Today, mobile device privacy is more crucial than ever, pushing Android to introduce Privacy Indicators (PIs) to enhance transparency and protect users. These visual alert systems signal when sensitive resources, like the camera or microphone, are in use. The effectiveness of these visual elements is clearly linked to their ability to capture the users' gaze. In this paper, we leverage eye-tracking technology to explore PIs' ability to catch the users' attention. In a controlled experiment with 29 participants, we uncovered significant gaps in PI effectiveness, particularly during high-engagement tasks, showing that changes in the PI implementation may affect its visibility, still highlighting the need for more attention-grabbing privacy notifications. Building on these findings, a second experiment with 14 participants assessed the Disk PI—the best performer from the initial study—across passive (video watching) and active (app usage) usage contexts. Even concerning these two factors, the results show the limits of the proposed solution, suggesting the need for careful analysis of the UI elements that are most effective in capturing the user's gaze to create a better solution. Heatmap analysis revealed that users consistently focus on centrally located, dynamic elements and text while ignoring static and peripheral areas. Inspired by these insights, we developed a new Popup PI, strategically positioned at the top center of the screen with dynamic animations and textual information. This Popup PI significantly increased user attention and retention, proving to be a more effective solution for privacy notifications. Our research underscores the urgent need for intuitive and user-friendly privacy indicators in the Android ecosystem. The compelling evidence points to the Popup PI as a superior alternative, greatly enhancing user awareness and privacy protection. These findings are a pivotal step towards evolving privacy mechanisms, fostering a safer and more transparent digital environment for all users, and advancing the methodology of utilizing eye tracking in user experience research.

The increasing diffusion of mobile devices and their integration with sophisticated hardware and software components has promoted the development of numerous applications in which developers find new ingenious ways to exploit the possibilities offered by the access to resources such as cameras, biometric sensors, and GPS receivers. As a result, we are increasingly used to seeing applications that make extensive use of sensitive resources, potentially dangerous for our privacy. To address this problem, the latest approach to support user awareness in terms of privacy is represented by the Privacy Indicators (PI), a software solution implemented by the operating system to provide a visual stimulus to inform users whenever a dangerous resource is exploited by the app. However, the effectiveness of this approach has not been assessed yet. In this article, we present the result of a study on the effectiveness of using the PI to inform the user every time an app accesses the mobile device camera or microphone. We have chosen these two resources as the PI are currently implemented only for a very limited number of permissions. The controlled experiment involved 122 Android users who were asked to complete a series of tasks on their smartphone through prototypes using the involved resources in an explicit and latent way. Although the PI mechanism is very similar between Android and iOS, we have decided to focus on the former due to its greater diffusion. The results show no significant correlation between the use of PI and the detection of the resource being used by the app, suggesting that the effectiveness of PI in improving sensitive-related resources usage awareness, as currently implemented, is still unsatisfactory. In order to understand if the problem was due to the specific implementation of the PI, we implemented an enhanced version and compared it with the standard one. The results confirmed that an implementation that makes the indicators more visible and that is clearer in highlighting the fact that the app is accessing a resource improves resources usage awareness.

In today’s digital landscape, where privacy preservation is of paramount importance, Android has implemented new features to enhance transparency: the Privacy Indicators (PIs). Our study employs eye-tracking technology to investigate how users perceive and interact with these indicators. As a visual alert system, PIs signal when sensitive resources, like camera or microphone, are in use. However, the structure of Android’s permission model, susceptible to exploitation by malevolent or commercial apps, places an excessive responsibility on PIs. They act as the final alert for users against the misuse of permissions in unexpected contexts. We conducted a controlled experiment with 29 participants who were exposed to various privacy scenarios while their eye movements were tracked and recorded. Our findings reveal a significant gap in PIs effectiveness, particularly in high-engagement tasks, indicating a need for more eye-catching privacy notifications. These findings suggest the need for redesigning some privacy interfaces to make them more effective. The study’s insights contribute to the broader discussion on balancing functionality with user privacy and the methodology of utilizing eye tracking in user experience research.

Despite the widespread deployment of 5G technologies, there exists a critical gap in security testing for 5G Standalone (SA) devices. Existing methods, largely manual and labor-intensive, are ill-equipped to fully uncover the state of security in the implementations of 5G SA protocols and standards on devices, severely limiting the ability to conduct comprehensive evaluations. To address this issue, in this work, we introduce a novel, open-source framework that automates the security testing process for 5G SA devices. By leveraging enhanced functionalities of 5G SA core and Radio Access Network (RAN) software, our framework offers a streamlined approach to generating, executing, and evaluating test cases, specifically focusing on the Non-Access Stratum layer. Our application of this framework across multiple 5G SA devices provides in-depth security insights, significantly improving testing efficiency and breadth.

Logic bombs are a critical security threat in Android applications that can be triggered by specific events or conditions, leading to serious consequences. In this work we focus on apps accessing mobile device resources for sensitive data leakage. Such malicious behaviour can exploit Android permission model by gaining access to sensitive related resources in a legitimate context and later using them in a dangerous one, once the logic bomb is triggered. We propose a dynamic approach by extending RPCDroid, a tool that monitors the behavior of an Android application whenever it accesses specific device resources. To defuse the logic bomb we force an explicit prompt to authorize access requests based on the usage context preventing accesses unbeknownst to the user. We assessed the effectiveness of our proposal using TriggerZoo, a publicly available dataset of apps injected with logic bombs. Our results show that a context aware permission model can effectively prevent uncontrolled access to privacy related data in case a logic bomb is triggered.

Over the years, there has been an explosion in the app market offering users a wide range of functionalities especially since modern devices are equipped with many hardware resources such as cameras, GPS, and so on. Unfortunately, this is sometimes associated to indiscriminate access to sensitive data. This exposes users to security and privacy risks because, although resource usage requires explicit user authorization, once permission is granted, a mobile application is usually free to access the corresponding resource until the permission is expressly revoked or the app is uninstalled. In this work, we introduce RPCDroid, a dynamic analysis tool for run-time tracking of the behavior (UI events and used permissions) of Android mobile applications that use device resources requiring dangerous permissions. We assessed the effectiveness of the tool to identify usage contexts, discriminating between different kinds of access to the same sensitive resource. We executed RPCDroid on a set of popular applications obtaining evidence that, in many cases, mobile applications access to the same resource though different user interactions.

The current authentication systems based on password and pin code are not enough to guarantee attacks from malicious users. For this reason, in the last years, several studies are proposed with the aim to identify the users basing on their typing dynamics. In this paper, we propose the adoption of formal methods to discriminate between different users by exploiting a set of keystroke features. The idea behind the proposed method is to identify the users silently and continuously during their typing on a monitored system. To perform such user identification effectively, we consider a feature vector able to capture the typing style that is specific to each given user. By considering this feature model, in detail we propose to consider model checking with logic temporal properties to discriminate between different users using a set of keystroke features.

Automatically generating test cases plays an important role to reduce the time spent by developers during the testing phase. In last years, several approaches have been proposed to tackle such a problem: amongst others, search-based techniques have been shown to be particularly promising. In this paper we describe Ocelot, a search-based tool for the automatic generation of test cases in C. Ocelot allows practitioners to write skeletons of test cases for their programs and researchers to easily implement and experiment new approaches for automatic test-data generation. We show that Ocelot achieves a higher coverage compared to a competitive tool in 81% of the cases. Ocelot is publicly available to support both researchers and practitioners.