User information violation acquisition detection method and related device

Abstract

The present disclosure discloses a user information violation acquisition detection method and related equipment. The user information violation acquisition detection method comprises: establishing a connection with a terminal device (step S102); obtaining the name of an application to be detected (step S104); injecting a monitoring code into the application to be detected of the terminal device, so as to use a Hook technology, make the application to be detected change the execution logic, and execute the monitoring code (step S106); when receiving the user information to be authorized which is acquired by the application to be detected without the user's permission based on the monitoring code, displaying the user information to be authorized to determine that the application to be detected violates the acquisition of the user information (step S108).

Description

Technical Field

[0001] This disclosure relates to the field of equipment security technology, and more specifically, to a method and related equipment for detecting unauthorized acquisition of user information. Background Technology

[0002] In recent years, with the rapid development of information technology and the widespread application of the Internet, more and more organizations are collecting and using large amounts of user information. While this brings convenience to people's lives, it has also led to problems such as the illegal collection, misuse, and leakage of user information (especially user privacy information), posing a serious threat to user information security. To address the security issues facing user information, it is necessary to regulate the relevant behaviors of user information controllers in the information processing stages, including collection, storage, use, sharing, transfer, and public disclosure, to avoid illegal and unauthorized collection, misuse, and leakage of user information, and to maximize the protection of users' legitimate rights and the public interest.

[0003] The information disclosed in the background section is only intended to enhance the understanding of the background of this disclosure, and therefore may include information that does not constitute prior art known to those skilled in the art. Summary of the Invention

[0004] This disclosure provides a method and related equipment for detecting the illegal acquisition of user information, which is used to detect whether an application (APP) installed on a terminal device has illegally acquired user information, thereby avoiding the illegal collection of user information.

[0005] Other features and advantages of this disclosure will become apparent from the following detailed description, or may be learned in part from practice of this disclosure.

[0006] According to one aspect of this disclosure, a method for detecting unauthorized acquisition of user information is provided, applied in a detection device, comprising: establishing a connection with a terminal device; obtaining the name of an application to be detected; injecting monitoring code into the application to be detected on the terminal device, using Hook technology to cause the application to be detected to change its execution logic to execute the monitoring code; and when receiving user information requiring authorization obtained by the application to be detected without user permission based on the monitoring code, displaying the user information requiring authorization to determine that the application to be detected has illegally acquired user information.

[0007] According to one embodiment of this disclosure, the circumstances without user permission include: after the application to be detected is initialized and before performing other operations based on user instructions, before displaying a privacy policy to the user but without detecting the user's consent instruction, before prompting the user to obtain user information permissions but without detecting the user's consent instruction, and after the user rejects the privacy policy or refuses to obtain the user information permissions.

[0008] According to one embodiment of this disclosure, establishing a connection with a terminal device includes: establishing a connection with the terminal device through a Frida client program installed in the detection device and a Frida server program installed in the terminal device.

[0009] According to one embodiment of this disclosure, injecting monitoring code into the application to be tested on the terminal device includes: when the application to be tested is an application that needs to run in the foreground of the terminal device, starting the application to be tested and injecting the monitoring code into the application to be tested.

[0010] According to one embodiment of this disclosure, injecting monitoring code into the application to be tested on the terminal device includes: when the application to be tested is a functional platform application that does not need to run in the foreground of the terminal device, injecting the monitoring code into the application to be tested that has already been launched.

[0011] According to one embodiment of this disclosure, the method further includes: displaying the API call information related to the received authorized user information.

[0012] According to another aspect of this disclosure, a user information illegal acquisition detection device is provided, applied in a detection device, comprising: a connection establishment module for establishing a connection with a terminal device; a name acquisition module for acquiring the name of an application to be detected; a code injection module for injecting monitoring code into the application to be detected on the terminal device, so as to use Hook technology to cause the application to be detected to change its execution logic to execute the monitoring code; and an illegal acquisition detection module for displaying the user information requiring authorization when it receives user information requiring authorization obtained by the application to be detected without user permission, based on the monitoring code, so as to determine that the application to be detected has illegally acquired user information.

[0013] According to another aspect of this disclosure, a system for detecting unauthorized acquisition of user information is provided, comprising: a detection device and a terminal device; wherein, the detection device is configured to establish a connection with the terminal, obtain the name of an application to be detected, and inject monitoring code into the application to be detected on the terminal device, using Hook technology to cause the application to be detected to change its execution logic to execute the monitoring code; the terminal device is configured to execute the monitoring code after the application to be detected is launched; when the monitoring code detects that the application to be detected has acquired user information requiring authorization without user permission, it sends the user information requiring authorization to the detection device; the detection device is further configured to display the user information requiring authorization upon receiving it, to determine that the application to be detected has illegally acquired user information.

