TELK
OMNIKA
T
elecommunication,
Computing,
Electr
onics
and
Contr
ol
V
ol.
18,
No.
1,
February
2020,
pp.
485
499
ISSN:
1693-6930,
accredited
First
Grade
by
K
emenristekdikti,
No:
21/E/KPT/2018
DOI:
10.12928/TELK
OMNIKA.v18i1.13288
r
485
A
sur
v
ey
on
andr
oid
security:
de
v
elopment
and
deployment
hindrance
and
best
practices
Ratul
Sikder
1
,
Md
Shohel
Khan
2
,
Md
Shohrab
Hossain
3
,
W
azir
Zada
Khan
4
1,2,3
Department
of
CSE,
B
UET
,
Dhaka,
Bangladesh
4
Department
of
CS
and
IT
,
Jazan
Uni
v
ersity
,
Jazan,
Saudi
Arabia
Article
Inf
o
Article
history:
Recei
v
ed
Jun
10,
2019
Re
vised
Dec
21,
2019
Accepted
Dec
31,
2019
K
eyw
ords:
Android
security
De
v
elopers
guideline
System
permission
User
pri
v
ac
y
V
ulnerability
ABSTRA
CT
Android
OS
is
the
most
popular
mobile
OS
for
the
pas
t
fe
w
years.
V
ulnerabilities
arise
with
respect
to
the
increasing
functionality
of
Android
OS,
impolitic
app
de
v
elopment
practices
of
de
v
elopers,
end-user
incautious
and
interestingly
remediation
for
the
vulnerabilities
has
been
introduced
frequently
as
well.
T
o
mitig
ate
security
risk
f
actor
Google
has
been
updated,
deprecated
and
restricted
man
y
system
le
v
el
APIs
for
3
rd
party
de
v
elopers.
C
onsidering
the
consequences,
this
paper
pro
vides
a
wide
o
v
ervie
w
of
Android’
s
system
le
v
el
app
de
v
elopment,
pri
v
ac
y
issues,
and
guideline
for
the
de
v
elopers
about
what
measure
the
y
should
consider
while
de
v
eloping
apps.
W
e
also
discussed
the
historical
de
v
elopment
of
Android
OS
and
the
end-users
role
to
maintain
pri
v
ac
y
and
to
minimize
security
risks.
This
is
an
open
access
article
under
the
CC
BY
-SA
license
.
Corresponding
A
uthor:
Ratul
Sikder
,
Department
of
CSE,
B
UET
,
Dhaka,
Bangladesh.
Email:
ratulsikder121@gmail.com
1.
INTR
ODUCTION
Current
age
is
considered
as
the
age
of
mobility
.
T
o
communicate
in
a
long-distance,
we
don’
t
ha
v
e
to
w
ait
for
days
or
hours;
no
w
we
can
communicate
almost
in
real-time.
The
rapid
and
accelerated
de
v
elopment
in
communication
technology
and
mobile
de
vices
in
recent
years
ha
v
e
made
this
possible.
From
the
early
nineteenth
century
to
date,
the
de
v
elopment
of
mobil
e
de
vi
ces
boo
s
ts
massi
v
ely
[1].
Earlier
,
the
only
use
of
mobile
de
vices
is
to
talk
with
someone
in
a
long
distance
b
ut
today’
s
mobile
phones
specifically
smartphones
are
po
werful
hand-held
computers.
Lik
e
an
y
traditional
computer
,
e
v
ery
smartphone
operates
based
on
its
operating
system.
Android,
iOS,
T
izen,
KaiOS
are
the
major
of
this
kind
[2].
T
oday’
s
smart
phone
Operating
System
(OS)
allo
ws
other
softw
are
to
run
on
the
phone
to
pro
vide
di
v
erse
functionalities
to
the
users.
It
enhances
t
he
user
e
xperience
b
ut
security
and
pri
v
ac
y
is
the
main
concern
by
allo
wing
3
rd
party
apps
on
users’
pri
v
ate
de
vi
ce
quirolgico2011v
etting.
Moreo
v
er
,
unfortunately
,
security
and
pri
v
ac
y
are
not
one
of
the
main
tar
gets
of
man
y
smal
l
to
big
3
rd
party
app
de
v
elopers
[3].
As
a
result,
smartphone
OS
de
v
elopers
naturally
don’
t
w
ant
to
allo
w
3
rd
party
apps
to
access
root
le
v
el
and
sensiti
v
e
information.
Being
a
fle
xible
smart
phone
OS
at
the
be
ginning,
Google’
s
Android
is
also
follo
wing
the
restricti
v
e
access
method.
Accessing
system-le
v
el
information,
system
log
and
other
sensiti
v
e
information
are
no
w
being
restricted
continuously
.
On
our
studies,
we
ha
v
e
found
that
de
v
elopment
of
man
y
de
vice
optimization
and
security-related
apps
had
stopped
due
to
permission
depreciation.
J
ournal
homepage:
http://journal.uad.ac.id/inde
x.php/TELK
OMNIKA
Evaluation Warning : The document was created with Spire.PDF for Python.
486
r
ISSN:
1693-6930
On
the
other
hand,
more
problems
arise
with
the
non-guided
practices
by
the
de
v
elopers.
De
v
elopers
often
don’
t
find
the
necessi
ty
of
follo
wing
the
rules
and
recommendations
for
de
v
eloping
apps
on
the
mobile
platform,
and
it
is
v
ery
hard
to
monitor
and
mine
the
source
code
and
app
beha
vior
to
detect
unwise
programming
and
harmful
acti
vities
of
the
apps.
Though
the
de
v
elopers,
engineers
and
some
machine
learning
based
technologies
are
al
w
ays
trying
to
find
harmful
apps
on
Google
Play
Store
[4,
5].
There
are
a
fe
w
research
w
orks
on
Android’
s
security
i
ssues
in
the
app
de
v
elopment
and
adaptation
phase.
