{"id":"https://openalex.org/W4406110427","doi":"https://doi.org/10.1109/tdsc.2024.3525049","title":"Understanding the Bad Development Practices of Android Custom Permissions in the Wild","display_name":"Understanding the Bad Development Practices of Android Custom Permissions in the Wild","publication_year":2025,"publication_date":"2025-01-06","ids":{"openalex":"https://openalex.org/W4406110427","doi":"https://doi.org/10.1109/tdsc.2024.3525049"},"language":"en","primary_location":{"id":"doi:10.1109/tdsc.2024.3525049","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tdsc.2024.3525049","pdf_url":null,"source":{"id":"https://openalex.org/S133795288","display_name":"IEEE Transactions on Dependable and Secure Computing","issn_l":"1545-5971","issn":["1545-5971","1941-0018","2160-9209"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310320439","host_organization_name":"IEEE Computer Society","host_organization_lineage":["https://openalex.org/P4310320439","https://openalex.org/P4310319808"],"host_organization_lineage_names":["IEEE Computer Society","Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Dependable and Secure Computing","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://ink.library.smu.edu.sg/sis_research/10452","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":null,"display_name":"Xiaohan Zhang","orcid":"https://orcid.org/0000-0003-3260-4530"},"institutions":[{"id":"https://openalex.org/I149594827","display_name":"Xidian University","ror":"https://ror.org/05s92vm98","country_code":"CN","type":"education","lineage":["https://openalex.org/I149594827"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Xiaohan Zhang","raw_affiliation_strings":["State Key Laboratory of Integrated Service Networks and School of Cyber Engineering, Xidian University, Xi’an, China","State Key Laboratory of Integrated Service Networks and School of Cyber Engineering, Xidian University, Xi'an, China","Engineering Research Center of Big data Security, Ministry of Education, China"],"raw_orcid":"https://orcid.org/0000-0003-3260-4530","affiliations":[{"raw_affiliation_string":"State Key Laboratory of Integrated Service Networks and School of Cyber Engineering, Xidian University, Xi’an, China","institution_ids":["https://openalex.org/I149594827"]},{"raw_affiliation_string":"State Key Laboratory of Integrated Service Networks and School of Cyber Engineering, Xidian University, Xi'an, China","institution_ids":["https://openalex.org/I149594827"]},{"raw_affiliation_string":"Engineering Research Center of Big data Security, Ministry of Education, China","institution_ids":[]}]},{"author_position":"middle","author":{"id":null,"display_name":"Zhiyuan Yu","orcid":"https://orcid.org/0000-0001-6196-7598"},"institutions":[{"id":"https://openalex.org/I204465549","display_name":"Washington University in St. Louis","ror":"https://ror.org/01yc7t268","country_code":"US","type":"education","lineage":["https://openalex.org/I204465549"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Zhiyuan Yu","raw_affiliation_strings":["Department of Computer Science and Engineering, Washington University in St. Louis, St. Louis, MO, USA"],"raw_orcid":"https://orcid.org/0000-0001-6196-7598","affiliations":[{"raw_affiliation_string":"Department of Computer Science and Engineering, Washington University in St. Louis, St. Louis, MO, USA","institution_ids":["https://openalex.org/I204465549"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5100626958","display_name":"Xinghua Li","orcid":"https://orcid.org/0000-0002-5583-4155"},"institutions":[{"id":"https://openalex.org/I149594827","display_name":"Xidian University","ror":"https://ror.org/05s92vm98","country_code":"CN","type":"education","lineage":["https://openalex.org/I149594827"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Xinghua Li","raw_affiliation_strings":["State Key Laboratory of Integrated Service Networks and School of Cyber Engineering, Xidian University, Xi’an, China","Engineering Research Center of Big data Security, Ministry of Education, China","State Key Laboratory of Integrated Service Networks and School of Cyber Engineering, Xidian University, Xi'an, China"],"raw_orcid":"https://orcid.org/0000-0002-5583-4155","affiliations":[{"raw_affiliation_string":"State Key Laboratory of Integrated Service Networks and School of Cyber Engineering, Xidian University, Xi’an, China","institution_ids":["https://openalex.org/I149594827"]},{"raw_affiliation_string":"Engineering Research Center of Big data Security, Ministry of Education, China","institution_ids":[]},{"raw_affiliation_string":"State Key Laboratory of Integrated Service Networks and School of Cyber Engineering, Xidian University, Xi'an, China","institution_ids":["https://openalex.org/I149594827"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5071275263","display_name":"Cen Zhang","orcid":"https://orcid.org/0000-0001-5603-1322"},"institutions":[{"id":"https://openalex.org/I172675005","display_name":"Nanyang