Tap Dance on Android External Storage: Covert Channels Built on File Operations

Android external (shared) storage has become an essential part for current apps. When an app stores its data on external storage, a series of file operations are conducted. Compared with the file content, the information from these file operations is much limited, just telling when, where and which file operation happens. In this paper, we attempt to shed light on the great potential capability of file operations for constructing covert channels. Taking advantage of file operations on external storage, we propose File-operation-based Covert Communication Framework (FIOCC) and design three kinds of covert channels: Channel Based on Operation Type (COTY), Channel Based on Operation Target (COTA) and Channel Based on Operation Time (COTI). Meanwhile, we propose the dual-monitor mechanism to deal with the interference from other apps’ file operations. To make the file operations seem as normal as the ones of benign apps, we introduce the dynamic arrangement into the file operation generating process. we conduct both theoretical analyses and real-world experiments on these covert channels. The final results fully prove the effectiveness and applicability of the proposed file-operation-based covert channels over current Android versions.