Jha
et
al.
[6]
studied
on
13,483
real-w
orld
Android
applications
and
found
only
2,373
apps
with
no
configuration
errors;
this
is
a
de
v
elopment
phase
scenario.
These
security
issues
become
more
se
v
ere
when
studies
found
that
security
and
pri
v
ac
y
are
not
the
primary
tasks
of
the
de
v
elopers
[3].
Security
and
pri
v
ac
y
are
shared
responsibilities
of
both
the
app
service
pro
viders
and
the
end
users.
Usage-pattern
and
misuse:
both
intentionally
and
unintentionally
m
ay
raise
the
probability
of
security
threats
to
the
end
users.
Google’
s
Android
help
and
support
center
pro
vide
some
simple
guidelines
for
the
Android
de
vice
users
for
helping
the
de
vice
and
information
safe
and
secure
[7].
A
detailed
surv
e
y
on
application
and
android
ecosystem
found
some
impro
v
ements
o
v
er
the
traditional
softw
are
systems
[8].
But
while
impro
ving
some
aspects
of
the
ecosystem,
it
has
also
introduced
a
ne
w
range
of
problems.
Moreo
v
er
,
a
detailed
analysis
of
Android
and
iOS
sho
wed
that
”Pri
v
ac
y
by
design”
is
better
for
mobile
platform
[9].
This
ultimate
po
we
r
of
platform
should
be
enforced
by
the
authorities
to
define
and
strictly
re
gulate
the
pri
v
ac
y
boundaries.
There
e
xists
no
such
surv
e
y
on
these
f
actors
where
the
readers
may
find
the
current
state
of
Android
security
and
pri
v
ac
y
violation,
major
changes
in
Android
from
the
de
v
elopers’
point
of
vie
w
,
restrictions
and
best
practices
for
the
de
v
elopers
as
well
as
the
users.
W
e
ha
v
e
studied
mobile
app
security
related
papers
and
blogs,
pri
v
ac
y
policies,
tested
dif
ferent
3
rd
party
apps,
open
source
projects
and
analyzed
some
of
the
helper
classes
of
Google.
There
are
v
ery
fe
w
resources
on
the
curr
ent
system
le
v
el
Android
de
v
elopment.
The
objecti
v
e
of
this
paper
i
s
to
summarize
our
findings
from
the
mobile
de
v
elopment
history
to
the
present
age,
including
android
de
v
elopment
hindrance
in
dif
ferent
aspects,
security
and
pri
v
ac
y
issues,
guidelines
to
w
ards
safe
de
v
elopment
and
significant
f
acts
about
the
platform
as
well
as
the
whole
ecosystem.
The
contrib
utions
of
this
paper
are
(i)
disc
u
s
s
security
vulnerabilities
and
possible
solutions,
(ii)
de
v
elopment
rest
rictions,
(iii)
recent
changes
and
impro
v
ements,
best
practices
for
both
the
de
v
elopers
and
users
as
well
as
some
suggestions
for
the
manuf
acturers
in
an
or
g
anized
f
ashion
so
that
both
the
Android
de
v
elopers
and
the
users
could
find
it
useful
in
a
simpler
w
ay
.
The
rest
of
the
paper
is
or
g
anized
in
the
follo
wing
sections.
In
section
2,
we
briefly
describe
the
mobile
de
vice
as
well
as
the
smartphone
operating
system
de
v
elopment
history
.
Section
3
characterizes
the
o
v
erall
scenario
of
mobile
app
de
v
elopment,
restrictions,
and
guidelines.
Major
issues
of
system
le
v
el
android
app
de
v
elopment
are
described
in
secti
on
4.
Best
practice
for
the
users
to
a
v
oid
security
and
pri
v
ac
y
threats
and
recommendations
for
the
de
v
elopers
for
safe
and
secure
de
v
elopment
are
e
xplained
in
section
5
This
section
also
includes
t
he
demand
from
the
manuf
acturers
as
the
de
v
elopers’
and
the
users’
point
of
vie
w
about
which
security-related
features
should
be
added
for
the
future
release
of
Android.
Applications
of
our
findings,
discussions
as
well
as
concluding
notes
are
e
xpressed
in
section
6.
2.
MOBILE
OS
DEVELOPMENT
HIST
OR
Y
iOS
is
a
po
werful
mobile
operating
system,
de
v
eloped
by
Apple
Inc.
originally
un
v
eiled
in
2007.
It
is
the
second
most
popular
OS
till
no
w
.
At
that
time,
Google
w
as
still
w
orking
on
Android
secretly;
b
ut
in
No
v
ember
of
that
year
,
the
compan
y
started
to
re
v
eal
its
plans
for
Android
and
its
functionalities.
Finally
,
Android
w
as
released
at
the
end
of
2008.
This
is
the
be
ginning
of
today’
s
Android
re
v
olution
in
the
smartphone
mark
et.
No
w
,
Android
is
the
most
popular
mobile
OS
w
orldwide
[10].
W
e
will
discuss
the
mobile
phone’
s
operating
system
and
the
mobile
phone
de
v
elopment
history
in
the
follo
wing
tw
o
subsections.
(a)
Mobile
de
vices
and
pre-android
de
v
elopment
(b)
Android
OS
de
v
elopment
2.1.
Mobile
de
vices
and
pr
e-andr
oid
de
v
elopment
In
1947,
Bell
laboratory
introduced
the
term
Mobile
Netw
ork.
The
first
automated
mobil
e
phone
system
for
pri
v
ate
v
ehicles
launched
in
Sweden
in
the
year
1956.
The
de
vice
in
the
car
used
v
acuum
tube
technology
and
weighed
approximately
40
kg.
An
engineer
of
the
So
viet
Union
de
v
eloped
and
presented
TELK
OMNIKA
T
elecommun
Comput
El
Control,
V
ol.
