PaperlayerView exact revision on arXiv

Source-linked AI summary

AdSplit: Separating smartphone advertising from applications

Shashi Shekhar, Michael Dietz, Dan S. Wallach

arXiv:1202.4030v1cs.OS

TL;DR

Embedded smartphone advertisements create permission bloat and let hostile host applications forge interactions. AdSplit separates advertisements into distinct processes and permission domains while authenticating client-side behavior. The study reports substantial advertising-only permission use and low runtime overhead, while acknowledging that hosts can still delegate permissions explicitly.

  • Problem

    Embedded advertising libraries add permissions to host applications and allow malicious hosts to forge advertisement interactions that advertisers cannot validate.

  • Method

    AdSplit extends Android to separate host applications and advertisements into processes with distinct user-ids and permissions, using authenticated UI-event mechanisms.

  • Results

    15% of Internet, 26% of coarse-location, and 47% of running-task permission requests are solely for advertising libraries, while touch throughput remains about 183 events per second.

  • Takeaways & Limitations

    AdSplit reduces advertising-related permission bloat and protects advertisers against forged interactions while maintaining marginal performance overhead.

  • Takeaways & Limitations

    AdSplit does not prevent a host application from explicitly delegating its granted permissions to an advertising library.

Abstract

from arXiv · show

A wide variety of smartphone applications today rely on third-party advertising services, which provide libraries that are linked into the hosting application. This situation is undesirable for both the application author and the advertiser. Advertising libraries require additional permissions, resulting in additional permission requests to users. Likewise, a malicious application could simulate the behavior of the advertising library, forging the user's interaction and effectively stealing money from the advertiser. This paper describes AdSplit, where we extended Android to allow an application and its advertising to run as separate processes, under separate user-ids, eliminating the need for applications to request permissions on behalf of their advertising libraries. We also leverage mechanisms from Quire to allow the remote server to validate the authenticity of client-side behavior. In this paper, we quantify the degree of permission bloat caused by advertising, with a study of thousands of downloaded apps. AdSplit automatically recompiles apps to extract their ad services, and we measure minimal runtime overhead. We also observe that most ad libraries just embed an HTML widget within and describe how AdSplit can be designed with this in mind to avoid any need for ads to have native code.

1 Introduction

Advertising-supported smartphone apps are widespread, but embedding ad libraries creates trust, privacy, permission, and reliability problems. AdSplit addresses these needs by separating advertisements from host applications with operating-system support.

  • Advertising-supported applications are expected to remain prominent, supported by a growing industry of smartphone advertising services.
  • Embedded advertising libraries prevent remote servers from validating legitimate user clicks, enabling malicious applications to forge interactions and steal advertising revenue.
  • Ad libraries can require Internet, location, and application-list permissions, causing otherwise low-permission applications to request additional privileges.
  • Separating advertisements from applications improves fault isolation, allowing the host application to continue if the ad system fails or slows.
  • The paper surveys thousands of Android applications, develops AdSplit, evaluates its performance, and presents binary rewriting for legacy applications.

2 App analysis

The app analysis measures advertising-library prevalence, permissions, and permission bloat across approximately 10,000 free Android applications. It finds substantial advertising-related permission use and motivates separating ads from host applications.

  • Approximately 10,000 free apps from the Android Market and Amazon App Store were downloaded and analyzed with purpose-built tools.
  • 35% of advertising-supported apps include two or more advertising libraries.
  • Different advertising libraries require different permission sets, and some permissions are optional for improving advertisement quality.
  • The permission analysis maps separated advertising-library API calls to required permissions after decompiling applications into dex format.
  • Permission-bloat estimates are strict lower bounds because the analysis may count permissions used only by speculative or dead code.
  • 15% of apps requesting Internet permissions, 26% requesting coarse location, and 47% requesting running-task access do so solely for advertising libraries.

3 Design objectives

AdSplit adapts web-ad isolation to smartphones by separating advertisements from host applications and adding mechanisms for screen sharing, lifecycle coordination, permission separation, and authenticated user input.

  • Unlike web pages with iframe isolation, Android lacks an equivalent same-origin policy, so AdSplit adds mechanisms to authenticate smartphone advertisement interactions.
  • AdSplit separates the host application from its advertisements to establish isolation between them.
  • AdSplit lets host activities specify which separate advertising libraries they use.
  • The design gives advertisements and host applications distinct permission sets and runs advertisements in separate isolated processes.
  • AdSplit manages advertisement lifecycles so ad processes run with the host application and can be killed when it is not running.
  • The system shares screen real estate and enables advertisements to validate displayed status and user input before sending unforgeable verification to a remote server.

4 Implementation

AdSplit extends Android so host and advertisement activities run separately while sharing the display and coordinating through an advertisement service. Its design isolates permissions, supports authenticated event delivery, and accommodates existing libraries through pairing and transformation mechanisms.