[0014] According to another aspect of this disclosure, an electronic device is provided, comprising: a processor; and a memory for storing executable instructions of the processor; wherein the processor is configured to perform the above-described method for detecting unauthorized acquisition of user information by executing the executable instructions.

[0015] According to another aspect of this disclosure, a computer-readable storage medium is provided having a computer program stored thereon, which, when executed by a processor, implements the above-described method for detecting unauthorized acquisition of user information.

[0016] The user information illegal acquisition detection method provided in this disclosure establishes communication with a terminal device and injects monitoring code into the application to be tested running on the terminal device. This allows the use of Hook technology to modify the original execution logic of the application under test, enabling the monitoring code to monitor whether the application illegally calls APIs related to authorized user information functions without user permission. If the application is detected to have called APIs related to authorized user information functions without user permission, the illegally obtained user information is sent to the detection device. The detection device displays the authorized user information returned by the terminal device, allowing detection personnel to quickly determine whether the application under test has illegally collected authorized user information.

[0017] It should be understood that the above general description and the following detailed description are merely exemplary and do not limit this disclosure. Attached Figure Description

[0018] The above and other objects, features and advantages of this disclosure will become more apparent from a detailed description of exemplary embodiments thereof with reference to the accompanying drawings.

[0019] Figure 1This is a schematic diagram of the structure of a user information illegal acquisition detection system according to an exemplary embodiment.

[0020] Figure 2 This is a flowchart illustrating a method for detecting unauthorized acquisition of user information according to an exemplary embodiment.

[0021] Figure 3 This diagram illustrates the structure of a user information illegal acquisition detection device according to an embodiment of the present disclosure.

[0022] Figure 4 A schematic diagram of the structure of an electronic device according to an embodiment of the present disclosure is shown.

[0023] Figure 5 A schematic diagram of a computer-readable storage medium is shown in an embodiment of the present disclosure. Detailed Implementation

[0024] Exemplary embodiments will now be described more fully with reference to the accompanying drawings. However, these exemplary embodiments can be implemented in many forms and should not be construed as limited to the examples set forth herein; rather, they are provided so that this disclosure will be more comprehensive and complete, and will fully convey the concept of the exemplary embodiments to those skilled in the art. The described features, structures, or characteristics may be combined in any suitable manner in one or more embodiments.

[0025] Furthermore, the accompanying drawings are merely illustrative of this disclosure and are not necessarily drawn to scale. The same reference numerals in the drawings denote the same or similar parts, and therefore repeated descriptions of them will be omitted. Some block diagrams shown in the drawings are functional entities and do not necessarily correspond to physically or logically independent entities. These functional entities may be implemented in software, in one or more hardware modules or integrated circuits, or in different network and / or processor devices and / or microcontroller devices.

[0026] Furthermore, in the description of this disclosure, "multiple" means at least two, such as two, three, etc., unless otherwise explicitly specified. "And / or" describes the relationship between related objects, indicating that three relationships can exist, such as A and / or B, which can represent the existence of A alone, the existence of B alone, or the simultaneous existence of A and B. The symbol " / " generally indicates that the preceding and following related objects are in an "or" relationship. The terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Thus, a feature specified as "first" or "second" may explicitly or implicitly include one or more of that feature.

[0027] User information refers to various information recorded electronically or otherwise that can, alone or in combination with other information, identify a specific natural person or reflect the activities of a specific natural person, such as name, date of birth, ID number, personal biometric information, address, contact information, communication records and content, account passwords, property information, credit information, whereabouts, accommodation information, health and physiological information, and transaction information. Among these, user privacy information refers to user information that, if leaked, illegally provided, or misused, may endanger personal and property safety, and is highly likely to cause damage to personal reputation, mental and physical health, or discriminatory treatment.

[0028] Currently, privacy leaks in terminal devices mainly involve two aspects: the unauthorized acquisition of user privacy information and the unauthorized transmission of user privacy information.

[0029] In related technologies, application privacy leakage detection technologies for terminal devices can be divided into two types based on whether the application being detected is running: dynamic detection and static detection.

