bundle the IMEI in search queries." and "uniquely code". com. Finding 5 . 5.toUrlFormatedString() creates a URL parameter string containing the IMEI.
Future analysis should consider more premium-rate prefixes. e. 5 apps did not also have the INTERNET permission. (2) creation of URI objects with a "tel:" prefix (used for phone call intent messages) and the string "900" (a premium-rate number prefix in the US).Applications do not appear to be misusing voice services. One application included code to call "tel://0900-9292". classifieds. as the application (com. Note that our analysis specification is limited to constants passed directly to the API and final variables. Users may be aware of regional geographic information associated with scores. For example. points of interest. We found eight uses in seven applications of AudioRecord. Finding 10 . and accessing the list of installed applications. the data flow source was defined as the getLatitude() and getLongitude() methods of the Location object retrieved from the location APIs. including telephony services. however the classes extended SurfaceView. The analysis informs the following findings. Finding 9 .highscore) both the city/country and geographic coordinates are sent along with high scores. the "preview display" might be one pixel in size. which is used by setPreviewDisplay().70 per minute) for travel advice in the Netherlands.The granularity of location reporting may not always be obvious to the user.3 expands on ad libraries.∗ getLastKnownLocation 428 204 148 LocationListener 652 469 282 requestLocationUpdates 316 146 128 Total Unique 505 304† ∗ Defined as having a LOCATION permission.Applications do not appear to be misusing video recording. † In total.andoop. This query found two applications using video in code not reachable from an activity. and therefore may create false negatives. the AdMob library had a apparently unused phone number hard coded. but it also detects video recording.Planner9292) is designed to provide travel advice.yp) appended the location to the variable webAdURLString.Applications do not appear to be using fixed phone number services. and (3) any URI objects with a "tel:" prefix.start() in code not reachable from an activity component. Finding 12 .Applications do not appear to be misusing audio recording. we inspected the AdMob library to determine why no data flow was found and determined that source code recovery failures led to the false negatives. Inspection of the remaining applications informs the following findings: Finding 7 .2. but it was unclear if users are aware that precise coordinates are also used. and (3) MediaRecorder. We manually inspected the 13 applications with location data flows. Several location data flows appeared to terminate in network connections used to retrieve ads. ing a constant destination number for the SMS API. We found: (1) applications frequently include call functionality for customer service. To overcome missing code challenges. and (3) not all hard-coded telephone numbers are used to make phone calls. We found no applications that record video without calling setPreviewDisplay().read() in code not reachable from an Android activity component. and social networking services.Location information is sent to advertisement servers. We analyzed application eavesdropping behaviors. which is a premiumrate number (e0. We defined three queries to identify such malicious behavior: (1) a constant used for the SMS destination number. We found two applications creating URI objects with the "tel:" prefix and containing the string "900". this did not appear malicious.wny and com.g. The MediaRecorder.2 Background Audio/Video 5.read() without a control flow . Finding 8 . two applications (com. sockets. 5. For example. The SMS and premium-rate analysis results are promising indicators for non-existence of malicious behavior. whereas DIAL has user confirmation the dialer and requires no permission). (2) AudioRecord. Motivated by [14]. Many data flows appeared to reflect legitimate uses of location for weather.Identifier # Uses # Apps # w/ Perm. 25]. (2) the "CALL" and "DIAL" intent actions were used equally for the same purpose (CALL calls immediately and requires the CALL_PHONE permission. Table 4: Access of Location APIs Table 3 shows detected location data flows to the network. We found 468 URI objects with the "tel:" prefix in 358 applications.2 Phone Misuse This section explores misuse of the smartphone interfaces. Section 5. In one application (com. We found zero applications us- Microphone and camera eavesdropping on smartphones is a real concern [41].2.avantar. The query reasonably did not consider the value passed to the preview display. Finding 11 . The other application contained several hard-coded numbers with "900" in the last four digits of the number.avantar. and therefore may have false negatives.1 Telephony Services Smartphone malware can provide direct compensation using phone calls or SMS messages to premium-rate numbers [18.start() query detects audio recording. specifically: (1) recording video without calling setPreviewDisplay() (this API is always required for still image capture). We manually inspected a sample of applications to better understand phone number use. However. 5. background recording of audio and video..
Furthermore. We observe that most Internet-based smartphone applications are HTTP clients. and VoIP.jjy. Android includes useful classes (e.. Sampling these applications. In these applications. but can be made generic. Of these applications. but we found no evidence of malicious use. One application (com. we documented advertisement and analytics library paths. and thus are a potential source of malicious behavior. We manually inspected all 75 applications to determine if Socket use seemed appropriate based on the application description. which explains the lack of reachability.eingrad.3.Applications do not appear to be harvesting information about which applications are installed on the phone. but did not appear malicious." i.davidgoemans. 5. a common set of developer utilities.. and we could not determine their exact purpose. For example.g. The second application (raker. Among the applications including custom network connection wrappers is a group of applications in the "Finance" category implementing cryptographic network protocols (e.8%). smartphone-based botnets have been found to exist on "jailbroken" iPhones [8].g. The remaining application did not have the required RECORD_AUDIO permission and the code most likely was part of a developer toolkit. These uses queried specific functionality and thus are not likely to harvest application information.foo. org/ apache/commons. game interaction. Our survey of the query APIs identified three calls within the AdMob library duplicated in many applications.. chat protocols. For example. 5. speech recognition. but several applications warrant deeper investigation. Socket factories were also detected.We found no evidence of malicious behavior by applications using Socket directly. Finally. A handful of applications have socket connections to hard-coded IP address and non-standard ports.duobao.2. We note that these applications use Asian character sets for their market descriptions.start() query identified an additional five applications recording audio without reachability to an activity. Therefore.2.218 on port 2009. We also found applications sharing what we term "developer toolkits. the lack of reachability was likely due to code recovery failures. and org/eclipse/jetty. Our survey yielded a diverse array of Socket uses. We found 54 uses of the get APIs in 45 applications.lci) connects to 209. The MediaRecorder. Identified factory names such as TrustAllSSLSocketFactory. one application (com.g.3. and one provides voice search.94.MispAndroid320) include the kr/co/shiftworks library that connects to 221. the sampled applications using the get APIs search the results for a specific application.1 Advertisement and Analytics Libraries We identified 22 library paths containing ad or analytics functionality. in the com/lumensoft/ks library).4 Installed Applications The list of installed applications provides valuable marketing data. among other uses excluded for brevity.store) defines a similar method. Sampled applications frequently contained .e. one application (com.118 on port 9001.vintagecomicdroid) downloads comics from 208. In all but two cases.147 on port 80 in a class named AdService and subsequently calls getLocalAddress() to retrieve the phone's IP address. 