Zero permission android applications - attacks and defenses

Google advertises the Android permission framework as one of the core security features present on its innovative and flexible mobile platform. The permissions are a means to control access to restricted AP/s and system resources. However, there are Android applications which do not request permissions at all.In this paper, we analyze the repercussions of installing an Android application that does not include any permission and the types of sensitive information that can be accessed by such an application. We found that even app/icaaons with no permissions are able to access sensitive information (such the device ID) and transmit it to third-parties.

Security testing in Android networks : a practical case study

Android is a new generation of an open operating system directed at mobile devices that are carried every day. The openness of this architecture is leading to new applications and opportunities including a host of multimedia services, new interfaces and browsers, multitasking including support for wireless local, personal and wide area networking services. Security with mobility and wireless connectivity thus becomes even more important with all these exciting developments. Vital security issues such as leakage of private information, file stealing and spambots abound in networks in practice and Android networks continue to be subject to these same families of vulnerabilities. This paper provides a demonstration of such vulnerabilities in spite of the best efforts of designers and implementers. In particular it describes examples of data leakage and file stealing (address books, contact lists, SMS messages, pictures) as well as demonstrating how Android devices can create spambots. © 2013 IEEE.

Mobile phone-based electrochemiluminescence sensing exploiting the 'USB On-The-Go' protocol

A low-cost system to generate, control and detect electrochemiluminescence using a mobile smartphone is described. A simple tone-detection integrated circuit is used to switch power sourced from the phone's Universal Serial Bus (USB) 'On-The-Go' (OTG) port, using audible tone pulses played over the device's audio jack. We have successfully applied this approach to smartphones from different manufacturers and with different operating system versions. ECL calibrations of a common luminophore, tris(2,2′-bipyridine)ruthenium(II) ([Ru(bpy)3]²⁺), with 2-(dibutylamino)ethanol (DBAE) as a co-reactant, showed no significant difference in light intensities when an electrochemical cell was controlled by a mobile phone in this manner, compared to the same calibration generated using a conventional potentiostat. Combining this novel approach to control the applied potential with the measurement of the emitted light through the smart phone camera (using an in-house built Android app), we explored the ECL properties of a water-soluble iridium(III) complex that emits in the blue region of the spectrum. The iridium(III) complex exhibited superior co-reactant ECL intensities and limits of detection to that of the conventional [Ru(bpy)3]²⁺ luminophore.

A web- and mobile phone-based intervention to prevent obesity in 4-year-olds (MINISTOP): a population-based randomized controlled trial

BACKGROUND: Childhood obesity is an increasing health problem globally. Overweight and obesity may be established as early as 2-5 years of age, highlighting the need for evidence-based effective prevention and treatment programs early in life. In adults, mobile phone based interventions for weight management (mHealth) have demonstrated positive effects on body mass, however, their use in child populations has yet to be examined. The aim of this paper is to report the study design and methodology of the MINSTOP (Mobile-based Intervention Intended to Stop Obesity in Preschoolers) trial.

METHODS/DESIGN: A two-arm, parallel design randomized controlled trial in 300 healthy Swedish 4-year-olds is conducted. After baseline measures, parents are allocated to either an intervention- or control group. The 6- month mHealth intervention consists of a web-based application (the MINSTOP app) to help parents promote healthy eating and physical activity in children. MINISTOP is based on the Social Cognitive Theory and involves the delivery of a comprehensive, personalized program of information and text messages based on existing guidelines for a healthy diet and active lifestyle in pre-school children. Parents also register physical activity and intakes of candy, soft drinks, vegetables as well as fruits of their child and receive feedback through the application. Primary outcomes include body fatness and energy intake, while secondary outcomes are time spent in sedentary, moderate, and vigorous physical activity, physical fitness and intakes of fruits and vegetables, snacks, soft drinks and candy. Food and energy intake (Tool for Energy balance in Children, TECH), body fatness (pediatric option for BodPod), physical activity (Actigraph wGT3x-BT) and physical fitness (the PREFIT battery of five fitness tests) are measured at baseline, after the intervention (six months after baseline) and at follow-up (12 months after baseline).