[0030] Static analysis, or static indexing, is performed before the application runs. It doesn't run the application itself, but rather analyzes the application's source code syntax, structure, and processes to detect privacy breaches, including unauthorized reading and / or disclosure of user information. For example, it performs structural analysis, control flow graph analysis, and symbolic execution on the source code to look for problems. While static indexing is fast, its drawbacks include the possibility of false positives, the inability to perform real-time dynamic analysis, and the inability to detect specific, detailed scenarios, such as whether the application illegally obtains user information before the user agrees to a privacy policy.

[0031] Dynamic detection technology detects whether an application has illegally obtained or / or disclosed user privacy information during its runtime. For example, it can detect whether there are any violations of privacy information acquisition and / or disclosure by detecting the data stored in the local database generated by the application during operation. However, this dynamic detection method is also prone to false positives or false negatives, and it is time-consuming and labor-intensive, unable to achieve the effect of real-time dynamic analysis.

[0032] In addition, the application privacy leakage detection tools used in related technologies mainly perform detection from the perspective of vulnerability detection or malicious code analysis.

[0033] For example, decompilation tools can be used to crack and reverse analyze the source code of an application to detect whether the application has problems such as privacy information leakage or acquisition of sensitive permissions. However, this method usually requires manual auditing and cannot achieve automated detection.

[0034] Alternatively, automated static analysis combined with simple dynamic analysis can be used to audit applications for issues such as storing and / or transmitting sensitive information in plaintext, obtaining file and / or component permissions, leaking log information, and denial-of-service attacks. However, since static analysis primarily relies on keyword matching, if contextual analysis and reachability analysis are lacking, and the developer happens to have defined a function with the same keyword, or the vulnerable code is not called, false positives will occur. Furthermore, taking the Android system as an example, Android application code and user interface (UI) interact closely. If the dynamic analysis only performs simple installation and launch of the application and automatic random clicks, it cannot cover most of the application's interface and functions, thus failing to cover more application execution paths, generate valid business data, and easily lead to false positives.

[0035] Alternatively, academic and industrial techniques such as fuzzing, taint analysis, general unpacking, and automated UI traversal are beginning to be applied to vulnerability auditing of end-device applications. For example, taint analysis can be divided into static taint analysis and dynamic taint analysis. Static taint analysis does not require the application to be running. Taking FlowDroid as an example, the static taint analysis technique for applications mainly includes the following steps:

[0036] 1. Parse the application's AndroidManifest.xml, Layout configuration file, and related Dex bytecode, and generate a hypercall graph, also known as an inter-procedural control flow graph (ICFG), based on the pre-modeled Android LifeCycle Model;

[0037] 2. Based on the defined taint sources and sinks, transform the problem into a backward or forward data flow problem based on ICFG for solution;

[0038] 3. Based on the solution results, it answers whether there is a data flow path from a certain input to the output. Taking the explicit Intent question as an example, FlowDroid will detect the existence of a path from the Sink method that sends the Intent to the Source that finally receives the Intent.

[0039] Dynamic taint analysis, on the other hand, tracks the values ​​of variables, memory, and registers during application runtime, and follows the propagation of tainted data according to the execution flow to trace attack paths and obtain vulnerability information. Taking TaintDroid as an example, the Android system needs to be customized to track tainted data during application runtime. However, due to the performance bottlenecks of Android devices or emulators, dynamic taint analysis cannot obtain all possible executable paths of the application.

[0040] Previously, taint analysis was commonly used for Android malware analysis and information leakage detection. Now, more and more vendors are also applying it to application vulnerability detection (such as the TaintDroid-based solution used by Alibaba Cloud Security). Compared to traditional application vulnerability detection, taint analysis can track the propagation process of tainted data and determine whether vulnerabilities are likely to be triggered in a real-world environment, making its detection capabilities more powerful.

[0041] However, the aforementioned application privacy leakage detection tools mainly detect from the perspective of vulnerability and / or malicious code analysis. In contrast, this disclosure provides a method for detecting illegal acquisition of user information, which detects whether there is a problem of illegal acquisition of user information during the operation of an application from the perspective of whether the acquisition of privacy information is compliant.

[0042] The exemplary embodiments of this disclosure will now be described in detail with reference to the accompanying drawings and examples.

[0043] Figure 1 This is a schematic diagram illustrating the structure of a user information illegal acquisition detection system according to an exemplary embodiment. Figure 1 As shown, the user information illegal acquisition detection system 1 includes: terminal device 11 and detection device 12.