5. During our manual inspection. The one non-AdMob application we inspected queried for specific functionality.miraeasset.2 discusses developer toolkits. and network connection tethering. Section 5.48. Additionally. and NonValidatingSSLSocketFactory are interesting as potential vulnerabilities. including: file transfer protocols. HttpURLConnection and HttpClient) for communicating with Web servers. Finding 14 .simpleClockWidget) defines a method that returns the list of all installed applications. and thus did not appear to attempt harvesting.mstock and kvp. Overall. 5. but the results were only displayed to the user.A small number of applications include code that uses the Socket class directly. we queried for applications that make network connections using the Socket class.e. we found no evidence of malicious behavior. two games included audio recording in a developer toolkit. audio and video streaming. which use sockets directly. we observe: Finding 15 . e.. Many applications are flagged for inclusion of well-known network libraries such as org/apache/thrift.appname typically exists in com/foo/ appname. Android has two relevant APIs types: (1) a set of get APIs returning the list of installed applications or package names.. but no record permission.85. Finding 13 . We found 177 Socket connections in 75 applications (6. Three of these applications have legitimate reasons to record audio: voice search.242. and (2) a set of query APIs that mirrors Android's runtime intent resolution.3 Included Libraries Libraries included by applications are often easy to identify due to namespace conventions: i. two are games that repeat what the user says. audio recording is expected. but it only appears to be called by unused debugging code.path to an activity component.tf1. the source code for com.143. AllTrustSSLSocketFactory.227. Several applications also included their own HTTP wrapper methods that duplicate functionality in the Android libraries. three provide VoIP functionality.3 Socket API Use Java sockets represent an open interface to external services. and 1015 uses of the query APIs in 361 applications. two of the aforementioned financial applications (com.
Some developer toolkits probe for permissions. eWallpapers. For example. P = Phone number. 5. AdMob has known location to network data flows [14]. We observe the following. Google Ads is used by 206 applications (18. Similar functionality exists in the com/casee/adsdk library (used by com. We observe from Table 5 that only a handful of libraries are used pervasively. The (WebtrendsAndroidValueFetcher) class uses try/catch blocks that catch the SecurityException that is thrown when an application does not have the proper permission. the AdMob SDK documentation [6] indicates that location information is only included if a package manifest configuration enables it. as mentioned in Section 6.jackeey. Finding 17 .jackeey. "system id extended" uses phone identifiers (IMEI. and ICC-ID. E‡ com/millennialmedia/android 52 Plain com/zestadz/android 10 Plain com/admarvel/android/ads 8 Plain com/estsoft/adlocal 8 Plain L com/adfonic/android 5 Obf. we found: 1 app has 8 libraries.orange.fish.july. L.pocketagent).wallpapers. 8 apps have 6 libraries. E = IMEI.getDeviceId() called. 15 apps have 5 libraries. phone number. and com. at least 561 applications (51%) include these libraries. Several libraries are also obfuscated. I† com/adserver/adview 3 Obf. 10 apps have 7 libraries. ICC-ID. While the original "jackeey.wallpaper" application was removed from the Android Market. L com/wooboo/adlib android 4 Obf. For example. com. it is easy to speculate data flows to network APIs. 37 apps have 4 libraries. IMSI. we observe the main application code not only specifies the phone number to be reported. IMEI. Finding 19 .1%). Inc. Finding 16 . The com/webtrends/mobile analytics library (used by com.cbssports.gundam).cartoon.Ad and analytics library use of phone identifiers and location is sometimes configurable. We found three wallpaper applications by developer "callmejack" that include utilities in the library path com/jackeeywu/apps/ eWallpaper (com. com/vdroid/ads 5 Obf. additional libraries may exist. Lookout. P. E com/medialets 4 Obf. and 367 apps have 1 library. we found code in the com/julysystems library that evaluates Android's checkPermission() method for the READ_PHONE_STATE and ACCESS_FINE_LOCATION permissions before accessing the IMEI. specifying event labels such as "GetMoreStories. Using the paths listed in Table 5.all1. 91 apps have 2 libraries. In AdFetcher. The analysis informs the following additional findings.7%).eoeandroid. E com/google/android/apps/analytics 67 Plain com/adwhirl 60 Plain L com/mobclix/android/sdk 58 Plain L. I = ICC-ID † In 1 app. many of these flows were not detected by program analysis.Some developer toolkits replicate dangerous functionality. and last known location. and ICC-ID). This is (likely) a result of code recovery failures and flows through Android IPC. reported a wallpaper application by developer "jackeey.Ad and analytics libraries probe for permissions. This library has data flow sinks for the phone number. Android's checkCallingOrSelfPermission() method is evaluated before accessing the IMSI. I Total Unique Apps 561 ∗ L = Location. com/qwapi/adclient/android 74 Plain L. P. Table 5 shows advertisement and analytics library use. 6 of the 13 libraries accessing sensitive information are obfuscated.reuters) in which the phone number is passed to FlurryAgent. In July 2010.3.onEvent() as generic data.luny).handmark.statefarm. Several libraries access phone identifier and location APIs. and we identified a code recovery failure for the class implementing that functionality." "StoryClickedFromList. while the other 3 included "P. however. type. This method is called throughout the application. It is unclear which identifier type was used by the application.eWallpapers. respectively. the library included "L". but also report frequency.activity). In total. L com/tapjoy 3 Plain com/inmobi/androidsdk 2 Plain E‡ com/apegroup/ad 1 Plain com/casee/adsdk 1 Plain S com/webtrends/mobile 1 Plain L. Interesting. L. The AdMob library is used most pervasively. defines the WebtrendsIdMethod class specifying four identifier types. However. Other libraries provide similar configuration. S. IMSI. A second application .us [29]. existing in 320 applications (29. IMSI. E com/greystripe/android/sdk 4 Obf. During manual inspection. Given the library purpose.getDeviceId(). In one application (com. but wrapper . 32 apps have 3 libraries. L com/google/ads 206 Plain com/flurry/android 98 Obf.Analytics library reporting frequency is often configurable." and "ImageZoom. This report also indicated that the developer changed his name to "callmejack". we encountered one application (com." Here. S = IMSI. Only one Several inspected applications use developer toolkits containing common sets of utilities identifiable by class name or library path. ‡ Direct API use not decompiled. Finding 18 . and location.2 Developer Toolkits multiple of these libraries.Table 5: Identified Ad and Analytics Library Paths Library Path # Apps Format Obtains∗ com/admob/android/ads 320 Obf. The com/webtrends/mobile library accesses the IMEI. I".mpp.3 Finding 20 . E.news.wallpaper" as sending these identifiers to imnet. and some applications include custom ad and analytics functionality. the applications by "callmejack" remained as of September 2010.
