The report introduces a framework that can automatically detect timing leaks on Android devices. It does so by automatically invoking API methods with different parameters and measuring the execution time of the different calls. If these differ significantly over several invocations, it may be possible to deduce information that is not directly accessible to the caller. The report shows two examples on how such timing differences can partially bypass the authorization system of Android.
Measurements of Timing-Differences in the Android API
The full text is currently only available in the Deutsch version. A translation will follow. Go to the Deutsch version
Archived. This content is no longer updated. It remains available for reference. Go to the archive
- Version
- 2020-06-08
- Source
- https://technology2.a-sit.at/en/publications/measurements-of-timing-differences-in-the-android-api/