[0044] Terminal device 11 may be a smartphone, game console, tablet computer, e-book reader, smart glasses, MP4 (Moving Picture Experts Group Audio Layer IV) player, smart home device, AR (Augmented Reality) device, VR (Virtual Reality) device, or other mobile terminal device; or terminal device 12 may be a personal computer (PC), such as a laptop computer or desktop computer, etc.

[0045] The terminal device 11 contains the application to be tested.

[0046] The terminal device 11 and the detection device 12 are connected via a communication network. Optionally, the communication network can be a wired network or a wireless network.

[0047] The detection device 12 can be, for example, a personal computer, a server, a server cluster consisting of several servers, or a virtualization platform. The detection device 12 is used to detect whether user information has been illegally obtained from the application to be tested installed on the terminal device 11.

[0048] Optionally, the aforementioned wireless or wired networks use standard communication technologies and / or protocols. The network is typically the Internet, but can also be any network, including but not limited to Local Area Networks (LANs), Metropolitan Area Networks (MANs), Wide Area Networks (WANs), mobile, wired or wireless networks, private networks, or any combination of virtual private networks. In some embodiments, technologies and / or formats including Hyper Text Markup Language (HTML), Extensible Markup Language (XML), etc., are used to represent data exchanged over the network. Furthermore, conventional encryption technologies such as Secure Socket Layer (SSL), Transport Layer Security (TLS), Virtual Private Networks (VPNs), and Internet Protocol Security (IPsec) can be used to encrypt all or some links. In other embodiments, custom and / or dedicated data communication technologies can be used to replace or supplement the aforementioned data communication technologies.

[0049] Figure 2 This is a flowchart illustrating a method for detecting unauthorized acquisition of user information according to an exemplary embodiment. The user information unauthorized acquisition detection method 10 provided in this disclosure embodiment can be applied to... Figure 1 The detection is performed by the detection device 12.

[0050] In step S102, a connection is established with the terminal device.

[0051] For example, refer to Figure 1 The detection device 12 establishes a connection with the terminal device 11. As mentioned above, the detection device 12 and the terminal device 11 can establish a connection via wired or wireless means.

[0052] In some embodiments, the detection device 12 and the terminal device 11 can establish a connection, for example, based on the Frida framework. Frida is a Python + JavaScript-based hook framework that can run on multiple platforms such as Android, iOS, Linux, and Windows, and primarily uses dynamic binary instrumentation technology. Frida is a lightweight SO (SharedObject) level hook framework that can help reverse engineers analyze the SO modules of a specified process. It mainly provides a simple Python interface and a feature-rich JavaScript interface, allowing the hook function to modify the SO programmatically. The Frida framework includes a Frida-server and a Frida-client. To establish a connection between the detection device 12 and the terminal device 11, the Frida-client program can be installed on the detection device 12, and the Frida-server program can be installed on the terminal device 11, thereby enabling communication between the two devices.

[0053] In step S104, the name of the application to be detected is obtained.

[0054] For example, the abd tool can be installed on testing device 12. abd is an Android Debug Bridge tool. It provides a command-line window for interacting with terminal device 11 via testing device 12. The tester can input the name (packagename) of the application to be tested using the abd tool. The packagename is unique to each application and is defined by the application's developer. The tester can then retrieve the name of the application to be tested input via the abd tool.

[0055] In step S106, monitoring code is injected into the application to be tested on the terminal device to use Hook technology to make the application to be tested change its execution logic to execute the monitoring code.

[0056] In some embodiments, monitoring code can be injected into the application under test on the terminal device, for example, through a custom Python script. Python is a cross-platform computer programming language, an object-oriented, dynamically typed language, originally designed for writing automation scripts (shell). With continuous updates and the addition of new features, it is increasingly used for independent, large-scale project development. A Python script can be predefined, for example, named `trace_app.py`. This script is mainly used to launch the application under test and inject monitoring code into the terminal device. The `trace_app.py` script can use one of the parameters "-load" to inject monitoring code. `trace_app.py` will call Frida to inject the monitoring code into the memory space of the specified application under test, thereby achieving the purpose of overriding and hooking the Java methods of the application under test.

[0057] Hook technology, also known as hook function, involves the hook program capturing the message before the system calls the application's function. The hook function gains control first, and can then process (change) the function's execution behavior or forcibly terminate message delivery.