Technological University","ror":"https://ror.org/02e7b5302","country_code":"SG","type":"education","lineage":["https://openalex.org/I172675005"]}],"countries":["SG"],"is_corresponding":false,"raw_author_name":"Cen Zhang","raw_affiliation_strings":["Nanyang Technological University, Singapore"],"raw_orcid":"https://orcid.org/0000-0001-5603-1322","affiliations":[{"raw_affiliation_string":"Nanyang Technological University, Singapore","institution_ids":["https://openalex.org/I172675005"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5058987076","display_name":"Cong Sun","orcid":"https://orcid.org/0000-0001-9116-2694"},"institutions":[{"id":"https://openalex.org/I149594827","display_name":"Xidian University","ror":"https://ror.org/05s92vm98","country_code":"CN","type":"education","lineage":["https://openalex.org/I149594827"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Cong Sun","raw_affiliation_strings":["State Key Laboratory of Integrated Service Networks and School of Cyber Engineering, Xidian University, Xi’an, China","Engineering Research Center of Big data Security, Ministry of Education, China","State Key Laboratory of Integrated Service Networks and School of Cyber Engineering, Xidian University, Xi'an, China"],"raw_orcid":"https://orcid.org/0000-0001-9116-2694","affiliations":[{"raw_affiliation_string":"State Key Laboratory of Integrated Service Networks and School of Cyber Engineering, Xidian University, Xi’an, China","institution_ids":["https://openalex.org/I149594827"]},{"raw_affiliation_string":"Engineering Research Center of Big data Security, Ministry of Education, China","institution_ids":[]},{"raw_affiliation_string":"State Key Laboratory of Integrated Service Networks and School of Cyber Engineering, Xidian University, Xi'an, China","institution_ids":["https://openalex.org/I149594827"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5100404897","display_name":"Ning Zhang","orcid":"https://orcid.org/0000-0003-0670-2161"},"institutions":[{"id":"https://openalex.org/I204465549","display_name":"Washington University in St. Louis","ror":"https://ror.org/01yc7t268","country_code":"US","type":"education","lineage":["https://openalex.org/I204465549"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Ning Zhang","raw_affiliation_strings":["Department of Computer Science and Engineering, Washington University in St. Louis, St. Louis, MO, USA"],"raw_orcid":"https://orcid.org/0000-0003-0670-2161","affiliations":[{"raw_affiliation_string":"Department of Computer Science and Engineering, Washington University in St. Louis, St. Louis, MO, USA","institution_ids":["https://openalex.org/I204465549"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5001712801","display_name":"Robert H. Deng","orcid":"https://orcid.org/0000-0003-3491-8146"},"institutions":[{"id":"https://openalex.org/I79891267","display_name":"Singapore Management University","ror":"https://ror.org/050qmg959","country_code":"SG","type":"education","lineage":["https://openalex.org/I79891267"]}],"countries":["SG"],"is_corresponding":false,"raw_author_name":"Robert H. Deng","raw_affiliation_strings":["Singapore Management University, Singapore"],"raw_orcid":"https://orcid.org/0000-0003-3491-8146","affiliations":[{"raw_affiliation_string":"Singapore Management University, Singapore","institution_ids":["https://openalex.org/I79891267"]}]}],"institutions":[],"countries_distinct_count":3,"institutions_distinct_count":4,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":2.568,"has_fulltext":true,"cited_by_count":4,"citation_normalized_percentile":{"value":0.87561437,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":97,"max":98},"biblio":{"volume":"22","issue":"4","first_page":"3208","last_page":"3223"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9997000098228455,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9997000098228455,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12799","display_name":"Mobile and Web Applications","score":0.9962000250816345,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12479","display_name":"Web Application Security Vulnerabilities","score":0.9873999953269958,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/android","display_name":"Android (operating system)","score":0.7718696594238281},{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.7511172294616699},{"id":"https://openalex.org/keywords/permission","display_name":"Permission","score":0.7357137799263},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.5913137197494507},{"id":"https://openalex.org/keywords/internet-privacy","display_name":"Internet privacy","score":0.44019970297813416},{"id":"https://openalex.org/keywords/static-analysis","display_name":"Static analysis","score":0.4335598349571228},{"id":"https://openalex.org/keywords/world-wide-web","display_name":"World Wide