  • Architecture: AdSplit coordinates a host activity, advertisement activity, and advertisement service across distinct user-ids and permissions.The service delivers UI events, verifies advertisement display, and checks that clicks are not forged.
  • Screen sharing: The host and advertisement activities share the screen by layering the advertisement window beneath the host window’s transparent regions.This preserves the host interface while allowing the advertisement activity to verify that users can see the ads.
  • Advertisement pairing: AdSplit replaces in-process advertisement APIs with an AppFrame element and a local stub that forwards requests to the advertisement service.The mechanism creates a distinct advertisement activity while retaining an API compatible with the original arrangement.
  • Advertisement pairing: Separate advertisement applications are managed one-to-one with host applications because libraries such as AdMob expect one copy per process.The advertisement service maintains the mapping so each host communicates with the correct advertisement application.
  • Permission separation: Host applications no longer need to request permissions on behalf of their advertisement libraries because advertisements run as separate Android users with isolated permissions.AdSplit does not prevent hosts from explicitly delegating permissions to advertisements.
  • Click fraud: Quire mechanisms authenticate motion events by signing them at input, forwarding them through the host and advertisement service, and validating them before remote transmission.AdSplit provides a workable skeleton design that was implemented and benchmarked, although existing advertising libraries do not use Quire RPC by default.

5 Performance

AdSplit adds modest runtime costs while preserving responsive interaction and exploiting Android’s shared WebView memory. Its main measured trade-off is higher memory use when advertisements run in a separate process.

  • 5.1 Effect on UI responsiveness: 183 events/sec remains achievable with AdSplit, well above Android’s default 60-event/sec touch limit.The measured overhead comes from passing touch events and traversing the advertisement view hierarchy; CPU overhead was considered a non-issue.
  • 5.2 Memory and CPU overhead: About 16.5 MB is used when a host WebView and locally hosted AdMob coexist, demonstrating effective memory sharing.The comparison includes approximately 3.9 MB for a simple activity, 9 MB with a WebView, and 16.3 MB with AdMob alone.
  • 5.2 Memory and CPU overhead: 20.2 MB is used when AdMob runs separately without another host WebView, roughly 4 MB more than local hosting.With a separate host WebView, total memory rises to 24.4 MB, roughly an 8 MB increase over local AdMob hosting.
  • 5.2 Memory and CPU overhead: A separate AdSplit process incurs CPU overhead comparable to an additional Dalvik virtual machine and can run at lower priority.Because advertisement activities run in the background, they can be safely killed without affecting the host application.
  • 5.2 Memory and CPU overhead: Each additional view-hierarchy depth adds about 1 ms to layout-query overhead, expected to occur only once per click.These queries let the advertisement service inspect host layout information to prevent UI rearrangement attacks.
  • 5.2 Memory and CPU overhead: AdSplit’s additional memory and CPU costs are characterized as marginal and negligible in practice.The conclusion summarizes the measured responsiveness and resource-overhead results.

6 Separation for legacy apps

AdSplit can automatically rewrite legacy Android applications by extracting advertisement libraries and replacing them with service stubs. The proof of concept focuses on AdMob, while deployment raises installation, permission, and lifecycle challenges.

  • 6 Separation for legacy apps: A proof-of-concept rewriter removes embedded advertisement code, reduces unnecessary permission requests, and adapts apps to AdSplit.The authors suggest such rewriting could be deployed through an app store or directly on a smartphone.
  • 6 Separation for legacy apps: The rewriting process decompiles dex bytecode into smali, replaces advertisement packages with API-compatible stubs, and edits the manifest.It also analyzes permissions without the advertisement library and removes requests that are no longer necessary.
  • 6 Separation for legacy apps: The proof of concept targets AdMob, although the authors state that the techniques could generalize to other advertising libraries.The implementation manually supports a handful of public AdMob methods and communicates with the advertisement service through Android IPC.
  • 6 Separation for legacy apps: Commercial automated API translation would require significant testing because corner cases could produce incorrect behavior.The authors envision handwritten support, potentially supplied by vendors in collaboration with an app store.
  • 6 Separation for legacy apps: Separate advertisement applications introduce unresolved questions about installation, permission grants, and advertisement-process unloading.The paper specifically discusses dependency handling, optional permissions, and advertisements being killed while communicating with hosts.

7 Alternative design: HTML ads

AdSplit’s HTML-ad design uses a constrained WebView and separate execution context to simplify deployment while preserving advertising isolation and event validation. The implementation supports downloaded advertisements with indistinguishable memory and performance overhead from the comparable experiments.