[0058] In some embodiments, the Python script `trace_app.py` can provide two injection methods, depending on whether the application to be detected is an application that needs to run in the foreground of the terminal device. Applications that need to run in the foreground are those that will run in the foreground after the application is launched. Applications that do not need to run in the foreground include functional platform applications such as the system desktop. These applications mainly provide basic operation, utility, and framework functions and are not part of the user's interaction with the terminal device. When the application to be detected is an application that needs to run in the foreground, the first injection method is used to launch the application and inject the monitoring code into it. When the application to be detected is a functional platform application that does not need to run in the foreground, the second injection method is used to directly inject the monitoring code into the already launched application. Typically, functional platform applications run continuously after the terminal device is powered on, so the monitoring code can be directly injected into the already launched application.

[0059] In some embodiments, monitoring code may be stored in JavaScript (JS) scripts. JavaScript (JS for short) is a lightweight, interpreted or just-in-time compiled programming language with a function-first approach. Monitoring code stored in JS scripts primarily defines the relevant hook points, that is, the calls to APIs (Application Programming Interfaces) of relevant user information functions that require authorization. An API is a set of predefined functions, or a set of conventions for connecting different components of a software system. Its purpose is to provide applications and developers with the ability to access a set of routines based on certain software or hardware, without needing to access the source code or understand the details of the internal workings.

[0060] In step S108, when the user information to be detected, which is obtained without the user's permission, is received based on the monitoring code, the user information to be detected is displayed to determine that the user information to be detected has been illegally obtained.

[0061] Authorized user information may include, for example, hardware serial number, device MAC address, software list, unique device identifier (such as IMEI (International Mobile Equipment Identity), Android ID, IDFA (Identifier For Advertising), OPENUDID (Open Unique Device Identifier), GUID (Globally Unique Identifier), SIM (Subscriber Identity Module) card IMSI (International Mobile Subscriber Identity) information), and sensitive personal information (phone number, email address, location information), etc.

[0062] After the monitoring code is injected into the terminal device, it alters the original execution order of the application under test using Hook technology. Therefore, the monitoring code can monitor whether the application under test calls APIs related to user information without the user's permission. If so, the monitoring code sends the user information obtained by the application under test without authorization to the detection device.

[0063] After receiving the aforementioned user information requiring authorization from the terminal device based on the monitoring code, the detection device displays the user information in the detection device. Since the monitoring code only obtains the user information obtained by the application under test when it detects that the application under test has illegally called the API related to the user information requiring authorization, when the detection device receives the user information requiring authorization returned by the terminal device, it can determine that the application under test has illegally obtained user information. Alternatively, the detection personnel can further determine whether the application under test has illegally obtained user information, such as further confirming whether the user information requiring authorization is indeed the user information requiring authorization.

[0064] Furthermore, in some embodiments, the detection device can further display API call information related to the received authorized user information. For example, depending on the analysis purpose, the detection device can display the type of authorized user information, the Java class, method, call stack, etc. (i.e., the parameter information of the API function that hooks the authorized user information) to facilitate analysts in accurately locating the code that obtains the authorized user information and pinpointing the problematic code.

[0065] The aforementioned "without user permission" scenarios may include, for example, the instant the application under test is launched, i.e., the time after the application under test is initialized and before performing other operations based on user instructions; or it may include the terminal device displaying a privacy policy to the user through the user interface but before detecting the user's consent instruction, such as detecting the user clicking the "agree" button (e.g., a virtual button in the user interface); or it may include prompting the user for permission to obtain user information but before detecting the user's consent instruction, for example, the application under test needs to obtain the user's location information and prompts the user (e.g., by displaying a message in the user interface) for permission to obtain location information, but before detecting the user clicking the "agree" button; or it may include after the user refuses the aforementioned privacy policy or refuses the aforementioned permission to obtain the aforementioned user information, i.e., illegally obtaining the user's authorized user information even without the user's consent.

[0066] The user information illegal acquisition detection method provided in this disclosure establishes communication with a terminal device and injects monitoring code into the application to be tested running on the terminal device. This allows the use of Hook technology to modify the original execution logic of the application under test, enabling the monitoring code to monitor whether the application illegally calls APIs related to authorized user information functions without user permission. If the application is detected to have called APIs related to authorized user information functions without user permission, the illegally obtained user information is sent to the detection device. The detection device displays the authorized user information returned by the terminal device, allowing detection personnel to quickly determine whether the application under test has illegally collected authorized user information.

[0067] The following are embodiments of the apparatus disclosed herein, which can be used to execute embodiments of the method disclosed herein. For details not disclosed in the apparatus embodiments of this disclosure, please refer to the embodiments of the method disclosed herein.

