  As the Internet of Things (IoT) continues to evolve, smartphones have become
essential components of IoT systems. However, with the increasing amount of
personal information stored on smartphones, user privacy is at risk of being
compromised by malicious attackers. Although malware detection engines are
commonly installed on smartphones against these attacks, attacks that can evade
these defenses may still emerge. In this paper, we analyze the return values of
system calls on Android smartphones and find two never-disclosed vulnerable
return values that can leak fine-grained user behaviors. Based on this
observation, we present EavesDroid, an application-embedded side-channel attack
on Android smartphones that allows unprivileged attackers to accurately
identify fine-grained user behaviors (e.g., viewing messages and playing
videos) via on-screen operations. Our attack relies on the correlation between
user behaviors and the return values associated with hardware and system
resources. While this attack is challenging since these return values are
susceptible to fluctuation and misalignment caused by many factors, we show
that attackers can eavesdrop on fine-grained user behaviors using a CNN-GRU
classification model that adopts min-max normalization and multiple return
value fusion. Our experiments on different models and versions of Android
smartphones demonstrate that EavesDroid can achieve 98% and 86% inference
accuracy for 17 classes of user behaviors in the test set and real-world
settings, highlighting the risk of our attack on user privacy. Finally, we
recommend effective malware detection, carefully designed obfuscation methods,
or restrictions on reading vulnerable return values to mitigate this attack.