Web","score":0.39854270219802856},{"id":"https://openalex.org/keywords/operating-system","display_name":"Operating system","score":0.10477197170257568}],"concepts":[{"id":"https://openalex.org/C557433098","wikidata":"https://www.wikidata.org/wiki/Q94","display_name":"Android (operating system)","level":2,"score":0.7718696594238281},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7511172294616699},{"id":"https://openalex.org/C2779089604","wikidata":"https://www.wikidata.org/wiki/Q7169333","display_name":"Permission","level":2,"score":0.7357137799263},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.5913137197494507},{"id":"https://openalex.org/C108827166","wikidata":"https://www.wikidata.org/wiki/Q175975","display_name":"Internet privacy","level":1,"score":0.44019970297813416},{"id":"https://openalex.org/C97686452","wikidata":"https://www.wikidata.org/wiki/Q7604153","display_name":"Static analysis","level":2,"score":0.4335598349571228},{"id":"https://openalex.org/C136764020","wikidata":"https://www.wikidata.org/wiki/Q466","display_name":"World Wide Web","level":1,"score":0.39854270219802856},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.10477197170257568},{"id":"https://openalex.org/C199539241","wikidata":"https://www.wikidata.org/wiki/Q7748","display_name":"Law","level":1,"score":0.0},{"id":"https://openalex.org/C199360897","wikidata":"https://www.wikidata.org/wiki/Q9143","display_name":"Programming language","level":1,"score":0.0},{"id":"https://openalex.org/C17744445","wikidata":"https://www.wikidata.org/wiki/Q36442","display_name":"Political science","level":0,"score":0.0}],"mesh":[],"locations_count":3,"locations":[{"id":"doi:10.1109/tdsc.2024.3525049","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tdsc.2024.3525049","pdf_url":null,"source":{"id":"https://openalex.org/S133795288","display_name":"IEEE Transactions on Dependable and Secure Computing","issn_l":"1545-5971","issn":["1545-5971","1941-0018","2160-9209"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310320439","host_organization_name":"IEEE Computer Society","host_organization_lineage":["https://openalex.org/P4310320439","https://openalex.org/P4310319808"],"host_organization_lineage_names":["IEEE Computer Society","Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Dependable and Secure Computing","raw_type":"journal-article"},{"id":"pmh:oai:ink.library.smu.edu.sg:sis_research-11454","is_oa":true,"landing_page_url":"https://ink.library.smu.edu.sg/sis_research/10452","pdf_url":null,"source":{"id":"https://openalex.org/S4306401925","display_name":"Singapore Management University Institutional Knowledge (InK) (Singapore Management University)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I79891267","host_organization_name":"Singapore Management University","host_organization_lineage":["https://openalex.org/I79891267"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by-nc-nd","license_id":"https://openalex.org/licenses/cc-by-nc-nd","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"https://doi.org/10.1109/TDSC.2024.3525049","raw_type":"Journal Article"},{"id":"pmh:oai:dr.ntu.edu.sg:10356/217718","is_oa":false,"landing_page_url":"https://hdl.handle.net/10356/217718","pdf_url":null,"source":{"id":"https://openalex.org/S4306402609","display_name":"DR-NTU (Nanyang Technological University)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I172675005","host_organization_name":"Nanyang Technological University","host_organization_lineage":["https://openalex.org/I172675005"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Journal Article"}],"best_oa_location":{"id":"pmh:oai:ink.library.smu.edu.sg:sis_research-11454","is_oa":true,"landing_page_url":"https://ink.library.smu.edu.sg/sis_research/10452","pdf_url":null,"source":{"id":"https://openalex.org/S4306401925","display_name":"Singapore Management University Institutional Knowledge (InK) (Singapore Management University)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I79891267","host_organization_name":"Singapore Management University","host_organization_lineage":["https://openalex.org/I79891267"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by-nc-nd","license_id":"https://openalex.org/licenses/cc-by-nc-nd","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"https://doi.org/10.1109/TDSC.2024.3525049","raw_type":"Journal Article"},"sustainable_development_goals":[],"awards":[{"id":"https://openalex.org/G256090909","display_name":null,"funder_award_id":"2023KXJ-190","funder_id":"https://openalex.org/F4320336350","funder_display_name":"Key Research and Development Projects of Shaanxi Province"},{"id":"https://openalex.org/G5420252985","display_name":null,"funder_award_id":"B16037","funder_id":"https://openalex.org/F4320336698","funder_display_name":"Overseas Expertise Introduction Center for Discipline Innovation of Food Nutrition and Human Health (111 