[0068] Figure 3 This diagram illustrates the structure of a user information illegal acquisition detection device according to an embodiment of the present disclosure.

[0069] like Figure 3 As shown, the user information illegal acquisition detection device 20 includes: a connection establishment module 202, a name acquisition module 204, a code injection module 206, and an illegal detection module 208.

[0070] The connection establishment module 202 is used to establish a connection with the terminal device.

[0071] The name acquisition module 204 is used to acquire the name of the application to be tested.

[0072] The code injection module 206 is used to inject monitoring code into the application to be detected on the terminal device, so as to use Hook technology to make the application to be detected change its execution logic to execute the monitoring code.

[0073] The violation detection module 208 is used to display the user information that requires authorization, obtained by the application under test without the user's permission, based on the monitoring code, in order to determine that the application under test has illegally obtained user information.

[0074] The user information illegal acquisition detection device provided in this disclosure establishes communication with a terminal device and injects monitoring code into the application to be detected running on the terminal device. This allows the use of Hook technology to modify the original execution logic of the application, enabling the monitoring code to detect whether the application illegally calls APIs related to functions requiring authorization for user information without user permission. If the application is detected to have called APIs related to functions requiring authorization for user information without user permission, the illegally obtained user information is sent to the detection device. The detection device displays the user information returned by the terminal device, allowing detection personnel to quickly determine whether the application has illegally collected authorized user information.

[0075] In some embodiments, the circumstances under which the user has not given permission include: after the application to be detected is initialized and before performing other operations based on user instructions, before displaying the privacy policy to the user but before detecting the user's consent instruction, before prompting the user to obtain user information permissions but before detecting the user's consent instruction, and after the user rejects the privacy policy or refuses to obtain the user information permissions.

[0076] In some embodiments, the connection establishment module 202 is used to establish a connection with the terminal device through the Frida client program installed in the detection device and the Frida server program installed in the terminal device.

[0077] In some embodiments, the code injection module 206 is used to launch the application to be detected and inject the monitoring code into the application to be detected when the application to be detected is an application that needs to run in the foreground of the terminal device.

[0078] In some embodiments, the code injection module 206 is used to inject the monitoring code into the application to be detected, which has already been launched, when the application to be detected is a functional platform application that does not need to run in the foreground of the terminal device.

[0079] In some embodiments, the system further includes an information display module for displaying API call information related to the received authorized user information.

[0080] like Figure 1 As shown in the figure, this disclosure also provides a user information illegal acquisition detection system, including a terminal device 11 and a detection device 12.

[0081] The detection device 12 is used to establish a connection with the terminal, obtain the name of the application to be detected, and inject monitoring code into the application to be detected on the terminal device, so as to use Hook technology to make the application to be detected change its execution logic to execute the monitoring code.

[0082] The terminal device 11 is used to execute the monitoring code after the application to be detected is launched; when the monitoring code detects that the application to be detected has obtained the user information that needs to be authorized without the user's permission, it sends the user information that needs to be authorized to the detection device.

[0083] The detection device 12 is also used to display the user information to be authorized when it receives the user information to be authorized, so as to determine that the application to be detected has illegally obtained user information.

[0084] In some embodiments, a Frida server program is installed on the terminal device 11 and a Frida client program is installed on the detection device 12, thereby establishing a connection between the terminal device 11 and the detection device 12 through the Frida framework.

[0085] In some embodiments, the detection device 12 is used to launch the application to be detected and inject the monitoring code into the application to be detected when the application to be detected is an application that needs to run in the foreground of the terminal device.

[0086] In some embodiments, the detection device 12 is used to inject the monitoring code into the application to be detected, which has already been launched, when the application to be detected is a functional platform application that does not need to run in the foreground of the terminal device.

[0087] In some embodiments, the detection device 12 is also used to display API call information related to the received authorized user information.

[0088] Those skilled in the art will understand that various aspects of this disclosure can be implemented as a system, method, or program product. Therefore, various aspects of this disclosure can be specifically implemented in the following forms: a completely hardware implementation, a completely software implementation (including firmware, microcode, etc.), or a combination of hardware and software aspects, collectively referred to herein as a "circuit," "module," or "system."

[0089] The following reference Figure 4 To describe an electronic device 800 according to such an embodiment of the present disclosure. Figure 4 The electronic device 800 shown is merely an example and should not impose any limitation on the functionality and scope of use of the embodiments disclosed herein.