1 Leaking Information to Logs Android provides centralized logging via the Log API.service.LOCATION" intent action string without protection. "pkgname. the IMEI is retrieved and passed to ProductConfiguration.com. Thus.4. In the initialization phase. Finding 22 . Another application (com.Filter: "pkgname.BarReceiver . The Android documentation for this permission indicates that "[the logs] can contain slightly private information about what is happening on the device.. The com/julysystems developer toolkit identified as probing for permissions exists in two applications with reputable application providers.4. We found 253 data flows in 96 applications for location information.Action: "pkgname.Few applications are vulnerable to forging attacks to dynamic broadcast receivers. Inc. Both applications contain an Android activity component named MainActivity. 5. These receivers are indirectly protected by Android's "protected broadcasts" introduced to eliminate forging.intent. 5.g. but should never contain the user's private information.Action: "pkgname.android) provided by "FOX News Network.FooReceiver . 5. The contents of the bundled information varied. Broadcast receivers define "intent filters" to subscribe to specific event types are public. Additional sampling may uncover more cases. We found many cases of applications sending unsafe intents to action strings containing the application's namespace (e. We found one application with an unprotected broadcast receiver for a custom intent type. For example one application (com. Similarly.4 Android-specific Vulnerabilities This section explores Android-specific vulnerabilities. However. and 123 flows in 90 applications for phone identifiers. location). Inc. LLC" contain the com/mercuryintermedia toolkit. The technical report [15] provides specification details. and in some cases. While logcat is a debugging tool. The class attempts to retrieve the phone number within a try/catch block. e.Well-known brands sometimes commission developers that include dangerous functionality.himsn) broadcasts the instant messaging client's status to the "cm.ulocate.. a malicious application can forge messages. we found several such intents used to install shortcuts to the home screen.univision) is provided by "Univision Interactive Media. This is unsafe if the intent contains sensitive information.intent. applications with the READ_LOGS permission can read these log messages. "CBS Sports Pro Football" (com.g.ACTION" for application pkgname). Sampling these applications. We found 271 such unsafe intent broadcasts with "extras" data in 92 applications (8. 5. we also found sensitive information.mz. and hence potentially misuse information.FooReceiver" pkgname.2 Leaking Information via IPC Shown in Figure 5.stS" action string.g.intent. any application can receive intent broadcasts that do not specify the target component or .ACTION" Figure 5: Eavesdropping on unprotected intents protect the broadcast with a permission (permission variant not shown).Component: "pkgname.4.initialize() (part of the com/ mecuryintermedia toolkit).activity) is provided by "CBS Interactive. widget and task identifiers. Both have location and phone state permissions. "USA TODAY" (com.4 Intent Injection Attacks Intent messages are also used to start activity and service components.july. These vulnerabilities allow malicious applications to eavesdrop on sensitive information in IPC." We looked for data flows from phone identifier and location APIs to the Android logging interface and found the following. which can displayed with the "logcat" command. the data was not sensitive. However. In some instances. Frequently. gain access to information that requires a permission (e. Finding 23 . Finding 24 .Filter: "pkgname.Private information is written to Android's general logging interface. however it appears to have limited impact.4. URLs containing this private information are logged just before a network connection is made.". We found an large number of receivers subscribed to system defined intent types. and "Univision F¨ tbol" u (com.Applications broadcast private information in IPC accessible to all applications. catching a generic Exception. If the receiver is not protected by a permission.". the READ_LOGS permission allows access to private information. news) provided by "USA TODAY" and "FOX News" (com. We found 406 unprotected broadcast receivers in 154 applications (14%).. the application does not have the READ_PHONE_STATE permission. Both applications have IMEI to network data flows through this method.intent.ACTION" Application: malicous malicous.cbssports.july.android. Finding 21 . An intent injection attack occurs if the in- 5. indicating the class is likely used in multiple applications.4%).ACTION" Fully Specified Intent Message .(v00032.intent.usatoday.3 Unprotected Broadcast Receivers Applications use broadcast receiver components to receive intent messages.wordplayer) defines the CustomExceptionHander class to send an exception event to an HTTP URL. Application: pkgname Partially Specified Intent Message .ulocate) broadcasts the user's location to the "com.foxnews.ACTION" .