18,
No.
1,
February
2020
:
485
–
499
Evaluation Warning : The document was created with Spire.PDF for Python.
TELK
OMNIKA
T
elecommun
Comput
El
Control
r
487
a
number
of
e
xperimental
pock
et-si
zed
communications
radio
in
1957-1961.
The
weight
of
one
model
w
as
only
70
g
and
it
w
as
palm-sized.
The
first
commercial
mobile
phone
w
as
introduced
by
Motorola.
In
1973,
the
y
made
the
first
public
mobile
phone
call
on
a
de
vice
that
weighed
1.1
Kg
[11].
In
the
past
30
years,
there
were
some
major
changes
in
the
mobile
phone
architecture.
Numerous
re
v
olution
had
been
occurring
in
that
era.
Later
in
the
late
’90s,
a
closed-source
mobile
operating
system
called
Symbi
an
has
been
de
v
eloped.
People
in
that
decade
e
xperienced
a
ne
w
form
of
the
mobile
OS
which
w
as
specially
designed
for
multitasking.
On
the
other
hand,
Series
40
w
as
a
softw
are
platform,
w
ork
ed
as
OS,
introduced
by
Nokia
in
1999.
It
w
as
one
of
the
w
orld’
s
most
widely
used
mobile
phone
platforms
b
ut
it
is
not
considered
as
a
smartphone
operating
system
because
of
its
limitations.
In
the
meanwhile,
Symbi
an
w
as
the
most
popular
smartphone
OS
until
the
end
of
2010.
Ob
viously
,
the
mark
et
w
as
slo
wly
captured
by
the
iOS
and
the
Android
from
2007.
T
imel
ine
1
sho
ws
the
historical
de
v
elopment
of
mobile
phones,
mobile
operating
systems
and
finally
the
de
v
elopment
of
Android
OS
till
date.
Google
had
at
least
tw
o
al
pha
b
uilds
of
Android
released
internally
before
the
release
of
v
ersion
1.0
at
the
end
of
2008
[12].
The
leading
manuf
acturers,
such
as
HTC,
Motorola,
Qualcomm,
T
e
xas
Instruments
and
carriers
including
T
-Mobile
agreed
on
a
formation
for
future
mobile
and
related
softw
are
production
which
is
called
Open
Handset
Alliance.
F
or
the
prom
o
t
ion
of
the
Android
platform
as
a
reliable
smartphone
operating
system,
OHA
members
are
forbidden
from
producing
de
vices
based
on
incompatible
forks
of
Android.
No
w
,
there
are
in
total
84
firms
under
this
agreement
and
the
y
contrib
ute
to
the
open
standards
for
the
smartphone
technology
.
No
w
,
the
Android
open
source
project
is
de
v
eloped
and
maintained
by
Google
and
Open
Handset
Alliance.
A
surve
y
on
andr
oid
security:
de
velopment...
(Ratul
Sikder)
Evaluation Warning : The document was created with Spire.PDF for Python.
488
r
ISSN:
1693-6930
2.2.
Andr
oid
de
v
elopment
From
the
v
ery
initial
release,
Google
has
been
releasing
ne
w
v
ersions
of
Android
OS
e
v
ery
year
,
containing
major
changes
in
both
the
base
architecture
and
the
user
interf
ace.
Figure
1.
Adaptation
of
android
OS
v
ersions(%)
The
pie
chart
in
Figure
1
sho
ws
the
percentage
of
de
vices
running
dif
ferent
v
ersions
of
the
Android
platform.
In
Oct.
2009,
a
year
after
the
launch
of
Android
1.0,
Google
released
v
ersion
2.0
of
the
OS.
This
v
ersion
adds
te
xt-to-speech
support
and
introduced
li
v
e
w
allpapers,
multiple
account
support,
and
Google
Map’
s
na
vig
ation.
This
release
contains
man
y
other
ne
w
features
and
impro
v
ements.
Android
2.3
Gingerbread
w
as
launched
in
Sept.
2010,
is
currently
the
oldest
v
ersion
of
the
most
popular
v
ersions
of
Android.
Basically
,
Android
started
dominating
the
smartphone
mark
et
with
the
huge
success
of
this
v
ersion
of
the
Android
OS.
Android
4.0,
4.2
and
4.4
ruled
the
mark
et
for
se
v
eral
years
and
Android
smartphone
became
a
strong
preference
for
the
general
people
because
of
its’
functionalities
lik
e
easy
file
sharing
and
backup,
enriched
app-store,
g
aming
and
so
on
alongside
with
its
comparati
v
ely
lo
wer
price
tag.
Mo
ving
on,
Android
v
ersions
from
5.0
to
9.0
gradually
ha
v
e
grabbed
around
75
percent
of
the
whole
mobile
mark
et
share
[13].
3.
BIG
PICTURE
Android
OS
is
significantly
popular
than
an
y
other
e
xisting
smartphone
OS.
T
able
1
sho
ws
the
smartphone
OS
mark
et
share
in
2019.
According
to
Global
Stats,
Android
OS
is
the
dominating
smartphone
OS
with
its
75
percent
mark
et
share
[14].
T
able
1.
Smartphone
operating
system
mark
et
share
w
orldwide,
2019
[14]
S/N
Mobile
OS
Mark
et
Share
(%)
1
Android
OS
75.33
2
iOS
22.4
3
KaiOS
0.84
4
W
indo
ws
OS
0.61
5
Unkno
wn
0.36
6
W
indo
ws
0.28
The
number
of
acti
v
e
mobile
users
around
the
globe
is
4.93
Billion
[15].
The
primary
goal
of
de
v
eloping
a
mobile
phone
w
as
to
communicate
with
others.
But,
today’
s
phone
can
do
much
more.
Due
to
the
increasing
functionality
of
mobile
phones,
vulnerabilities
arise
which
has
become
a
serious
concern
for
both
the
manuf
acturers
and
the
de
v
elopers.
