Research Areas

My research investigates access control in emerging and complex systems such as those found in mobile platforms, Internet of Things (IoT), networks, and cloud infrastructure. These investigations include studying the (1) need for access control through application analysis, (2) the correctness of access control enforcement and policy, and (3) the incorporation of new access control primitives.

Application and Text Analysis

My research uses static and dynamic analysis of software applications and their artifacts to better understand the need for and expressiveness of access control. Much of my application analysis research as focused on mobile platforms such as Android and iOS. As these platforms were emerging, my research built novel application analysis tools to explore the types of platform functionality being used by application developers. For example, my TaintDroid framework adds find-grained dynamic taint analysis to the Android platform. It is primarily used as a dynamic application analysis tool to discover privacy infringements and malicous functionality. TaintDroid enabled the first study that identified Android applications commonly leak geographic location information and phone identifiers to third-parties without the users knowledge. My research has also explored the need for access control through the novel use of natural language processing (NLP). For example, my Whyper framework was the first analysis tool to use NLP of the textual descriptions of applications in the Google Play Store. This work determines which, if any, of the sentences in the description suggest the need for the different permissions requested by the application. In doing so, Whyper helps bridge the gap between program analysis and end user expectations. Beyond mobile platforms, my research has also considered application analysis in the emerging domain of Internet of Things (IoT) security. For example, my HomeSnitch framework uses network-based instrumentation to determine the semantic behavior corresponding to network packets from IoT devices (e.g., heartbeat, firmware check, motion detected). In doing so, HomeSnitch provides a foundation to enabled transparency and enhanced protection for smart homes.

  1. Benjamin Andow, Samin Yaseer Mahmud, Wenyu Wang, Justin Whitaker, William Enck, Bradley Reaves, Kapil Singh, and Tao Xie, PolicyLint: Investigating Internal Privacy Policy Contradictions on Google Play, in Proceedings of the USENIX Security Symposium, Santa Clara, CA, 2019, pp. 585–602.
    [PDF] (acceptance rate=16%)
  2. TJ OConnor, Reham Mohamed, Markus Miettinen, William Enck, Bradley Reaves, and Ahmad-Reza Sadeghi, HomeSnitch: Behavior Transparency and Control for Smart Home IoT Devices, in Proceedings of the ACM Conference on Security and Privacy in Wireless and Mobile Networks (WiSec), Miami, FL, 2019, pp. 128–138.
    [PDF] (acceptance rate=25.6%)
  3. TJ OConnor, William Enck, and Bradley Reaves, Blinded and Confused: Uncovering Systemic Flaws in Device Telemetry for Smart-Home Internet of Things, in Proceedings of the ACM Conference on Security and Privacy in Wireless and Mobile Networks (WiSec), Miami, FL, 2019, pp. 140–150. (best paper).
    [PDF] (acceptance rate=25.6%)
  4. Benjamin Andow, Akhil Acharya, Dengfeng Li, William Enck, Kapil Singh, and Tao Xie, UiRef: Analysis of Sensitive User Inputs in Android Applications, in Proceedings of the ACM Conference on Security and Privacy in Wireless and Mobile Networks (WiSec), 2017.
    [PDF] (acceptance rate=22.3%)
  5. Benjamin Andow, Adwait Nadkarni, Blake Bassett, William Enck, and Tao Xie, A Study of Grayware on Google Play, in Proceedings of the IEEE Mobile Security Technologies workshop (MoST), 2016.
    (acceptance rate=28.6%)
  6. Wei Yang, Xusheng Xiao, Benjamin Andow, Sihan Li, Tao Xie, and William Enck, AppContext: Differentiating Malicious and Benign Mobile App Behaviors Using Context, in Proceedings of the International Conference on Software Engineering (ICSE), Firenze, Italy, 2015.
    [PDF] (acceptance rate=18.5%)
  7. Tsung-Hsuan Ho, Daniel Dean, Xiaohui Gu, and William Enck, PREC: Practical Root Exploit Containment for Android Devices, in Proceedings of the ACM Conference on Data and Application Security and Privacy (CODASPY), San Antonio, TX, 2014.
    [PDF] (acceptance rate=16.0%) (supercedes TR-2012-12)
  8. Rahul Pandita, Xusheng Xiao, Wei Yang, William Enck, and Tao Xie, WHYPER: Towards Automating Risk Assessment of Mobile Applications, in Proceedings of the USENIX Security Symposium, Washington, D.C., 2013.
    [PDF] (acceptance rate=16.2%)
  9. Saurabh Chakradeo, Brad Reaves, Patrick Traynor, and William Enck, MAST: Triage for Market-scale Mobile Malware Analysis, in Proceedings of the ACM Conference on Security and Privacy in Wireless and Mobile Networks (WiSec), Budapest, Hungary, 2013. (best paper).
    [PDF] (acceptance rate=15.1%)
  10. Vaibhav Rastogi, Yan Chen, and William Enck, AppsPlayground: Automatic Large-scale Dynamic Analysis of Android Applications, in Proceedings of the ACM Conference on Data and Application Security and Privacy (CODASPY), San Antonio, TX, 2013.
    [PDF] (acceptance rate=23.1%)
  11. William Enck, Damien Octeau, Patrick McDaniel, and Swarat Chaudhuri, A Study of Android Application Security, in Proceedings of the 20th USENIX Security Symposium, San Francisco, CA, 2011.
    [PDF] (acceptance rate=17.2%) (supercedes NAS-0144)
  12. William Enck, Peter Gilbert, Byung-Gon Chun, Landon P. Cox, Jaeyeon Jung, Patrick McDaniel, and Anmol N. Sheth, TaintDroid: An Information-Flow Tracking System for Realtime Privacy Monitoring on Smartphones, in Proceedings of the 9th USENIX Symposium on Operating Systems Design and Implementation (OSDI), Vancouver, BC, 2010.
    [PDF] (acceptance rate=16.1%) (supercedes NAS-0120)