to relay the action string from a broadcast receiver to a service.rent) obtains a URL from a file named connRentInfo. as the application crash is obvious to the user. if the intent address is unspecified. Another application (com. We believe the false positives results from the program analysis modeling of classes extending InputStream. the applications must first start a malicious activity.4. and setComponent() is the sink for 8 applications. Sampling these applications. we found an overwhelming number of pending intents used for either: (1) Android's UI notification service. Investigating the application package files. exploiting these vulnerabilities appears to provides negligible adversarial advantage. These sets are disjoint.Some applications define intent addresses based on IPC input. which is used to create InputStreamReader objects. we found that 17 applications set the target component class explicitly (all except 3 use the setAction() data flow sink).484 dereferences in 481 applications).Applications frequently do not perform null checks on IPC input.4. We found 80 data flows from IPC to an intent address in 37 applications. The data flow sink exists in a class named ProgressBroadcastingFileInputStream.6 Null Checks on IPC Input Android applications frequently process information from intent messages received from other applications. we found that 71 applications contain . A malicious application can exploit this vulnerability by specifying the vulnerable component's name directly and controlling the action string. We classified the data flows by the sink: the Intent constructor is the sink for 13 applications. Finding 27 . we found 95 . We found 746 potential null dereferences in 230 applications within classes defining broadcast receiver components. Therefore.3%). Applications crashes corresponding to these null dereferences have a higher probability of going unnoticed. We also found four false positives due to our assumption that all Intent objects come from IPC (a few exceptions exist). Two additional applications start an activity based on the action string returned as a result from a previously started activity. e. None of these cases allow manipulation by a malicious application. (2) Android's alarm service. Three applications use IPC input strings to specify the package and component names for the setComponent() data flow sink. No decompiled code references this class.4. to exploit this vulnerability.so file either do not call any native methods. . setAction() is the sink for 16 applications. Null dereferences in activity components have minimal impact.so files. We found 657 references to the SDcard in 251 applications (22. we observe: Finding 25 .getInputStream(). We found 2. We found two applications that send unsafe pending intents via IPC. However. Finding 26 . Null dereferences cause an application to crash.so files. Most occur in classes for activity components (2. or the code calling the native methods was not decompiled. we found 72 potential null dereferences in 36 applications within classes defining service components. 5.4. the action string used to start a component is copied directly into a new intent object. 5. we found a few unexpected uses. Sampling these applications.7 SDcard Use Any application that has access to read or write data on the SDcard can read or write any other application's data on the SDcard. but it can fill in missing fields. the remote application can redirect an action that is performed with the original application's permissions. or (3) communicating between a UI wid- get and the main application. they have inherent dangers.925 potential null dereferences on IPC input in 591 applications (53. therefore it is unclear what effect a null dereference in a broadcast receiver will have. This indicates two applications with an . We also note that more a more sophisticated analysis framework could be used to eliminate the aforementioned false positives. We could not confirm the data flow and classify it a false positive.mocospace.dat at the root of the SDcard. Finally.android) determines the free space available on the SDcard. 5. In the remaining cases." An application first creates an intent message as if it was performing the action.5 Delegating Control Applications can delegate actions to other applications using a "pending intent.g. For the remaining 16 cases. For example.762 calls to native methods in 69 applications (6. and can thus be used to as a denial of service. Applications commonly use broadcast receivers to start background services.Few applications unsafely delegate actions.8%). We found 300 unsafe pending intent objects in 116 applications (10. The pending intent recipient cannot change values. As these methods are not written in Java. Across these 71 applications. We found 3.tent address is derived from untrusted input. the com/ tapjoy ad library (used by com.8 JNI Use Applications can include functionality in native libraries using the Java Native Interface (JNI).5%). 82 of which have unique names. Similarly. Of the 37 applications.jnj. 5. The remaining potential null dereferences are not easily associated with a component type.. one application uses the IPC "extras" input to specify an action to an Intent constructor. We found 10 data flows from the network to an intent address in 1 application. and all data flow sources are calls to URLConnection. However.7%). It then creates a reference to the intent based on the target component type (restricting how it can be used).
the program analysis tool could not parse 8.net) for applications using its licensing service [23]. our study only characterized one edge of the application space.34% of the classes..3.g.8%) have this obfuscation property. we searched applications containing a. Software written in C is particularly susceptible to programming errors that result in vulnerabilities. Therefore it has limited impact on program analysis. our manual source code inspection sheds more light on how information is misused. and ICC-ID. Additionally.java heuristic is not intended to be a firm characterization of the percentage of obfuscated code. While we found no evidence of telephony misuse. noting that such integration is challenging for both logistical and technical reasons [30]. a portion of the recovered source code was obfuscated before distribution. we stress that the a..appname). address book exfiltration. destruction of SDcard contents. Our findings indicate an overwhelming concern for misuse of privacy sensitive information such as phone identifiers and location information.042 classes. the number of ad and analytics libraries included per application was unexpected. For example. ProGuard protects against readability and does not obfuscate control flow. IMSI.. As discussed in Section 5. Our analysis also identified significant penetration of ad and analytic libraries. While this might not be surprising for free applications. background recording of audio or video. producing single letter Java filenames (e. and c) source code recovery failures interrupt data and control flows. phone number..java. we searched for a. Enck et al. one having to do with the study apparatus. In total. com/foo/appname for com. Java applications are inherently safer than C applications and avoid simple vulnerabilities such as buffer overflows. and field names are converted to single letters. However. In addition to the recovery failures. e. To obtain a closer estimate of the number of applications whose main code is obfuscated. We leave such discussions for future work. reducing coverage to 91. Code obfuscation significantly impedes manual inspection. It likely exists to protect intellectual property. It is unclear why an application needs more than one advertisement and one analytics library. one might argue that such malicious functionality is less likely to occur in popular applications.g.java within a file path equivalent to the package name (e. [14]). as well as occasionally broadcast to unprotected IPC. a. or abusive network connections. sensitive information is frequently written to Android's centralized logs. ded and the program analysis specifications are enabling technologies that open a new door for application certification. 7 What This All Means Identifying a singular take-away from a broad study such as this is non-obvious. but rather a means of acquiring insight. occurring in 51% of the studied applications. We found phone identifiers. method. however. Ashcraft and Engler [7] use compiler extensions to identify errors in range checks.sf. b) the program analysis tool cannot compute data and control flows for IPC between components.foo. IMEI.100 applications contain this file. Arguably more important than identifying the existence the information misuse. Only 20 applications (1. no cases were readily exploitable. were used for everything from "cookie-esque" tracking to account numbers. We come away from the study with two central thoughts. We also identified the potential for IPC injection attacks. class. In addition to further studies of this kind. and phishing [20]. which is expected for free applications (as opposed to paid applications). Missing data and control flows may lead to false negatives. and the other regarding the applications. finding that . Finally. One might speculate this occur due to the difficulty in assigning malicious intent.100 free popular applications to be consistent with smaller studies (e.g. One application included as many as eight different libraries. JNI execution [34]. 396 of the 1. We focused our study on popular applications to characterize those most frequently used. Ware and Fox [46] compare eight different open source and commercially available Java source code analysis tools. However. On a technical level. even these samples may miss the existence of truly malicious applications.. Many forms of obfuscated code are easily recognizable: e. we see the potential to integrate these tools into an application certification process. we found that many developers fail to take necessary security precautions. 8 Related Work Many tools and techniques have been designed to identify security concerns in software. Future studies should take samples that span application popularity.6 Study Limitations Our study section was limited in three ways: a) the studied applications were selected with a bias towards popularity. Google suggests obfuscation using ProGuard (proguard.g. We found the approach rather effective despite existing limitations. including installing new applications [43]. MOPS [11] uses model checking to scale to large amounts of source code [42].g.java). Our findings also support the existence of databases external to cellular providers that link identifiers such as the IMEI to personally identifiable information. several advertisement and analytics libraries are obfuscated. Future studies should also consider several additional attacks. we found the security characteristics of the top 1. For a rough estimate on the use of obfuscation. From a vulnerability perspective.