DISCUSSION: This novel study will evaluate the effectiveness of a mHealth program for mitigating gain in body fatness among 4-year-old children. If the intervention proves effective it has great potential to be implemented in child-health care to counteract childhood overweight and obesity.

Bootstrapping mobile app development

Modern IDEs provide limited support for developers when starting a new data-driven mobile app. App developers are currently required to write copious amounts of boilerplate code, scripts, organise complex directories, and author actual functionality. Although this scenario is ripe for automation, current tools are yet to address it adequately. In this paper we present RAPPT, a tool that generates the scaffolding of a mobile app based on a high level description specified in a Domain Specific Language (DSL). We demonstrate the feasibility of our approach by an example case study and feedback from a professional development team. Demo at: https://www.youtube.com/watch?v=ffquVgBYpLM.

JCML: A specification language for the runtime verification of Java Card programs

COSTA, Umberto Souza; MOREIRA, Anamaria Martins; MUSICANTE, Matin A.; SOUZA NETO, Plácido A. JCML: A specification language for the runtime verification of Java Card programs. Science of Computer Programming. [S.l]: [s.n], 2010.

Specification and Runtime Verification of Java Card Programs

COSTA, Umberto Souza da; MOREIRA, Anamaria Martins; MUSICANTE, Martin A. Specification and Runtime Verification of Java Card Programs. Electronic Notes in Theoretical Computer Science. [S.l:s.n], 2009.

Técnicas baseadas em etnografia e prototipagem no Design de interface de aplicativo mobile para gerenciamento acadêmico

Baseado na metodologia de design participativo, este artigo relata o processo de pesquisa e desenvolvimento de uma versão mobile de um sistema já existente para desktop e amplamente utilizado para o compartilhamento de informações acadêmicas em uma universidade federal do Brasil. A pesquisa foi realizada em duas etapas. Na ‘Etapa I’ foram realizados estudos baseados em etnografia envolvendo docentes e discentes: Grupo de Foco, Análise Contextual, Avaliação Heurística Participativa e Avaliação Cooperativa. Por meio dos resultados foi possível identificar funcionalidades e requisitos desejáveis, problemas de usabilidade de uma versão mobile já em processo inicial de desenvolvimento, bem como e elaboração de uma nova interface gráfica. Na ‘Etapa II’ foram avaliados modelos de interação por meio de protótipos especificamente projetados para testes no mecanismo de lançamento de frequência do sistema mobile que, em seguida, foram avaliados através de testes de usabilidade e questionário de satisfação do usuário.

Use of a semantically grained database system for distribution and control within design environments

This paper presents a technique to share the data stored in an object-oriented database aimed at designing environments. This technique shares data between two related databases, called the Original and Product databases, and is composed of three processes: data separation, evolution and integration. Whenever a block of data needs to be shared, it is spread into both databases, resulting in a block on the original database, and another into the Product database, with special links between them controlled by the Object Manager. These blocks do not need to be maintained identical during the evolution phase of the sharing process. Six types of links were defined, and by choosing one, the designer control the evolution and reintegration of the block in both databases. This process uses the composite object concept as the unit of control. The presented concepts can be applied to any data model with support to composite objects.

Use of myoelectric signals to command mobile entertainment robot by disabled children: Design and control architecture

Severely disabled children have little chance of environmental and social exploration and discovery. This lack of interaction and independency may lead to an idea that they are unable to do anything by themselves. In an attempt to help children in this situation, educational robotics can offer and aid, once it can provide them a certain degree of independency in the exploration of environment. The system developed in this work allows the child to transmit the commands to a robot through myoelectric and movement sensors. The sensors are placed on the child's body so they can obtain information from the body inclination and muscle contraction, thus allowing commanding, through a wireless communication, the mobile entertainment robot to carry out tasks such as play with objects and draw. In this paper, the details of the robot design and control architecture are presented and discussed. With this system, disabled children get a better cognitive development and social interaction, balancing in a certain way, the negative effects of their disabilities. © 2012 IEEE.