Shashi Shekhar, Separating Smartphone advertising from applications

A large number of Smartphone apps use advertisement libraries for monetization. These advertisement libraries often run within the same code base as the app itself. This situation requires that apps request permissions on behalf of the advertisement libraries they host, even when those permissions are unused by the app itself. These permissions, used only by hosted ad libraries, increase the permission bloat of the app and can be used for nefarious purposes by an untrustworthy ad library. We propose a novel method for solving this problem in Android, by splitting advertisements from the hosting app and introducing a trusted path mechanism for validating user input. Our design allows apps and advertisements to run in isolated application domains. This allows advertisement libraries to have their own permission sets. We demonstrate the usefulness of our approach by examining apps from two major app stores and determining the permission reductions afforded by our approach. We further show that performance overhead of our approach is low by analyzing the communication and memory overhead of our modifications.