[0090] like Figure 4 As shown, the electronic device 800 is manifested in the form of a general-purpose computing device. The components of the electronic device 800 may include, but are not limited to: at least one processing unit 810, at least one storage unit 820, and a bus 830 connecting different system components (including storage unit 820 and processing unit 810).

[0091] The storage unit stores program code that can be executed by the processing unit 810, causing the processing unit 810 to perform the steps described in the "Exemplary Methods" section of this specification according to various exemplary embodiments of this disclosure. For example, the processing unit 810 can perform actions such as... Figure 2 In step S102, a connection is established with the terminal device; in step S104, the name of the application to be tested is obtained; in step S106, monitoring code is injected into the application to be tested on the terminal device to use Hook technology to make the application to be tested change its execution logic to execute the monitoring code; in step S108, when the application to be tested receives user information that requires authorization and is obtained without the user's permission based on the monitoring code, it is determined that the application to be tested has illegally obtained user information.

[0092] Storage unit 820 may include a readable medium in the form of a volatile storage unit, such as random access memory (RAM) 8201 and / or cache memory 8202, and may further include a read-only memory (ROM) 8203.

[0093] The storage unit 820 may also include a program / utility 8204 having a set (at least one) of program modules 8205, including but not limited to: an operating system, one or more application programs, other program modules, and program data, each or some combination of these examples may include an implementation of a network environment.

[0094] Bus 830 can represent one or more of several types of bus structures, including a memory cell bus or memory cell controller, a peripheral bus, a graphics acceleration port, a processing unit, or a local bus using any of the various bus structures.

[0095] Electronic device 800 can also communicate with one or more external devices 700 (e.g., keyboard, pointing device, Bluetooth device, etc.), and with one or more devices that enable a user to interact with electronic device 800, and / or with any device that enables electronic device 800 to communicate with one or more other computing devices (e.g., router, modem, etc.). This communication can be performed via input / output (I / O) interface 850. Furthermore, electronic device 800 can also communicate with one or more networks (e.g., local area network (LAN), wide area network (WAN), and / or public networks, such as the Internet) via network adapter 860. As shown, network adapter 860 communicates with other modules of electronic device 800 via bus 830. It should be understood that, although not shown in the figures, other hardware and / or software modules can be used in conjunction with electronic device 800, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0096] From the above description of the embodiments, those skilled in the art will readily understand that the exemplary embodiments described herein can be implemented by software or by combining software with necessary hardware. Therefore, the technical solutions according to the embodiments of this disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (such as a CD-ROM, USB flash drive, external hard drive, etc.) or on a network, including several instructions to cause a computing device (such as a personal computer, server, terminal device, or network device, etc.) to execute the methods according to the embodiments of this disclosure.

[0097] In exemplary embodiments of this disclosure, a computer-readable storage medium is also provided, on which a program product capable of implementing the methods described above is stored. In some possible implementations, various aspects of this disclosure may also be implemented as a program product including program code that, when the program product is run on a terminal device, causes the terminal device to perform the steps of the various exemplary embodiments of this disclosure described in the "Exemplary Methods" section above.

[0098] refer to Figure 5 As shown, a program product 900 for implementing the above-described method according to an embodiment of the present disclosure is described. This product may employ a portable compact disc read-only memory (CD-ROM) and include program code, and may run on a terminal device, such as a personal computer. However, the program product of the present disclosure is not limited thereto. In this document, the readable storage medium may be any tangible medium containing or storing a program that may be used by or in conjunction with an instruction execution system, apparatus, or device.

[0099] The program product may employ any combination of one or more readable media. A readable medium may be a readable signal medium or a readable storage medium. A readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of readable storage media (a non-exhaustive list) include: an electrical connection having one or more wires, a portable disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof.

[0100] Computer-readable signal media may include data signals propagated in baseband or as part of a carrier wave, carrying readable program code. Such propagated data signals may take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. A readable signal medium may also be any readable medium other than a readable storage medium, capable of sending, propagating, or transmitting programs for use by or in conjunction with an instruction execution system, apparatus, or device.

[0101] The program code contained on the readable medium may be transmitted using any suitable medium, including but not limited to wireless, wired, optical fiber, RF, etc., or any suitable combination thereof.

[0102] Program code for performing the operations of this disclosure can be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java and C++, and conventional procedural programming languages ​​such as C or similar languages. The program code can execute entirely on the user's computing device, partially on the user's computing device, as a standalone software package, partially on the user's computing device and partially on a remote computing device, or entirely on a remote computing device or server. In cases involving remote computing devices, the remote computing device can be connected to the user's computing device via any type of network, including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0103] It should be noted that although several modules or units for the device used to perform actions have been mentioned in the detailed description above, this division is not mandatory. In fact, according to embodiments of this disclosure, the features and functions of two or more modules or units described above can be embodied in one module or unit. Conversely, the features and functions of one module or unit described above can be further divided and embodied by multiple modules or units.

