  As privacy features in Android operating system improve, privacy-invasive
apps may gradually shift their focus to non-standard and covert channels for
leaking private user/device information. Such leaks also remain largely
undetected by state-of-the-art privacy analysis tools, which are very effective
in uncovering privacy exposures via regular HTTP and HTTPS channels. In this
study, we design and implement, ThirdEye, to significantly extend the
visibility of current privacy analysis tools, in terms of the exposures that
happen across various non-standard and covert channels, i.e., via any protocol
over TCP/UDP (beyond HTTP/S), and using multi-layer custom encryption over
HTTP/S and non-HTTP protocols. Besides network exposures, we also consider
covert channels via storage media that also leverage custom encryption layers.
Using ThirdEye, we analyzed 12,598 top-apps in various categories from
Androidrank, and found that 2887/12,598 (22.92%) apps used custom
encryption/decryption for network transmission and storing content in shared
device storage, and 2465/2887 (85.38%) of those apps sent device information
(e.g., advertising ID, list of installed apps) over the network that can
fingerprint users. Besides, 299 apps transmitted insecure encrypted content
over HTTP/non-HTTP protocols; 22 apps that used authentication tokens over
HTTPS, happen to expose them over insecure (albeit custom encrypted)
HTTP/non-HTTP channels. We found non-standard and covert channels with multiple
levels of obfuscation (e.g., encrypted data over HTTPS, encryption at nested
levels), and the use of vulnerable keys and cryptographic algorithms. Our
findings can provide valuable insights into the evolving field of non-standard
and covert channels, and help spur new countermeasures against such privacy
leakage and security issues.