Center)"},{"id":"https://openalex.org/G7628465010","display_name":null,"funder_award_id":"2024GX-YBXM-072","funder_id":"https://openalex.org/F4320336350","funder_display_name":"Key Research and Development Projects of Shaanxi Province"}],"funders":[{"id":"https://openalex.org/F4320309650","display_name":"Washington University in St. Louis","ror":"https://ror.org/01yc7t268"},{"id":"https://openalex.org/F4320336350","display_name":"Key Research and Development Projects of Shaanxi Province","ror":null},{"id":"https://openalex.org/F4320336698","display_name":"Overseas Expertise Introduction Center for Discipline Innovation of Food Nutrition and Human Health (111 Center)","ror":null}],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":35,"referenced_works":["https://openalex.org/W1985686072","https://openalex.org/W1988036170","https://openalex.org/W1994588724","https://openalex.org/W2003276999","https://openalex.org/W2017025011","https://openalex.org/W2056388267","https://openalex.org/W2060646286","https://openalex.org/W2080696000","https://openalex.org/W2140095007","https://openalex.org/W2241404614","https://openalex.org/W2399629598","https://openalex.org/W2470899015","https://openalex.org/W2598193574","https://openalex.org/W2600871181","https://openalex.org/W2728910784","https://openalex.org/W2736244653","https://openalex.org/W2780289003","https://openalex.org/W2792035783","https://openalex.org/W2797009188","https://openalex.org/W2803054784","https://openalex.org/W2885133134","https://openalex.org/W2888121123","https://openalex.org/W3000598158","https://openalex.org/W3007553983","https://openalex.org/W3089915031","https://openalex.org/W3135916744","https://openalex.org/W3153294612","https://openalex.org/W3160974549","https://openalex.org/W3174321501","https://openalex.org/W4245027182","https://openalex.org/W4251541794","https://openalex.org/W4308632256","https://openalex.org/W6640059210","https://openalex.org/W6764197484","https://openalex.org/W6999986095"],"related_works":["https://openalex.org/W2316685381","https://openalex.org/W2056388267","https://openalex.org/W2249350383","https://openalex.org/W2072937473","https://openalex.org/W4210309948","https://openalex.org/W4388923452","https://openalex.org/W3211901564","https://openalex.org/W2786416059","https://openalex.org/W2070518775","https://openalex.org/W609672658"],"abstract_inverted_index":{"Android":[0],"system":[1],"provides":[2],"application":[3],"developers":[4],"with":[5,22,184],"the":[6,16,32,48,144,167,179,191],"ability":[7],"to":[8,14,58,85,130],"define":[9],"custom":[10,52,188],"permissions,":[11,189],"which":[12],"serve":[13],"regulate":[15],"sharing":[17],"of":[18,47,62,103,120,133,143,156,161,170],"resources":[19],"and":[20,75,94,152],"functionalities":[21],"other":[23],"applications.":[24],"However,":[25],"developers'":[26],"improper":[27],"development":[28],"practices":[29,50,186],"can":[30,83],"render":[31],"permission":[33],"mechanism":[34],"ineffective,":[35],"facilitating":[36],"easy":[37],"exploitation":[38],"by":[39,55],"attackers.":[40],"This":[41],"paper":[42],"presents":[43],"a":[44,109,117,153],"comprehensive":[45],"examination":[46],"problematic":[49],"surrounding":[51],"permissions":[53],"employed":[54],"developers,":[56],"referred":[57],"as":[59,90],"Bad":[60],"Practices":[61],"Custom":[63],"Permissions":[64],"(BPCP":[65],"issues).":[66],"To":[67,98],"accomplish":[68],"this,":[69],"we":[70,106,115],"conducted":[71],"an":[72],"empirical":[73],"study":[74],"identified":[76],"nine":[77],"common":[78],"BPCP":[79,134],"issue":[80],"patterns":[81,102],"that":[82,139],"lead":[84],"various":[86],"adverse":[87],"consequences,":[88],"such":[89],"installation":[91],"failures,":[92],"crashes,":[93],"even":[95],"component":[96],"hijacking.":[97],"automatically":[99],"identify":[100],"these":[101,171],"bad":[104,185],"practices,":[105],"devised":[107],"PERMEAGRE,":[108,114],"static":[110],"analysis":[111,119,164,175],"tool.":[112],"Employing":[113],"performed":[116],"large-scale":[118],"83,085":[121],"applications":[122],"obtained":[123],"from":[124],"seven":[125],"major":[126],"app":[127],"markets,":[128],"aiming":[129],"detect":[131],"instances":[132],"issues.":[135,172],"The":[136],"results":[137],"revealed":[138],"more":[140],"than":[141],"26%":[142],"analyzed":[145],"apps":[146,157],"contained":[147],"at":[148],"least":[149],"one":[150],"issue,":[151],"significant":[154],"number":[155],"had":[158],"garnered":[159],"millions":[160],"downloads.":[162],"Our":[163],"delved":[165],"into":[166],"underlying":[168],"causes":[169],"Consequently,":[173],"this":[174],"sheds":[176],"light":[177],"on":[178],"potential":[180],"threat":[181],"landscape":[182],"associated":[183],"in":[187],"emphasizing":[190],"urgent":[192],"requirement":[193],"for":[194],"effective":[195],"mitigation":[196],"strategies.":[197]},"counts_by_year":[{"year":2025,"cited_by_count":4}],"updated_date":"2026-07-23T08:03:31.855105","created_date":"2025-10-10T00:00:00"}