  The scheme of application (app) distribution systems involving incentivized
third-party app vendors is a desirable option for the emerging edge computing
systems. However, such a scheme also brings various security challenges as
faced by the current mobile app distribution systems. In this paper, we study a
threat named covert device association, in which the vendors of two apps
collude to figure out which of their app installations run on the same edge
device. If the two colluding apps are popular, the threat can be used to launch
various types of further attacks at scale. For example, the user of the
compromised edge device, who wishes to remain anonymous to one of the two apps,
will be de-anonymized if the user is not anonymous to the other app. Moreover,
the coalition of the two apps will have an escalated privilege set that is the
union of their individual privilege sets. In this paper, we implement the
threat by a reliable and ubiquitous covert channel based on the edge device
processor workload. The implementations on three edge devices (two smartphones
and an embedded compute board) running Android and Android Things do not
require any privileged permissions. Our implementations cover three attack
scenarios of 1) two apps running on the same Android phone, 2) an app and a web
session in the Tor browser running on the same Android phone, and 3) two apps
running on the same Android Things device. Experiments show that the covert
channel gives at least 0.25 bps data rate and the covert device association
takes at most 3.2 minutes.