Correctness of Enforcement and Policy

My research studies the correctness of access control enforcement by analysing both code and policy. Much of my research on this topic has focused on mobile platforms such as Android and iOS. Android and iOS have fundamentally changed access control for commodity computing. Most significantly, these platforms have changed the underlying security principal from the user to the application. This change was primarily necessitated by the introduction of feature-rich runtime environments where not all applications should be trusted with the user’s authority. The corresponding new burden on the operating system access control was significant, leading to the incorporation of over a hundred new permissions. Frequently, system daemons must have hard-coded checks to ensure the accessing application has sufficient privilege.

I have studied the correctness of these access control policy in both Android and iOS. For Android, my research has created a collection of static program analysis tools for investigating the Android middleware. It has uncovered dozens of missing or incorrect access control checks that have been reported to Google. For iOS, my research has reverse engineered and formally modeled the different mandatory and discretionary access control policies. It has uncovered many flaws in the policy that have been addressed by Apple.

  1. Luke Deshotels, Costin Carabas, Jordan Beichler, Razvan Deaconescu, and William Enck, Kobold: Evaluating Decentralized Access Control for Remote NSXPC Methods on iOS, in Proceedings of the IEEE Symposium on Security and Privacy (S&P), San Francisco, CA, 2020, pp. 1056–1070.
    [PDF] (acceptance rate=12.3%)
  2. Sigmund Albert Gorski III and William Enck, ARF: Identifying Re-Delegation Vulnerabilities in Android System Services, in Proceedings of the ACM Conference on Security and Privacy in Wireless and Mobile Networks (WiSec), Miami, FL, 2019, pp. 151–161.
    [PDF] (acceptance rate=25.6%)
  3. Sigmund Albert Gorski III, Benjamin Andow, Adwait Nadkarni, Sunil Manandhar, William Enck, Eric Bodden, and Alexandre Bartel, ACMiner: Extraction and Analysis of Authorization Checks in Android’s Middleware, in Proceedings of the ACM Conference on Data and Application Security and Privacy (CODASPY), Dallas, TX, 2019, pp. 25–36.
    [PDF] (acceptance rate=23.5%)
  4. Luke Deshotels, Razvan Deaconescu, Costin Carabas, Iulia Manda, William Enck, Mihai Chiroiu, Ninghui Li, and Ahmad-Reza Sadeghi, iOracle: Automated Evaluation of Access Control Policies in iOS, in Proceedings of the ACM Asia Conference on Computer and Communications Security (ASIACCS), Songdo, Incheon, Korea, 2018, pp. 117–131.
    [PDF] (acceptance rate=20.0%)
  5. Haining Chen, Ninghui Li, William Enck, Yousra Aafer, and Xiangyu Zhang, Analysis of SEAndroid Policies: Combining MAC and DAC in Android, in Proceedings of the Annual Computer Security Applications Conference (ACSAC), San Juan, Puerto Rico, USA, 2017.
    (acceptance rate=19.7%)
  6. Rui Shu, Xiaohui Gu, and William Enck, A Study of Security Vulnerabilities on Docker Hub, in Proceedings of the ACM Conference on Data and Application Security and Privacy (CODASPY), Scottsdale, Arizona, 2017.
    [PDF]
  7. Luke Deshotels, Razvan Deaconescu, Mihai Chiroiu, Lucas Davi, William Enck, and Ahmad-Reza Sadeghi, SandScout: Automatic Detection of Flaws in iOS Sandbox Profiles, in Proceedings of the ACM Conference on Computer and Communications Security (CCS), Vienna, Austria, 2016.
    [PDF] (acceptance rate=16.5%)
  8. Ruowen Wang, William Enck, Douglas Reeves, Xinwen Zhang, Peng Ning, Dingbang Xu, Wu Zhou, and Ahmed Azab, EASEAndroid: Automatic Policy Analysis and Refinement for Security Enhanced Android via Large-Scale Semi-Supervised Learning, in Proceedings of the USENIX Security Symposium, Washington, DC, 2015.
    [PDF] (acceptance rate=15.7%)