com/ ~eric/software/mocha/. P.reversed-java. H.. //www. However. com/files/iSEC_Securing_Android_Apps. W. our analysis framework allows us to observe not only the existence of dangerous functionality. E.uk/2/hi/technology/ 8373739. Egele et al. Our future work will consider these challenges. whereas our study analyzes source code. [11] C HEN . E. we thank Kevin Butler. AND E NGLER . By using static analysis.. [2] Fortify 360 Source Code Analyzer (SCA).admob. However. P. A. Google i/o 2008 . C. In the Web server environment. [26] consider behavioral properties of BHOs and toolbars. the integration of these technologies into an application certification process requires overcoming logistical and techni- . October 2008. and the SIIS lab for their editorial comments during the writing of this paper.youtube. AdMob Android SDK: Installation Instructions. Finally. 30). Accessed November 2010. PiOS: Detecting Privacy Leaks in iOS Applications. Privacy Oracle [24] uses differential black box fuzz testing to find privacy leaks in applications. http://www.pdf.-G. While our findings of exposure of phone identifiers and location are consistent with previous studies. G. Stephen McLaughlin.. [7] A SHCRAFT. http://www. Acknowledgments We would like to thank Fortify Software Inc. In Proceedings of the USENIX Symposium on Operating Systems Design and Implementation (2010). and phishing. K. J. we foresee ded and our analysis specifications as enabling technologies that will open new doors for application certification. for providing us with a complementary copy of Fortify SCA to perform the study.dalvik virtual machine internals. [13] E GELE . Felmetsger et al. D. Y IN . New iPhone worm can act like botnet say experts. fine-grained taint tracking. References [1] Fernflower . Patrick Traynor. B. In Proceedings of the IEEE Symposium on Security and Privacy (2002). http://www.com/products/fortify360/ source-code-analyzer. Dynamic Spyware Analysis.com/jad.. [10] B URNS . [12] E GELE . [5] Mocha. CNS-0905447. and command injection. 233–246.fr/. N. On smartphones. [14] E NCK . M C DANIEL . Moving forward. Developing Secure Mobile Applications for Android.isecpartners.pdf. While analysis included non-security bugs. AND WAGNER ..html. iSEC Partners. the results motivate a strong need for automated analysis by all developers.. inputs are easily controlled by an adversary. [13] target information leaks by browser-based spyware explicitly using dynamic taint analysis. while our static analysis only confirms the potential for it. Using Programmer-Written Compiler Extensions to Catch Security Holes. cross-site scripting. In Proceedings of the USENIX Annual Technical Conference (June 2007).decompiler. J UNG .. com/fernflower/. Spyware and privacy breaching software have also been studied.. findings. and conclusions or recommendations expressed in this material are those of the author(s) and do not necessarily reflect the views of the National Science Foundation. they advance vulnerability analysis by providing automatic detection of application-specific logic errors. Finally.. C OX .com/docs/AdMob_Android_SDK_ Instructions..fortify. http://www.no one tool detects all vulnerabilities. we described the ded decompiler for Android applications and used decompiled source code to perform a breadth study of both dangerous functionality and vulnerabilities. [6] A D M OB. TaintDroid: An Information-Flow Tracking System for Realtime Privacy Monitoring on Smartphones. we were able to study a far greater number of applications (1. [19] also study Java-based web applications.bbc.html.brouhaha.free. Model Checking One Million Lines of C Code. [3] Jad. [8] BBC N EWS..stm. C. K IRDA . http://www. D EAN . but focuses on permissions and other application configuration data. malicious JNI. but also how it occurs within the context of the application. http://www. 2004).. and CNS-0643907. L.. Kirda et al. TaintDroid's analysis confirms the exfiltration of information. K IRDA . Any opinions. M. In Proceedings of the 11th Annual Network and Distributed System Security Symposium (Feb. TaintDroid [14] uses system-wide dynamic taint tracking to identify privacy leaks in Android applications. AND S HETH . the java decompiler. pp.com/watch?v=ptjedOZEXPM.. Livshits and Lam [28] focus on Java-based Web applications. and broaden our analysis to new areas. K RUEGEL . K RUEGEL . D.co. In this paper. This material is based upon work supported by the National Science Foundation Grant No. https: 9 Conclusions Smartphones are rapidly becoming a dominant computing platform. H. M. D. Panaorama [47] considers privacy-breaching malware in general using wholesystem. AND V IGNA . cal challenges. P. and left unchecked can lead to SQL injection. D. November 23. 2009..100 vs. [9] B ORNSTEIN . J. The PiOS study found the majority of analyzed applications to leak the device ID and over half of the applications include advertisement and analytics libraries.. D. C HUN . CNS0721579. AND S ONG . Hovemeyer and Pugh [22] study six popular Java applications and libraries using FindBugs extended with additional checks. path traversal. We also thank Suneel Sundar and Joy Marie Forsythe at Fortify for helping us debug custom rules. HTTP response splitting.kpdus. PiOS [12] performs static analysis on iOS applications for the iPhone. including application installation.java decompiler. Low barriers of entry for application developers increases the security risk for end users. http://java. http://news. G ILBERT. Kirin [16] also uses static analysis. In Proceedings of the Network and Distributed System Security Symposium (2011). [4] Jd java decompiler.