Man
y
of
the
security
vulnerabilities
are
unintentional,
e.g.,
poor
programming
practices,
app
de
v
elopers
f
ail
to
v
alidate
input
from
the
web,
allo
wing
adv
ersaries
to
access
the
TELK
OMNIKA
T
elecommun
Comput
El
Control,
V
ol.
18,
No.
1,
February
2020
:
485
–
499
Evaluation Warning : The document was created with Spire.PDF for Python.
TELK
OMNIKA
T
elecommun
Comput
El
Control
r
489
protected
files,
etc.
V
ulnerabilities
can
also
be
intentional
as
well
as
malicious
and
can
be
hidden
within
a
seemingly
safe
and
le
gitimate
app,
i.e.
a
simple
paint
app
asks
for
internet
and
GPS
access
[16].
Security
vulnerabilities
and
unwise
programming
practices
can
lead
to
the
follo
wing
issues:
(a)
Users’
pri
v
ac
y
violation
(b)
Performance
de
gradation
(c)
Hea
vy
battery
drain
(d)
Poor
end-user
satisf
action
(e)
Mal
w
are,
virus,
adw
are
attack,
etc.
V
ulnerabilities
result
from
security
threats
which
are
created
with
the
collaboration
of
a
group
of
hack
ers
and
unethical
emplo
yees.
The
top
security
threats
are
discussed
in
the
follo
wing:
3.1.
Malicious
app
Malicious
apps
are
specially
designed
to
attack
smartphone
systems.
These
mal
w
are
apps
signific
antly
relay
on
the
e
xploitation
of
OS
and
softw
are
technology
of
smartphone.
W
e
can
enlist
the
malicious
apps
into
the
follo
wing
four
cate
gories:
[17]
(a)
Sp
yw
are
(b)
T
rojans
(c)
Phishing
(d)
Hidden
processes
3.1.1.
Spywar
e
Sp
yw
are
is
unsought
softw
are
that
perv
ades
one’
s
computing
de
vices
by
robbing
his/her
internet
usage
data
and
other
sensiti
v
e
information
lik
e
personal
information
without
his/her
kno
wledge
of
it.
Sp
yw
are
is
a
kind
of
mal
w
are
designed
to
g
ain
access
to
one’
s
de
vice.
The
intentions
of
using
sp
yw
are
are
di
v
erse
e.g.,
for
tracking
login
information,
selling
internet
usage
data,
capturing
credit/debit
card
information,
etc.
Some
sp
yw
are
is
able
to
install
additional
applications
and
the
y
can
change
the
settings
of
the
victim’
s
smartphone.
According
to
the
Norton
Cyber
Security
Insights
Report,
in
the
year
2017,
nearly
978
million
people
from
20
countries
were
attack
ed
by
c
ybercrime
and
victims
lost
172
billion
USD
globally
and
sp
yw
are
caused
more
damages
than
other
types
of
malicious
app
[18].
3.1.2.
T
r
ojans
T
rojan
is
a
kind
of
mal
w
are
that
is
often
f
ak
ed
as
le
gitimate
softw
are.
T
rojans
can
be
de
v
oted
by
hack
ers
and
other
c
yber
criminals
to
g
ain
access
to
someone’
s
computing
de
vice
and
can
se
v
erely
damage
the
system,
e.g.,
deleting,
cop
ying,
disrupting,
blocking
and
modifying
data.
Some
common
form
of
trojans
includes
T
rojan-SMS,
T
rojan-Notifier
,
T
rojan-Sp
y
,
T
rojan-Mailfinder
and
so
on
[19].
Sometimes
it
is
hard
to
ensure
the
absence
of
trojans
in
a
system
as
the
y
may
not
harm
directly
to
the
users
rather
steal
the
pri
v
ate
and
sensiti
v
e
information
silently
.
3.1.3.
Phishing
It
is
a
type
of
social
engineering
attack
designed
to
g
ain
access
to
someone’
s
pri
v
ate
i
nformation,
e.g.,
credit
card
information
and
login
credentials.
The
c
yber
thie
v
es
accomplish
this
by
misleading
people
in
v
ery
con
v
enient
w
ays.
F
or
e
xample,
one
may
recei
v
e
an
email
which
claims
that
his/her
passw
ord
for
a
specific
website
is
about
to
e
xpire
within
24
hours
and
put
a
f
ak
e
link
which
looks
v
ery
le
gitimate
to
rene
w
the
passw
ord.
Once
the
victim
inserts
his/her
logi
n
credentials,
the
attack
er
captures
the
original
information
and
e
v
entually
get
access
to
his/her
pri
v
ate
data.
3.1.4.
Hidden
pr
ocesses
These
are
the
applications
in
which
some
anon
ymous
acti
vities
are
embedded
without
pro
viding
an
y
kno
wledge
to
the
users.
F
or
e
xample,
a
g
aming
application
scans
for
the
nearby
wireless
de
vices
which
is
not
necessary
for
an
y
of
the
g
aming
functionalities.
These
types
of
hidden
operations
can
harm
users
and
user
e
xperience.
3.2.
Malwar
e
do
wnloader
A
mal
w
are
do
wnloader
(i.e.
trojan
do
wnloader)
is
a
harmful
application,
basically
installed
by
an
e
xploit
or
some
other
fraudulent
causes
lik
e
an
email
attachment
or
a
do
wnloaded
image
that
triggers
to
install
the
malicious
program
onto
a
victim’
s
computer
[20].
A
surve
y
on
andr
oid
security:
de
velopment...
(Ratul
Sikder)
Evaluation Warning : The document was created with Spire.PDF for Python.
490
r
ISSN:
1693-6930
3.3.
F
ak
e
operation
Android
OS
f
amily
is
v
ery
di
v
erse.
There
are
numerous
of
ficial
as
well
as
unof
ficial
v
ersions
of
this
OS.