  • Deployment: All examined advertising libraries include a WebView, with native Android code serving mainly as a wrapper around it.This observation motivates the HTML-focused design.
  • Deployment: AdSplit proposes a single core-distributed advertising application to serve typical vendors, with advertiser content limited to HTML, JavaScript, and images.This removes the need for vendor-specific native advertising applications.
  • Security model: HTML advertisements still run in a separate process and activity under a separate user-id, while Quire validates user events before they reach the WebView.Outbound WebView HTTP transactions are extended with Quire RPC signatures.
  • Security model: AdWebView hosts HTML ads in a constrained WebView with user-controlled permissions for Internet access and HTML5 geolocation.Permission checks occur when advertisements request URLs or geolocation access.
  • Policy boundary: AdWebView does not support persistent cookies by default, although adding them would be trivial.Whether HTML advertisements should retain long-term tracking cookies remains an open policy question.
  • Evaluation: Memory and performance overheads are indistinguishable from the AdMob experiments when both versions run the same HTML/JavaScript content in separate-process WebViews.The sample implementation successfully downloaded and ran advertisements from an advertisement server.

8 Policy

AdSplit introduces policy trade-offs around ad blocking, rooting, privacy, and advertising integrity. It may improve blocking resistance and isolate permissions, but it does not prevent hosts from passing sensitive information to advertisements.

  • Ad blocking: Broken ad-supported experiences can cause users to stop visiting websites, while publishers may deploy technical workarounds to bypass blockers.These responses illustrate the practical risks of ad-blocking conflicts.
  • Ad blocking: AdSplit may trigger smartphone ad-blocking efforts, potentially producing an arms race between blocking and ad-display technologies.The paper bases this expectation on the popularity of browser ad blockers.
  • Ad blocking: For most of the smartphone marketplace, Android advertising apps offer greater potential for blocking detection and resistance than web advertising.The authors therefore believe advertisers and application vendors would prefer AdSplit over the status quo.
  • Privacy: Advertisers must trade improved advertising integrity against access to additional privacy-violating user details.The paper connects AdSplit’s separation model with reduced access to host application privileges.

9 Related Work

AdSplit builds on browser isolation, JavaScript sandboxing, privacy-preserving advertising, Android permission controls, and information-flow systems. Its separation architecture complements rather than replaces mechanisms that control data flows or application privileges.

  • Web security: AdSplit applies controlled mashup ideas from web security, where advertisements can be isolated from hosting content in separate browser contexts.The paper relates this design to iframe isolation and restricted cross-frame interaction.
  • Web security: Caja and ADsafe sandbox JavaScript by restricting dangerous primitives and exposing limited APIs; AdSplit can host advertisements built for these systems.The paper notes that evolving sandbox APIs could be directly supported.
  • Privacy: Privad and related work address privacy and targeted-advertising concerns by preventing behavioral profiling while enabling targeted advertisements.AdSplit itself does not address these privacy problems.
  • Android security: Android permission-policy systems such as Kirin, Saint, Apex, and CRePE enforce install-time or runtime restrictions, but differ in the attacks and policy decisions they address.The cited systems primarily regulate application permissions and contextual constraints.
  • Android security: XManDroid restricts risky inter-application communication, while kernel, taint-analysis, and related systems centralize or track information-flow policies.These approaches target privilege escalation, leakage, or runtime policy enforcement.
  • Complementarity: TaintDroid and ParanoidAndroid are complementary because AdSplit separates advertisements but still permits applications to pass sensitive information to them.AdSplit does not require Quire’s IPC inspection system or its associated recompilation semantics.

10 Future Work

The paper places AdSplit within a broader convergence of HTML and smartphone application security. It identifies increasing HTML functionality and embedded web content as drivers of future security questions, while leaving the eventual app model unresolved.

  • Security convergence: HTML is evolving from a uniform web security model toward page-specific permissions, including user-granted access to location information.This development parallels the paper’s interest in combining HTML and smartphone application security.
  • Platform security: Android restricts application permissions more strongly than the original iOS model, yet Android malware remains a growing problem, especially through third-party app stores.The paper argues that more restrictive Android security is needed.
  • Application models: Many smartphone applications use native code to establish WebViews and implement the remainder in HTML and JavaScript, easing support across platforms.The paper presents embedded web content as evidence that the two application models are already converging.
  • Application models: Increasing HTML5 functionality could lead native applications to be supplanted by a mobile-HTML model in which apps are built this way.The paper presents this as a possibility rather than a settled outcome.
  • Future questions: The convergence raises open security questions about safely connecting external web intents with internal Android intents.The paper identifies this interaction as a direction for future investigation.

11 Conclusion

AdSplit protects advertisers from hostile host applications while reducing permission bloat in advertising-supported free applications.

  • AdSplit provides advertisers integrity guarantees against potentially hostile applications that might host them.It uses Quire mechanisms to ensure UI events are correct and communicate externally in ways hosting applications cannot forge.
  • AdSplit runs with marginal performance overhead and offers a path toward adoption through its HTML-based design.
  • AdSplit protects against click fraud and ad blocking while reducing permission bloat among advertising-supported free applications.It may also reduce incentives for applications to leak privacy-sensitive user information for better advertising revenues.
Loading 1202.4030v1…