uk/2009/11/06/iphone_ games_storm8_lawsuit/. http://android-developers.. [20] F IRST T ECH C REDIT U NION. M. USA. P. R. H. In Proceedings of SummerCon (June 2010). Optimizing java bytecode using the soot framework: Is it feasible? In International Conference on Compiler Construction. AND K EM MERER . M. In Proceedings of the USENIX Conference on Object-Oriented Technologies and Systems (1997). E. M. In Proceedings of the Eighth Working Conference on Reverse Engineering (2001). the primitive type would be dependent on the path taken at run time. [33] M ILNER . 2010. Zombies and Angry Birds attack: mobile phone malware. [44] T IURYN ... Model Checking an Entire Linux Distribution for Security Violations. 2009. B. AND M C DANIEL . P. K. Z HANG . http://blog.[15] E NCK .. [42] S CHWARZ . Z HOU . http://www. W. The Register.. 2009).. I NTWALA . Dec. R. In Proceedings of the 14th USENIX Security Symposium (2005). E NCK . G. University Park. G. Computerworld (August 2010). AND S UNDARESAN . S. Department of Computer Science and Engineering.com/ home/security/fraud/security_fraud.. S HETH . Dec.. V. E. Languages. D... Tech.. P.. [37] O NGTANG . W. IEEE Security & Privacy Magazine 7. P OM INVILLE . Computerworld (November 2010). A. D.com/2010/ 08/best-practices-for-handling-android. these dangerous applications are now nonfunctional. Toward Automated Detection of Logic Vulnerabilities in Web Applications. 2006).firsttechcu. [36] O NGTANG . Android Hax. January 2011. M. [27] K RALEVICH . AND Y EGNESWARAN .. First SMS Trojan detected for smartphones running Android. WAGNER . 2010.. Semantically Rich Application-Centric Security in Android. PA. AND M C DANIEL . BANKS . Sept. [22] H OVEMEYER . B. [21] G OODIN . J. T. Not So Great Expectations: Why Application Markets Haven't Failed Security. [17] E NCK . In Proceedings of the Workshop on Static Analysis (SAW) (2008). D. Finding Security Vulnerabilities in Java Applications with Static Analysis. In Proceedings of the ACM conference on Computer and Communications Security (2007). C. E. Decompiling java using staged encapsulation. N. K RUEGEL . X.COM.blogspot. AND V IGNA . [30] M C DANIEL .. J. rep. P. In Proceedings of the Annual Computer Security Applications Conference (2005).. SPAM-AND-ABUSE. O NGTANG . [28] L IVSHITS . [43] S TORM .. Security Fraud: Rogue Android Smartphone app created..com/2010/ 09/securing-android-lvl-applications. J. and Applications (2004).. S. L AM . The ded Decompiler... AND M C DANIEL .sri. In Proceedings of the Network and Distributed System Security Symposium (2011).. AND F OX .. E GELE . Porscha: Policy Oriented Secure Content Handling in Android. [39] P ROEBSTING . Finding Bugs is Easy. SRI International. Panorama: Capturing System-wide Information Flow for Malware Detection and Analysis. L. [16] E NCK . [34] O BERHEIDE . M. AND WANG . W. In Proceedings of the Annual Computer Security Applications Conference (2009). [25] K ASPERSKEY L AB. IEEE Security & Privacy Magazine 8. [19] F ELMETSGER . 18–34.co.. 1 (January/February 2009).us NS entry is NS1. Google: Android wallpaper apps were not security threats. Understanding Android Security. G AGNON . R.com/ 2010/07/mobile-application-analysis-blackhat/. A theory of type polymorphism in programming... August 2010.. J. AND H ENDREN . S.f-secure.. In Proceedings of the 11th International Conference on Compiler Construction (2002). G REENSTEIN . 2 Note that it is sufficient to find any type-exposing instruction for a register assignment. November 2009. X. A. In Proceedings of the 16th ACM Conference on Computer and Communications Security (CCS) (Nov.theregister. M.. [47] Y IN . W ETHERALL . M. S. P.com/v-descs/trojan_symbos_ viver_a. PA. An Analysis of the Ikee. AND T U . [45] VALLEE -R AI . [26] K IRDA . C. AND K IRDA . Backdoor in top iphone games stole user data. W. W.. Network and Security Research Center. V.. a clear violation of Java's type system. T. Notes 1 The undx and dex2jar tools attempt to decompile .A. G. J. W. AND H ENDREN . Decompiling java bytecode: Problems. On Lightweight Mobile Phone Application Certification. traps and pitfalls. M AGANIS . G. Best Practices for Handling Android User Data. H ENDREN . H. [23] J OHNS . Pennsylvania State University. C HEN . Rep. Tech. J.. W. [29] L OOKOUT.blogspot. Any code that could result in different types for the same register would be illegal. P.. 5 (September/October 2010). S ONG . In Proceedings of the 15th USENIX Security Symposium (Aug. 3 Fortunately. Network and Security Research Center. Rep.html. P. In Proceedings of the Mathematical Foundations of Computer Science (1990). 50–57. AND P UGH .. AND C HAUDHURI . E NCK . M C DANIEL .. A. C AVEDON . O NGTANG .com/news?id= 207576158.SUSPENDED-FOR. but were non-functional at the time of this writing. as the imnet. W EST. If this were to occur. C. R.. P..... D. NAS-TR-0140-2010. [35] O CTEAU . V. A. A.. D. [38] P ORRAS . In Proc. AND M C DANIEL . O CTEAU .B (Duh) iPhone Botnet. M. pp. T. P.. 2009... In Proceedings of the ACM conference on Object-Oriented Programming Systems. Krakatoa: Decompilation in java (does bytecode reveal source?). [32] M IECZNIKOWSKI . L IN . V IGNA .kaspersky. AND L AM .. V.. K APA DIA . [46] WARE . of the Annual Computer Security Applications Conference (2010). In Proceedings of the USENIX Security Symposium (2010). L. LNCS 1781 (2000)... Securing Android LVL Applications. http://www.html. B. USA.. C. Soundcomber: A Stealthy and ContextAware Sound Trojan for Smartphones. In Proceedings of the ACM conference on Computer and Communications Security (2008). suit claims. [41] S CHLEGEL . 2010. J.. S.. A Study of Android Application Security. H. B UTLER .html. AND WATTERSON . J. J. http://www. July 2010.mylookout. AND KOHNO . Type inference problems: A survey. AND M C DANIEL . http://mtc.shtml. . [24] J UNG . [40] R APHEL . P.. L. K RUEGEL . NASTR-0144-2011.. W. S AIDI .com/iPhone/. Behavior-based Spyware Detection. Journal of Computer and System Sciences 17 (August 1978).. D. University Park. Tech. http://android-developers. [18] F-S ECURE C ORPORATION.. K. K RUEGEL . Update and Clarification of Analysis of Mobile Applications at Blackhat 2010. M C L AUGHLIN . D. Privacy Oracle: A System for Finding Application Leaks with Black Box Differential Testing. M ORRISON . J. http://www..dex files. Securing Java Code: Heuristics and an Evaluation of Static Analysis Tools. Department of Computer Science and Engineering. Virus Description: Viver. AND E NCK . L. G. D. Pennsylvania State University. 76–78. [31] M IECZNIKOWSKI .
This action might not be possible to undo. Are you sure you want to continue?
We've moved you to where you read on your other device.
