Security Research for Android Remote Assistance Apps

With the help of remote assistance app, we can watch the screen of a smartphone or control the smartphone remotely. In reality, smartphones often contain a vast amount of personal information. If the information is to be leaked by the remote assistance app, it may lead to serious consequences for users’ privacy. To the best of our knowledge, existing works have not conducted a thorough investigation into the security of this type of app. We present two new research objectives: understanding how such apps work and identifying security risks of the apps. We are carefully selecting remote assistance apps, from popular app markets such as Google Play, to conduct our study. As a result, we have made three important discoveries regarding these apps: (1) identification of security issues related to the leakage of user privacy data, (2) risk of exposing user device to unauthorized remote control, and (3) usage of highly sensitive non-third-party permissions, and the presence of numerous potential security issues such as Secure Socket Layer (SSL) security. Our experiments show that 11 apps had vulnerabilities in login or assistance authentication stage, while 11 apps used insecure communication protocols during the remote assistance stage. Besides, we have submitted 11 more serious vulnerabilities to both the vendor and the security platform. We have received 9 active responses, and some of our vulnerabilities were assessed as high risk. Our studies indicate that it is essential to monitor and regulate the use of these apps.