  The number of Android smartphone and tablet users has experienced a rapid
growth in the past few years and it raises users' awareness on the privacy and
security of their mobile devices. The features of openness and extensibility
make Android unique, attractive and competitive but meanwhile vulnerable to
malicious attack. There are lots of users rooting their Android devices for
some useful functions, which are not originally provided to developers and
users, such as backup and taking screenshot. However, after observing the
danger of rooting devices, the developers begin to look for other non-root
alternatives to implement those functions. ADB workaround is one of the best
known non-root alternatives to help app gain higher privilege on Android. It
used to be considered as a secure practice until some cases of ADB privilege
leakage have been found. In this project, we design an approach and implement a
couple of tools to detect the privilege leakage in Android apps. We apply them
to analyse three real-world apps with millions of users, and successfully
identify three ADB privilege leaks from them. Moreover, we also conduct an
exploitation of the ADB privilege in one app, and therefore we prove the
existence of vulnerabilities in ADB workaround. Based on out study, we propose
some suggestion to help developers create their apps that could not only
satisfy users' needs but also protect users' privacy from similar attacks in
future.