Get the full title to continue listening from where you left off, or restart the preview.


text:
Top Definition
A song that is a combination rap or hip hop with Japanese pop. Seen primarily in recent Japanese video games.
The game "Persona 3" has a soundtrack composed primarily of jap rap.
delijoe tarafından 4 Ocak 2008, Cuma
Trending Now
Emailler, email@example.com adresinden gönderilir. Asla spam mail göndermeyiz.×

subset: commoncrawl


text:
Crazy Substitute Teachers
Enjoy, NG4.05 / 5.00 1,609 Views
Vacuum Salesman
This dude and his Megazord vacuum cleaner3.99 / 5.00 2,456 Views
Markiplier Animated | Mark Of The Survey Corps
This took far too long to make...3.90 / 5.00 4,174 Views
That was kickass! (and a little disgusting, i mean, surely the dog didn't need to go _that_ badly, right?) loving the concept, and the style of the retarded dog. it was _soooo_ cute!
newayz, good work man. keep it up.
Great job
dude nice work this was classical!!!I expect this 2 be on the front page soon.BR@D("_) vote 5 every 1!!!!


text:
>> Watch this new [OFFICIAL MUSIC VIDEO] from Das Racist for "Girl."
>> Hey, look, everybody! It's beloved R.E.M. guitarist Peter Buck at City Winery in NYC!
>> Green Day cancel all upcoming shows.
>> Find yourself watching Lianne La Havas doing "Is Your Love Big Enough?" at WFUV's studios in New York City. on the internet.
>> A letter from Aerosmith.
>> Hear an odd new Jack White song called "Blues On Two Trees."
>> Apparently Kendrick Lamar is not saying "BIATCH!!! COLDPLAY!!!" (More like Buzzkill.) #amirite
>> Lulu, son of Serge, talks From Gainsbourg to Lulu.
>> Get to know amazing Jackson, Tennessee blueslady Valerie June.
>> U deserve to watch this OFFICIAL video for "U Don't Deserve Dat," from Trouble (feat. Gucci Mane, Rocko & Travis Porter).
>> Rap lyric decoder site Rap Genius has secured a 15 million dollar investment.
>> Hey, look, everybody! It's Rick Rubin buying some fruit In Malibu!
3 people apparently love handing over an extra 40% in fees for nothing in return…
Dang. I thought they would name some actual headliners.
Forgot to mention that Iggy did a stellar show @ the Agora in the spring…
Their fees were onerous, to say the least. $16 per ticket for "convenience," and it's…
That poster is for the Iggy Pop show on March 11 1983 @ 688 club…
oh sweet: just who i was waiting to get announced!


text:
Wednesday, November 27, 2013
More than a year ago, I stood in a long line to see "The Hunger Games" on opening night. This past weekend, I was surprised to be one of very few people arriving early to see "Catching Fire," the next installment of the series written by Suzanne Collins.
Let me just say this series is not the next "Twilight" series, as Hollywood or your children may have you believe. And it's not just for your teenagers.
When I went to the first movie, I believed I was taking my then-10-year-old girl to see the next teen love story. I left thinking it was the most intense satire on American government, culture and media I had ever seen.
"Catching Fire" emphasized that.
The first two movies spare no expense painting the political — or ruling — class of the "Capitol" as gaudy gluttons taking everything from the working class.
Capitol residents wear outlandish clothing and clownish makeup. They take everything for granted, while ignoring the difficulties of those living in poor, rural areas.
In a "Catching Fire" scene, one of the heroes is encouraged to, shall we say, "toss his cookies," just so he could taste more treats. That's something he just can't stomach, knowing people in his home "district" are starving and barely getting by.
Conversely, district residents have little food and virtually no modern conveniences. Everything they do is done to benefit the government and ruling class.
The satire is intensified by the depiction of the televised media as loud and opinionated and whose job it is to sell the games as a competition to distract district residents from the hardships of their poverty-stricken lives.
That doesn't sound so far-fetched from some things we see going on today in our nation's capitol, does it?
Looking at Washington, D.C., it's not difficult to find examples of lifestyles and society reflected by "The Hunger Games" series. It's not that hard to see some of the same excesses in Olympia, either.
Want to see the poverty reflected in the movie? How about taking note of areas right here in Okanogan and Ferry counties where people live without electricity, still have outhouses and lack the connectivity of the modern world.
And what about the media?
Can you say reality TV? That's basically the movie's version of what is being pushed on the American public today.
If you see some of the same satire I did, maybe the movies will prompt you to help reshape where our nation is headed.
While I caught flack for taking my daughter to the first movie, I hope she learned something and doesn't just see "The Hunger Games" as the next teen love story.
Roger Harnack is the editor and publisher of The Chronicle. He can be reached at 509-826-1110 or via email at firstname.lastname@example.com.
More like this story
Latest stories
- Gubernatorial candidate debate planned tomorrow
- Lightning sparks several small fires
- Results for the Tonasket Truck and Tractor Pull announced
- 820 (2016-322 July 20, 27) STATE OF WASHINGTON DEPARTMENT OF ECOLOGY
- 820 (2016-310 July 13, 20, 27) SUPERIOR COURT, STATE OF WASHINGTON, COUNTY OF SPOKANE
- 320 (2016-317 July 27, Aug. 3) OMAK SCHOOL DISTRICT SURPLUS SALE
- 820 (2016-320 July 27) LEGAL NOTICE
- 820 (2016-323 July 20, 27, Aug. 3) SUPERIOR COURT OF WASHINGTON FOR OKANOGAN COUNTY
- 820 (2016-328 July 20, 27, Aug. 3) IN THE SUPERIOR COURT OF THE STATE OF WASHINGTON IN AND
- 820 (2016-330 July 27, Aug. 3, 10) SUPERIOR COURT OF THE STATE OF WASHINGTON IN AND FOR
Latest video:
2016 Molson Mid-Summer Festival
Here's a clip of the annual Molson Mid-Summer Festival, June 18, 2016. Chronicle video by Brock Hires. Enlarge


text:
Keegan Sauder News
News on Keegan Sauder continually updated from thousands of sources around the net.
Skateboarder Magazine "The Killing Season" Video
Aug 20, 2012 | Hypebeast.com | Comment?
