中文摘要：

为了保护用户的隐私数据,Android实现了一套基于权限的安全机制.为此设计了一种针对该机制的评估工具PrivacyMiner,以检测其在隐私保护方面的有效性.首先将Android系统中的隐私数据分为22个类别;然后使用动态检测与静态污点分析相结合的方法,来检测Android系统的安全机制是否能有效地保护它们.用PrivacyMiner工具对12个版本的Android源代码进行了检测,发现其中有7个类别的隐私数据并没有得到有效的保护,恶意软件可以在用户不知情的情况下读取这些隐私,并发送到任意服务器上.这些漏洞在6个Android设备上得到了验证,从Android2.1到最新发布的Android 4.4.2,均得到了Android安全团队的确认。

英文摘要：

To protect private data in smart phones, Android enforces a permission-based security policy. PrivacyMiner, a tool for evaluating the effectiveness of privacy protection in Android, was designed. First, 22 categories of private data in smart phones were identified, which were then checked to see if Android could efficiently protect them from malware. PrivacyMiner was applied to 12 revisions of Android source code, and it was found that 7 categories of private data were not well protected, as Malware can read them and send them out without any permission. These vulnerabilities were verified on 6 Android devices with 6 revisions of Android, from 2.1 up to 4. 4. 2. Our findings were confirmed by the Android Security Team from Google.