This
open
nature
of
the
platform
has
gi
v
en
the
attack
ers
to
introduce
v
arious
f
ak
e
operations.
F
aking
operator’
s
identity
,
model,
v
ersion,
softw
are
update
as
well
as
f
ak
e
apps’
goal,
etc
are
some
common
e
xamples
of
f
ak
e
operations.
3.4.
Hidden
ads
”It
w
on’
t
hurt
if
you
don’
t
kno
w
it.
”
is
a
common
pro
v
erb
b
ut
unfortunately
,
this
phase
isn’
t
suitable
for
today’
s
smartphone
security
ris
k
s
.
Man
y
of
the
free
apps
contain
e
xcessi
v
e
ads
that
are
a
v
ailable
in
the
app
store.
That
is
le
g
al
because
the
y
ackno
wledge
both
parties
that
the
app
contains
ads.
But
some
malicious
app
contains
hidden
ads
that
may
be
harmful
to
users.
Often
these
apps
cause
slo
wing
do
wn
the
de
vice,
sucking
mobile
data,
draining
the
battery
and
so
on.
A
recent
study
has
sho
wn
that
more
than
5000
apps
of
both
the
major
smartphone
platforms
contain
hidden
apps.
It
al
so
causes
a
huge
amount
of
loss
to
the
adv
ertising
or
g
anization.
The
y
lose
about
$85
million
per
year
because
of
the
hidden
ads
[21].
3.5.
Pr
emium
text
Sometime
we
may
recei
v
e
some
messages
from
a
four
or
fi
v
e
digit
phone
number
e.g.,
get
jok
es
for
USD1
per
month
or
send
ST
OP
to
cancel
the
service.
Majority
of
the
users
m
ay
not
acti
v
ate
the
service
so
the
y
are
not
concern
about
it
b
ut
after
a
month
the
y
get
a
bill
of
USD1.
This
unintentional
or
f
ak
e
re
gistration
to
a
service
is
done
by
some
scammers
and
fraudsters.
The
y
sign
up
for
the
victim
by
using
the
victim’
s
phone
number
from
some
websites
[22].
3.6.
Mobile
spy
Mobile
sp
ying
applications
ha
v
e
been
de
v
eloped
to
monitor
child
or
emplo
yee’
s
mobile
and
tablet
usage.
T
ar
geted
ads
are
a
major
source
of
income
for
an
ad
netw
ork
which
may
enable
this
type
of
attack
ers
to
mine
the
personal
information
of
a
user
[23].
T
able
2
sho
ws
the
top
enlisted
mobile
threats
in
2016-2017
along
with
their
percentages.
T
able
2.
Enlisted
mobile
threats
in
2016-2017
[26]
Mobile
Threat
Percentage
Malicious
App
39.2
Mal
w
are
Do
wnloader
16.1
F
ak
e
Operation
5.2
Hidden
Ads
4.8
Premium
T
e
xt
4.1
Mobile
Sp
y
3.2
SMS
Block
er
2.3
Mal
Dropper
2.1
Do
wnloader
1.7
Dropper
1.7
F
ak
e
App
1.7
SMS
Stealer
1.7
Rootnik
1.6
Lotoor
1.4
Re
g
SMS
1.2
F
ak
e
Inst
1.2
Hidden
App
0.8
Lock
Droid
0.8
Being
the
most
popular
smartphone
OS,
Android
has
a
much
bigger
tar
get
for
malicious
attacks.
According
to
an
industry
research
firm
”J.
Gold
Associates”
compa
n
i
es
that
manuf
acture
Android-po
wered
de
vices
should
tak
e
necessary
meas
ures
to
mak
e
global
policies
to
mitig
ate
security
r
isks
that
the
platform
may
pose
due
to
its’
massi
v
e
gro
wth
[24].
On
the
other
hand,
though
Google’
s
Android
OS
is
an
open-source
OS,
it
has
restricted
a
lot
of
features
for
3
rd
party
de
v
elopers.
The
3
rd
party
de
v
elopers
ha
v
e
minimized
de
v
eloping
security
related
stuf
f
due
to
Android’
s
core
le
v
el
restrict
ions.
F
or
e
xample,
AutoStart
restriction
has
been
introduced
in
Android
v
ersion
3
:
1
(Hone
ycomb),
Android
6
:
0
(Marshmallo
w)
update
restricted
apps’
ability
to
find
the
current
running
task
by
using
the
getRunningT
asks()
API
[25].
TELK
OMNIKA
T
elecommun
Comput
El
Control,
V
ol.
18,
No.
1,
February
2020
:
485
–
499
Evaluation Warning : The document was created with Spire.PDF for Python.
TELK
OMNIKA
T
elecommun
Comput
El
Control
r
491
4.
MAJOR
ISSUES
OF
SYSTEM
LEVEL
ANDR
OID
DEVELOPMENT
Android
OS
has
been
de
v
eloped,
changed
and
modified
significantly
in
recent
days.
Security-re
lated
de
v
elopment,
as
well
as
process
handling
API,
is
becoming
deprecated
for
the
3
rd
party
de
v
elopers
and
Google
has
clearly
mentioned
that
this
is
the
job
for
mobile
manuf
acturers
[27].
Currently
,
de
v
eloping
apps
for
the
root
le
v
el
platform
optimization
is
not
feasible
without
root
acces
s
which
is
only
a
v
ailable
for
manuf
acturers
and
trusted
de
v
elopers.
This
is
mainly
due
to
the
continuous
permission
restrictions
in
e
v
ery
major
rel
ease
of
the
Android
OS.
This
domain
will
be
discussed
in
the
follo
wing
three
subsections.
(a)
Android
security
restrictions
for
3
rd
parties
(b)
Recent
changes
in
android
permission
(c)
Feasibility
of
de
v
eloping
security
related
apps
4.1.