Keegan Sauder news is powered by NewsRank™
Trending Now
Updated: Mon Aug 20, 2012 04:35 pm
Copyright © 2016 Topix LLC


text:
The Big Business Behind America's Love for Hot Dogs
July 2 (Bloomberg) -- Janet Riley, president of National Hot Dog & Sausage Council, discusses the hot dog industry as the 2012 drought impacts prices and the expanded choices available to consumers as the July 4th holiday approaches. She speaks on Bloomberg Television's "Bloomberg Surveillance."
Most Recent Videos
When Can We Say Yes, Inflation Is Here?
36:50 - Citigroup Global Head of G-10 FX Strategy Steven Englander discusses the risk of inflation and Fed monetary policy. He speaks on "Bloomberg ‹GO›." (Source: Bloomberg)


text:
Golf Christmas Ornaments
Hit a hole in one for the special golf player in your life when you give them a unique golf ornament for their Christmas tree. Each golf ornament can be personalized for the expert golfer it's meant for, and we have a variety of both male and female golfer ornaments.
- Archery
- Badminton
- Ballet
- Baseball MLB Teams
- Baseball/Softball
- Basketball
- Basketball NBA Teams
- Biking
- Billiards
- Boating
- Bowling
- Boxing
- Bungee Jumping
- Camping
- Cheerleader/Pompons
- Coaching
- Color Guard
- Curling
- Equestrian
- Exercise/Fitness
- Field Hockey
- Fishing
- Football
- Football NFL Teams
- Golf
- Gymnastics
- Hiking
- Hockey
- Hockey NHL Teams
- Hunting
- Karate
- Kayaking
- Lacrosse
- Motocross
- NASCAR and Indy 500 Racing
- Rock Climbing
- Running and Track
- Scuba
- Skateboarding
- Skating
- Skydiving
- Snorkeling
- Snow Skiing
- Snowboarding
- Snowmobilers
- Soccer
- Swimming
- Tennis
- Volleyball
- Water Skiing
- Water Sports
- Weightlifting
- Wrestling
- Ziplining
- View All
- ‹ Previous
- Page
- 1
- Next ›
- 18th Hole Price: $13.95
- Ethnic Golfer Female Price: $13.95
- Ethnic Golfer Male Price: $13.95
- Golf Price: $17.95
- Golf Bag with 18th Hole Flag Price: $14.95
- Golf Green Price: $13.95
- Golf Shoe Price: $12.99
- Golfer Female Price: $13.95
- Male Golfer with Golf Bag Price: $13.95
- View All
- ‹ Previous
- Page
- 1
- Next ›
Read what our customers say about our Personalized Christmas Ornaments and their shopping experience!Hover over testimonials to stop scrolling
11/18/2015 - "The ornaments are simply beautiful. Sandra K."
11/29/2015 - "The website is functional and I LOVE how many categories there are. This is the ONLY place I could find that would put my dogs and cats on the same ornament. I did not want to buy multiples for the animals, so I was very happy to find the one i bought from ornamentshop. Bryce M."
11/19/2015 - "Loved shopping here! Viktoriya V."
12/6/2015 - "Last year I was very pleased with my personalized ornaments, so I am back again. Maureen S."
9/11/2015 - "Ornament Shop is part of my family tradition. I always order Christmas ornaments in time to gift the Grandkids when they come to my house for Thanksgiving. That way when they return home to put up their family tree they have their new ornament. I always select an ornament for each child that represents something new they did the past year. I have been shopping with y'all for about 10 years and my Grandkids look forward to this each year. Oh did I forget to say, I LOVE ORNAMENT SHOP! Your quality and service is exceptional. Joyce S."
11/27/2015 - "Every year I buy a special ornament for my kids and grandchildren. Everyone just loves them! Karen W."
12/10/2015 - "I especially appreciate the free personalizing. The time of order receiving is wonderful; no wondering where the order is. Thank you. Ruth F."
9/22/2015 - "I received my order today and am very, very pleased with each ornament. The ornaments are perfect, high quality, and beautiful. I will definitely be a return customer. Thank you!! Kathy G."
7/18/2016 - "I love the product. It is so personal and my daughter will love it! Suzmarie S."
5/14/2016 - "OrnamentShop.com offered a particular product that I really wanted, and others did not carry. Shirley S."


text:
Is there any functionality in Eclipse (similar to Visual Studio), to automatically tag the JAR's with increasing version?
I googled for this first, but didn't find any specific answer.
We started with Q&A. Technical documentation is next, and we need your help.
Whether you're a beginner or an experienced developer, you can contribute.


text:
jobs near Stamford, CT
Refine your searchClear Filters
Date Added
More Filters
Inside Sales Executive - Online Advertising (Entry Level)
Indeed - Stamford, CT
Develop relationships through phone, email, social media and professional networking. Sales Executives at Indeed are on the front lines of helping organizations...
Accounts Payable Specialist
Indeed - Stamford, CT
Our Finance team ensures that Indeed complies with the highest standards of business, law and ethics, while providing Indeed's clients with excellent customer...
Truck Driver / Owner Operator
Western Express - Stamford, CT
Join one of the TOP TRUCKING COMPANIES in the industry and JUMPSTART your truck driving career! At Western Express, you can use our INSURANCE AND AUTHORITY or...
Restaurant Manager - CT - Westport
Panera Bread - Westport, CT
We continually invest in and develop our cafe teams and tools to help execute flawless service and allow more time for interacting with our customers....
IT Executive Assistant (L07)
Synchrony Financial - Stamford, CT
Provide all administrative support including calendar management, telephone coverage, coordinating travel and hotel accommodationsExtensive travel bookings &...
Inside Sales Executive - Online Advertising
Indeed - Stamford, CT
Develop relationships through phone, email, social media and professional networking. Sales Executives at Indeed are on the front lines of helping organizations...
Benefits Specialist (Americas)
Indeed - Stamford, CT
Review documentation and eligibility status to determine whether an employee is eligible for benefits. Research, recommend and implement benefit schemes...
Custom Cabinet Sales Designer
DEANE Inc - Stamford, CT
Proven sales record and kitchen design experience preferred. Design and sell custom cabinetry to high-end residential homes....
School Bus and Coach Mechanic/Tech
County Coach Corp. - Rye, NY
Must have clean CDL BPS and have own tools. DOT knowledge a plus. Opening available for experienced school bus and coach mechanic/tech....
Parts Advisor
Bruce Bennett Nissan - Wilton, CT
The right candidate must be able to multi-task by servicing technicians, working the retail counter and taking phone orders while maintaining a courteous and...