An Autonomic And Permissionless Android Covert Channel

Demand for mobile devices continues to experience worldwide growth. Within the U.S., there is a significant shift away from broadband usage towards Smartphones as the primary Internet entry point for consumers. Although technological advancements have helped fuel demand for greater features and functionality to enhance the user experience, they have also drawn attention from malicious actors seeking to access and exfiltrate increasingly available sensitive and content rich personalized information.In traditional Android based exfiltration channels, the application engaged in information acquisition is granted permission to execute off-board communications. This tactic increases the possibility of detection by applications designed to identify this form of behavior. In this paper, we sever the acquisition / exfiltration bundling by assigning independent responsibilities to two apps communicating via a stealthy, permissionless, self-configuring and self-optimizing ultrasonic bridge. We present a framework for analyzing channel feasibility and performance, and apply it to 28 popular mobile devices. We demonstrate basic channel capability on 13 devices, achieving in certain cases, Bit Error Rates lower than 10(-4) and Shannon capacity approaching 14 bps. We further demonstrate two performance boosting solutions that build on these results: a multichannel implementation which improves performance by nearly 80% and; a single channel Amplitude Shift Keying solution that increases capacity three-fold.