Andr
oid
security
r
estrictions
f
or
3
rd
parties
Android
is
continuously
restricting
access
to
3
rd
party
apps
for
dif
ferent
types
of
resources
and
ra
w
data.
Gradually
,
the
majority
of
the
apps
de
v
eloped
to
serv
e
the
purpose
of
further
platform
optimization
such
as
battery
optimization,
security
checking,
process
optimization,
etc.,
had
stopped
from
de
v
eloping
further
.
Some
of
the
restrictions
are
sho
wn
belo
w
.
(a)
Limiting
directory
access:
w
orld-writable
directories
may
lead
to
security
weaknesses
and
enable
an
application
to
manipulate
trusted
files.
A
proper
file
scanning
scheme
is
mandatory
for
a
security-related
3
rd
party
app
for
better
threat
detection
[27].
(b)
Logging
data:
it
increases
the
risk
of
the
e
xposure
of
core
le
v
el
system
data
and
reduces
system
performance
upon
e
xcessi
v
e
requests.
On
the
other
hand,
log
information
is
necessary
to
g
ather
information
about
the
battery
,
CPU
and
netw
ork
usage
which
are
mandatory
for
de
vice
optimization
and
security
analysts
[27].
(c)
De
vice
Metadata:
Android
also
restricts
access
to
data
that
does
not
seem
directly
sensiti
v
e,
b
ut
that
could
lead
to
re
v
ealing
characteristics
about
the
user
,
user
preferences,
and
other
stuf
f
[28].
4.2.
Recent
changes
in
andr
oid
permission
Android
has
changed
as
well
as
depreciated
some
system
le
v
el
permissions
and
APIs.
It
has
led
some
old
applications
to
a
non-w
orkable
state
in
the
ne
wer
v
ersions
of
Android.
Figure
2
summarizes
the
changes
in
recent
Android
v
ersions
which
includes
battery
and
memory
optimization,
performance
enhancement
and
others.
Figure
2.
Major
changes
in
the
recent
android
v
ersions
A
surve
y
on
andr
oid
security:
de
velopment...
(Ratul
Sikder)
Evaluation Warning : The document was created with Spire.PDF for Python.
492
r
ISSN:
1693-6930
4.2.1.
Changes
in
Andr
oid
6.0
(Marshmallo
w)
Runtime
Permis
sion:
In
Android
6.0,
a
ne
w
mechanism,
called
runtime
perm
ission,
is
added
so
that
the
user
can
identify
what
permissions
are
needed
for
a
particular
app
and
this
gi
v
es
them
a
chance
to
re
vie
w
the
permissions
to
judge
whether
it
is
w
orth
y
or
not.
This
technique
reduces
security
risks
via
permission
violation
[29].
Doze
and
App
Standby:
If
a
de
vice
is
stationary
and
idle
along
with
the
screen
of
f,
the
de
vice
goes
into
doze
mode.
It
is
lik
e
a
s
leep
state
of
the
system
and
app
standby
technology
enables
the
system
to
percei
v
e
that
an
app
is
idle.
4.2.2.
Changes
in
Andr
oid
7
(Nougat)
Battery
and
Memory:
In
Android
7.0,
the
system’
s
characteristics
w
as
changed
to
enhance
the
battery
life
and
the
memory
optimization
of
de
vices.
Impro
v
ement
of
Doze:
Battery
life
is
impro
v
ed
by
’Doze’
by
limi
ting
CPU
and
netw
ork
act
i
vities.
Doze
triggers
when
a
user
k
eeps
de
vice
unplugged;
could
be
mo
ving
or
stationary
,
with
the
screen
turned
of
f.
4.2.3.
Changes
in
Andr
oid
8
(Or
eo)
(a)
Background
e
x
ecution
limits
(b)
Android
background
location
limits
Android
Go:
Android
Go
is
a
lightweight
v
ersion
of
Android
OS
specially
designed
for
lo
w-end
de
vices
to
run
apps
and
other
processes
smoothly
.
The
operating
system
w
as
introduced
alongside
Android
8.0
(Oreo)
and
it’
s
based
on
Android
8.0.
This
lightweight
smartphone
OS
is
optimized
to
run
on
smartphones
ha
ving
1
GB
or
lo
wer
memory
and
it
tak
es
almost
half
of
the
storage
than
the
re
gular
Android
v
ersions
[30].
Android
Go
de
vices
are
15%
f
aster
in
terms
of
apps
opening
than
the
re
gular
v
ersions.
On
the
other
hand,
the
apps
may
be
f
aster
and
lightweight
on
Android
Go
b
ut,
the
y
are
lack
of
some
features.
The
positi
v
e
thing
is
that
the
de
v
elopers
can
easily
optimize
their
apps
for
the
Android
Go
platform
by
follo
wing
Google’
s
”Building
for
Billions”
de
v
elopment
guidelines.
4.2.4.
Changes
in
Andr
oid
9
(Pie)
Android
9.0
is
the
ne
west
v
ersion
of
this
OS
of
fered
from
Google.
It
introduces
a
number
of
changes
to
the
system
beha
vior
of
the
OS.
Important
beha
vioral
changes
are
briefly
des
cribed
belo
w
[31].
Po
wer
management:
Android
9
(API
le
v
el
28)
introduces
brand
ne
w
features
to
impro
v
e
the
po
wer
management
of
Android-based
de
vices.
These
po
wer
management
features
are
tw
o
types
as
follo
ws:
(a)
App
standby
b
uck
ets:
Analyzing
the
user’
s
usage
pattern,
the
s
ystem
limits
access
to
v
arious
resources
lik
e
battery
or
CPU
to
the
apps.
(b)
Battery
sa
v
er
impro
v
ements:
The
e
xisting
battery
sa
ving
feature
is
impro
v
ed
with
a
wide
area
of
restrictions.