[0104] Other embodiments of this disclosure will readily occur to those skilled in the art upon consideration of the specification and practice of the invention disclosed herein. This disclosure is intended to cover any variations, uses, or adaptations of this disclosure that follow the general principles of this disclosure and include common knowledge or customary techniques in the art not disclosed herein. The specification and examples are to be considered exemplary only, and the true scope and spirit of this disclosure are indicated by the appended claims.

Claims

1. A method for detecting unauthorized acquisition of user information, applied in a detection device, characterized in that, include: Establish a connection with the terminal device; Get the name of the application to be tested; The monitoring code is injected into the application to be tested on the terminal device to use hook technology to hook the Java methods of the application to be tested, so that the application to be tested changes its execution logic to execute the monitoring code. as well as When the monitoring code receives user information that the application under test has obtained without the user's permission, the system displays the user information and the API call information involved in the user information to determine that the application under test has illegally obtained user information. The API call information includes the type of user information that requires authorization, the Java class, method and call stack for obtaining the user information that requires authorization. The situations where the user has not given permission include: after the application to be detected has been initialized and before any other operations are performed based on user instructions.

2. The method according to claim 1, characterized in that, The circumstances under which no user permission is required include: before displaying the privacy policy to the user without detecting the user's consent instruction, before prompting the user that permission to access user information is required without detecting the user's consent instruction, and after the user rejects the privacy policy or refuses to access the user information permission.

3. The method according to claim 1, characterized in that, Establishing a connection with the terminal device includes: establishing a connection with the terminal device through the Frida client program installed in the detection device and the Frida server program installed in the terminal device.

4. The method according to claim 3, characterized in that, Injecting monitoring code into the application to be tested on the terminal device includes: when the application to be tested is an application that needs to run in the foreground on the terminal device, starting the application to be tested and injecting the monitoring code into the application to be tested.

5. The method according to claim 3, characterized in that, Injecting monitoring code into the application to be tested on the terminal device includes: when the application to be tested is a functional platform application that does not need to run in the foreground of the terminal device, injecting the monitoring code into the application to be tested that has already been launched.

6. A device for detecting unauthorized acquisition of user information, used in detection equipment, characterized in that, include: The connection establishment module is used to establish a connection with the terminal device; The name acquisition module is used to obtain the name of the application to be detected; The code injection module is used to inject monitoring code into the application to be detected on the terminal device, so as to use hook technology to hook the Java methods of the application to be detected, thereby causing the application to be detected to change its execution logic to execute the monitoring code. as well as The violation detection module is used to display the user information requiring authorization and the API call information involved in the user information when it receives user information that the application under test has obtained without the user's permission, which is obtained based on the monitoring code, in order to determine that the application under test has illegally obtained user information. The API call information includes the type of user information requiring authorization, the Java class, method and call stack for obtaining the user information requiring authorization. The situations where the user has not given permission include: after the application to be detected has been initialized and before any other operations are performed based on user instructions.

7. A system for detecting unauthorized acquisition of user information, characterized in that, include: Testing equipment and terminal equipment; The detection device is used to establish a connection with the terminal, obtain the name of the application to be detected, and inject monitoring code into the application to be detected on the terminal device. The monitoring code is then injected into the application to be detected using hook technology to hook the Java methods of the application to be detected, thereby changing the execution logic of the application to be detected and executing the monitoring code. The terminal device is used to execute the monitoring code after the application to be detected is launched; when the monitoring code detects that the application to be detected has obtained the user information that needs to be authorized without the user's permission, it sends the user information that needs to be authorized to the detection device. The detection device is also used to display the user information to be authorized and the API call information involved in the user information to be authorized when it receives the user information to be authorized, so as to determine that the application to be detected illegally obtains user information. The API call information includes the type of user information to be authorized, the Java class, method and call stack for obtaining the user information to be authorized; The situations where the user has not given permission include: after the application to be detected has been initialized and before any other operations are performed based on user instructions.

8. An electronic device, characterized in that, include: processor; as well as Memory for storing the executable instructions of the processor; The processor is configured to execute the method of any one of claims 1-5 by executing the executable instructions.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the method described in any one of claims 1-5.

Images