[Paper Review] A Side-channel Analysis of Sensor Multiplexing for Covert Channels and Application Profiling on Mobile Devices

Carlton Shepherd, Jan Kalbantner+2 more|arXiv (Cornell University)|Oct 12, 2021

Internet Traffic Analysis and Secure E-voting4 citations

TL;DR

This paper demonstrates that Android's sensor multiplexing design enables unprivileged malicious apps to create spectral covert channels and perform coarse-grained application profiling via frequency-key shifting. By exploiting the fact that all apps receive sensor data at the highest requested sampling rate, attackers can transmit data or detect app behavior using standard sensor APIs, affecting millions of devices without root access.

ABSTRACT

Mobile devices often distribute measurements from physical sensors to multiple applications using software multiplexing. On Android devices, the highest requested sampling frequency is returned to all applications, even if others request measurements at lower frequencies. In this paper, we comprehensively demonstrate that this design choice exposes practically exploitable side-channels using frequency-key shifting. By carefully modulating sensor sampling frequencies in software, we show how unprivileged malicious applications can construct reliable spectral covert channels that bypass existing security mechanisms. Additionally, we present a novel variant that allows an unprivileged malicious application to profile other active, sensor-enabled applications at a coarse-grained level. Both methods do not impose any special assumptions beyond accessing standard mobile services available to developers. As such, our work reports side-channel vulnerabilities that exploit subtle yet insecure design choices in Android sensor stacks.

Motivation & Objective

• To investigate how Android's sensor multiplexing mechanism creates exploitable side-channels through frequency modulation.
• To demonstrate that unprivileged apps can establish reliable spectral covert channels using sensor sampling frequency shifts.
• To develop a novel method for coarse-grained profiling of sensor-enabled applications based on their sampling frequency patterns.
• To evaluate the feasibility and impact of these attacks across diverse Android devices and popular applications.
• To highlight design flaws in the Android sensor stack that bypass existing security mechanisms like sandboxing.

Proposed method

• Use of frequency-shift keying (FSK) to encode data by modulating the sampling frequency of a shared sensor between a sender and receiver app.
• Leveraging the Android Sensor SDK to request sensor data at different sampling rates, where the highest requested rate is applied to all apps.
• Establishing a low-frequency carrier signal in a receiver app and detecting frequency shifts caused by a sender modulating its request rate.
• Monitoring spectral changes in sensor data streams to detect when a victim app starts requesting sensor data at a higher frequency.
• Performing large-scale analysis on 250 top Android apps to detect and classify sensor usage patterns based on standard sampling rate constants (e.g., SENSOR_DELAY_GAME, SENSOR_DELAY_UI).
• Implementing proof-of-concept attacks using only standard Android sensor APIs, without requiring root or kernel access.

Experimental results

Research questions

• RQ1 Can unprivileged Android applications exploit sensor multiplexing to create reliable spectral covert channels for inter-process communication?
• RQ2 To what extent can sensor sampling frequency patterns be used to profile the behavior of other active, sensor-enabled applications?
• RQ3 How prevalent are detectable sensor sampling patterns in real-world Android applications, particularly among top-ranked apps?
• RQ4 Why do existing Android security mechanisms, including those introduced in Android 9, fail to prevent these side-channel attacks?
• RQ5 What are the implications of these side-channels for mobile application security and user privacy?

Key findings

• The authors successfully demonstrated spectral covert channels on multiple Android devices from major OEMs, enabling data transmission between unprivileged apps using standard sensor APIs.
• Covert communication achieved bitrates of up to 100 bps with low error rates, depending on the sensor and device, and could transmit arbitrary bit-strings and low-resolution images.
• 22.8% of the top 250 Android applications (57 out of 250) were found to use detectable sensor sampling frequencies, making them vulnerable to profiling via this side-channel.
• The study identified specific sensor sampling constants (e.g., SENSOR_DELAY_GAME, SENSOR_DELAY_UI) used by apps, which can be detected with high accuracy and near real-time latency.
• The attacks bypass traditional security controls such as app sandboxing and do not require root access or kernel-level privileges.
• Despite Android 9’s efforts to limit long-polling continuous sensors, the proposed side-channel techniques remain effective due to the fundamental design of sensor multiplexing.