Pri
v
ac
y
changes:
(a)
Limited
access
to
sensors
in
background:
In
Android
9,
apps
running
in
the
background
can
not
access
the
camera,
microphone,
sensors
using
the
continuous
reporting
mode
as
well
as
on-change
and
one-shot
reporting
mode.
(b)
Android
9
restricts
apps’
access
to
call
logs
and
telephone
numbers.
(c)
The
system
restricts
access
to
W
i-Fi
location
and
connection
information.
Restrictions
on
use
of
non-SDK
interf
aces:
The
pl
atform
restricts
the
use
of
some
popular
non-SDK
methods
and
fields
if
the
de
v
elopers
attempt
to
access
these
directly
,
via
reflection
or
using
JNI.
Security
beha
vior
changes:
(a)
The
system’
s
TLS
implementation
has
e
xperienced
numerous
modifications
in
Android
9.
(b)
Android
9
additionally
restricts
the
system
calls
a
v
ailable
to
apps
that
use
pri
vile
ged
syscalls.
(c)
Android
secure
encrypted
files
are
no
longer
supported.
(d)
Netw
ork
address
lookups
can
cause
netw
ork
violations
that
require
name
resolution.
This
might
in
v
ok
e
netw
ork
I/O
and
might
be
considered
blocking
actions.
This
can
result
in
pauses
on
the
main
thread.
TELK
OMNIKA
T
elecommun
Comput
El
Control,
V
ol.
18,
No.
1,
February
2020
:
485
–
499
Evaluation Warning : The document was created with Spire.PDF for Python.
TELK
OMNIKA
T
elecommun
Comput
El
Control
r
493
4.3.
F
easibility
of
de
v
eloping
security
r
elated
apps
W
e
ha
v
e
studied
dif
ferent
types
of
utility
apps
de
v
eloped
for
mobile
de
vice(Android)
optimiza
tion
and
battery
life
enhancement.
W
e
ha
v
e
found
some
interesting
f
acts,
that
is
most
of
these
apps
didn’
t
do
an
ything
right
rather
draining
the
battery
and
slo
wing
do
wn
the
performance.
Android
OS
structure
has
been
changing
rapidly
and
the
security
in
v
olv
ements,
process
handling
API,
etc.
are
becoming
deprecated
for
3
rd
party
de
v
elopers.
Google
has
clearly
mentioned
that
this
is
the
job
for
mobile
manuf
acturers.
5.
BEST
PRA
CTICES
The
o
v
erall
security
and
the
pri
v
ac
y
of
an
Android
mobil
e
phone
us
er
depend
on
the
end
user’
s
usage
pattern
and
a
w
areness.
The
security
and
pri
v
ac
y
related
principals
and
ef
forts
put
by
the
de
v
elopers
in
this
field
is
also
equally
important
for
ensuring
security
and
pri
v
ac
y
.
The
first
party
such
as
manuf
acturers
ha
v
e
a
big
opportunity
to
play
important
roles
in
deli
v
ering
the
latest
security
features,
patches
to
the
phone
quickly
.
These
three
portions
of
security
and
pri
v
ac
y
related
practices
all
together
result
in
greater
protection
and
safety
for
the
end
users.
5.1.
Best
practices
f
or
the
users
Almost
e
v
ery
smart
phone
user
has
at
least
100
apps
on
his/her
mobile
phone
according
to
the
surv
e
y
of
F
ortune
[32].
But,
the
user
doesn’
t
use
all
the
apps.
A
user
may
need
an
application
for
a
while,
b
ut
after
getting
the
job
done,
he/she
may
not
delete
the
application,
e
v
en
though
he/she
does
not
require
the
app
an
ymore.
In
addition,
one
may
stop
using
man
y
such
applications.
These
unused
applications
can
be
detected
as
malicious
apps
[33].
Man
y
of
these
unused
applications
may
use
resources,
lik
e
the
internet,
geographic
locations,
call
logs
and
other
user
permissions.
It
is
harmful
to
a
user
.
So,
e
v
ery
user
should
follo
w
some
rules
to
k
eep
his/her
de
vices
health
y
,
and
som
e
of
the
rules
are
sho
wn
in
the
Figure
3.
In
the
follo
wing,
we
will
discuss
some
important
security
practices
that
should
be
considered
for
a
v
oiding
unw
anted
vulnerabilities.
Figure
3.
Best
practices
for
users
5.1.1.
Softwar
e
update
Google
Inc.
and
other
manuf
acturers
pro
vide
system
updates
which
include
security
patches,
feat
ures
and
functionalities,
UI
impro
v
ements
and
so
on
to
o
v
ercome
vulnerabilities
and
to
ensure
smoother
user
e
xperience.
T
o
get
the
finest
user
e
xperiences,
it
is
definitely
a
good
i
dea
to
update
the
phone
softw
are
re
gularly
.
The
ne
west
v
ersions
of
the
s
oftw
are
help
the
users
to
run
their
phones
more
smoothly
and
quickly
with
minimum
numbers
of
lags
and
security
vulnerabilities.
A
surve
y
on
andr
oid
security:
de
velopment...
(Ratul
Sikder)
Evaluation Warning : The document was created with Spire.PDF for Python.
494
r
ISSN:
1693-6930
5.1.2.
Installation
of
applications
fr
om
untrustw
orth
y
sour
ces
Unlik
e
Google,
may
other
third-party
app
stores
ne
v
er
seem
to
concern
about
malicious
appli
cations
on
their
stores.
Man
y
de
v
elopers
also
of
fer
bet
a
apps
that
don’
t
follo
w
some
of
the
Google’
s
guidelines.
Hence,
it
is
a
good
practice
not
to
install
apps
from
an
y
untrustw
orth
y
sources
as
well
as
the
beta
v
ersions
of
smartphone
apps.
5.1.3.
Understanding
app
permissions
Android
OS
is
getting
better
in
terms
of
security
enhancement
day
by
day
.