Discovered Vulnerabilities

iOS

Android

New Access Control Primitives

My research investigates new access control primitives for computing platforms. These primitives take different forms and are often motivated by observations made while analyzing applications. For example, my NativeWrap framework allows Android users with an alternative to over-permissioned applications and Web browsers with cross-site tracking. My HomeSnitch framework gives users enhanced control of smart home devices. I have also explored how information flow control (IFC) can be practically incorporated into systems to provide enhanced security guarantees. IFC controls not only which security principal can access information, but also what it may do with information once it has been accessed. My Aquifer and Weir frameworks have demonstrated how Android’s runtime environment is amenable to decentralized information flow control (DIFC) in ways that traditional platforms are not. My PivotWall framework uses Software Defined Networking (SDN) to extend IFC from hosts into an enterprise network environment.

  1. Sanket Goutam, William Enck, and Bradley Reaves, Hestia: Simple Least Privilege Network Policies for Smart Homes, in Proceedings of the ACM Conference on Security and Privacy in Wireless and Mobile Networks (WiSec), Miami, FL, 2019, pp. 215–220. (short paper).
    [PDF] (acceptance rate=32.2%)
  2. Reham Mohamed, Terrence O’Connor, Markus Miettinen, William Enck, and Ahmad-Reza Sadeghi, HONEYSCOPE: IoT Device Protection with Deceptive Network Views, in Autonomous Cyber Deception: Reasoning, Adaptive Planning, and Evaluation of HoneyThings, E. Al-Shaer, J. Wei, K. W. Hamlen, and C. Wang, Eds. Springer, 2019.
    [PDF]
  3. TJ OConnor, William Enck, W. Michael Petullo, and Akash Verma, PivotWall: SDN-Based Information Flow Control, in Proceedings of the ACM Symposium on SDN Research (SOSR), Los Angeles, CA, 2018, pp. 1–14.
    [PDF] (acceptance rate=28.6%)
  4. Ruowen Wang, Ahmed M. Azab, William Enck, Ninghui Li, Peng Ning, Xun Chen, Wenbo Shen, and Yueqiang Cheng, SPOKE: Scalable Knowledge Collection and Attack Surface Analysis of Access Control Policy for Security Enhanced Android, in Proceedings of the ACM Asia Conference on Computer and Communications Security (ASIACCS), 2017. (distinguished paper).
    [PDF] (acceptance rate=18.7%)
  5. Adwait Nadkarni, Benjamin Andow, William Enck, and Somesh Jha, Practical DIFC Enforcement on Android, in Proceedings of the USENIX Security Symposium, Austin, TX, 2016.
    [PDF] (acceptance rate=15.6%)
  6. Stephan Heuser, Adwait Nadkarni, William Enck, and Ahmad-Reza Sadeghi, ASM: A Programmable Interface for Extending Android Security, in Proceedings of the USENIX Security Symposium, San Diego, CA, 2014.
    [PDF] (acceptance rate=19.1%) (supercedes TUD-CS-2014-0063)
  7. Adwait Nadkarni, Vasant Tendulkar, and William Enck, NativeWrap: Ad Hoc Smartphone Application Creation for End Users, in Proceedings of the ACM Conference on Security and Privacy in Wireless and Mobile Networks (WiSec), Oxford, United Kingdom, 2014.
    [PDF] (acceptance rate=26.0%)
  8. Adwait Nadkarni and William Enck, Preventing Accidental Data Disclosure in Modern Operating Systems, in Proceedings of the 20th ACM Conference on Computer and Communications Security (CCS), Berlin, Germany, 2013.
    [PDF] (acceptance rate=19.8%)
  9. Machigar Ongtang, Stephen McLaughlin, William Enck, and Patrick McDaniel, Semantically Rich Application-Centric Security in Android, in Proceedings of the 25th Annual Computer Security Applications Conference (ACSAC), Honolulu, HI, 2009. (best paper).
    [PDF] (acceptance rate=19.0%) (supercedes NAS-00116)
  10. William Enck, Machigar Ongtang, and Patrick McDaniel, On Lightweight Mobile Phone Application Certification, in Proceedings of the 16th ACM Conference on Computer and Communications Security (CCS), Chicago, IL, 2009.
    [PDF] (acceptance rate=18.4%) (supercedes NAS-00113)
  11. William Enck, Patrick McDaniel, and Trent Jaeger, PinUP: Pinning User Files to Known Applications, in Proceedings of the 24th Annual Computer Security Applications Conference (ACSAC), Anaheim, CA, 2008.
    [PDF] (acceptance rate=24.3%) (supercedes NAS-0063)