From
Android
v6.0,
runtime
permission
request
is
added.
It
means
the
user
needs
to
agree
with
critical
permission(s)
during
app
usage.
Though
this
process
is
safer
than
the
pre
vious
v
ersions’
of
agreement,
people
often
mak
e
mistak
es
while
opening
the
app
for
the
first
time:
the
y
often
grant
permissions
without
reading
and
kno
wing
the
consequences
of
it
.
The
y
also
do
not
check
the
list
of
permissions
during
apps
installation.
Instead,
the
y
j
ust
accept
the
requests
without
thinking
about
the
consequences.
It
may
be
harmful
be
cause
the
de
v
eloper
could
tak
e
adv
antages
of
it.
5.1.4.
Data
encryption
and
r
emote
phone
wipe
Encrypting
the
data
of
a
smartphone
can
help
to
impro
v
e
users’
security
and
pri
v
ac
y
one
step
ahead.
A
user
can
only
get
access
to
the
encrypted
data
with
a
v
alid
passw
ord
or
k
e
y
.
Encryption
of
a
smartphone
enables
the
needs
for
a
passw
ord
or
k
e
y
in
e
v
ery
boot
up
of
the
smartphone.
Apart
from
that,
it
doesn’
t
change
an
ything
ho
w
a
user
uses
his/her
smartphone.
From
Android
v
ersion
6.0,
data
encryption
is
enabled
by
def
ault.
Encryption
may
cause
slo
wing
do
wn
the
performance
of
some
older
smartphone,
b
ut
it
doesn’
t
af
fect
today’
s
Android
de
vices.
If
an
application
does
not
meet
certain
challenges,
it
should
not
be
installed
on
phone
[34].
Anti-virus
pro
vider
Kaspersk
y
lab
published
a
report
that
an
IT
-based
compan
y
de
v
eloped
an
app
called
“sk
ygofree”
which
w
as
released
with
48
dif
ferent
commands
that
w
as
able
to
risk
a
user’
s
safety
in
se
v
eral
w
ays
lik
e
it
relies
on
5
dif
ferent
e
xploits
to
achie
v
e
root
pri
vile
ge
which
allo
ws
it
to
bypass
security
k
e
y
and
it
w
as
also
capable
of
location-based
recording,
capturing
image,
videos,
calendar
data
and
other
personal
information
[35].
Although
applying
all
the
security
measurement
a
v
ailable,
it
w
on’
t
feel
good
if
the
phone
got
stolen,
unfortunately
.
If
someone
f
aces
such
circumstances
that
he/she
w
on’
t
re
g
ain
his/her
de
vice
ag
ain,
it
becomes
necessary
to
wipe
the
phone.
Google
pro
vides
”find
my
de
vice”
option
for
all
Google
account
link
ed
Android
smartphones.
V
ictims
need
to
head
o
v
er
to
the
”Google’
s
De
vice
Manager”
website
and
log
into
the
Google
account
and
complete
the
desired
operation.
If
the
de
vice
has
internet
access,
it
is
possible
to
call,
set
alert,
find
the
e
xact
location,
lock
or
wipe
the
phone’
s
data
remotely
from
the
de
vice
manager
.
The
user
must
mak
e
sure
that
the
Google
account’
s
passw
ord
is
strong
enough
so
that
an
yone
else
can’
t
wipe
his/her
smartphone.
5.1.5.
Lock-scr
een
and
biometric
scanner
Almost
one-third
of
the
total
users
don’
t
concern
about
the
lock-screen
security
and
the
y
use
the
traditional
swipe-to-unlock
method
[36].
Though
it
helps
to
protect
the
phone
from
accidental
touches
when
the
phone
is
in
the
pock
et
b
ut
the
phone
can
not
pro
vide
an
y
security
barrier
if
the
phone
got
stolen
or
compromised
someho
w
.
All
type
of
Android
smartphone
of
fer
PIN,
passw
ord,
and
pattern
(mostly)
to
secure
the
phone
which
can
easily
be
enabled
from
the
security
options
in
the
settings.
Additi
o
na
lly
,
modern
smartphones
ha
v
e
been
introducing
biometric
sensors
lik
e
fingerprint
sensor
,
iris,
and
f
aceID
to
enhance
smartphone
security
.
Among
these
multiple
biometric-based
methods,
fingerprint-based
biometrics
is
the
most
secure
w
ay
to
date.
5.1.6.
Online
backups
Limited
storage
on
an
y
smartphones
could
create
some
troubles,
especially
on
lo
wer
storage
smartphones.
W
ith
the
increasing
media
consumption
and
day
to
day
online
interactions
and
acti
vities,
the
inb
uilt
phone
storage
is
getting
occupied
quickly
.
This
lead
to
slo
wing
do
wn
the
smartphone’
s
performance,
increase
battery
consumption
and
reduce
the
quality
of
user
e
xperience.
A
non-limited
storage
or
at
least
visibly
enough
storage
w
ould
solv
e
the
problem.
On
the
other
hand,
if
the
phone
is
lost,
stolen
or
damaged
then
all
the
important
data
and
media
might
be
lost
fore
v
er
if
the
data
is
not
back
ed
up.
T
o
preserv
e
important
data
and
access
them
from
an
ywhere
and
from
an
y
de
vice,
cloud
storage
is
a
proper
solution.
Man
y
online
cloud
service
pro
vider
serv
es
this
purpose
according
to
their
o
wn
structure.
F
or
e
xample,
one
can
backup
unlimited
photos
and
videos
to
Google
Photos
free
of
cost.
Dropbox,
Google
Dri
v
e,
One
Dri
v
e,
etc.
are
of
fering
online
cloud
storage.
TELK
OMNIKA
T
elecommun
Comput
El
Control,
V
ol.
18,
No.
1,
February
2020
:
485
–
499
Evaluation Warning : The document was created with Spire.PDF for Python.