In the permission-based security model (used e.g. in Android and Blackberry), applications can be granted more permissions than they actually need, what we call a "permission gap". Malware can leverage the unused permissions for achieving their malicious goals, for instance using code injection. In this paper, we present an approach to detecting permission gaps using static analysis. Using our tool on a dataset of Android applications, we found out that a non negligible part of applications suffers from permission gaps, i.e. does not use all the permissions they declare.
For example, Bartel REF proposed a tool named "COPES" to detecting permission gaps using static analysis.
Automatically securing permission-based software by reducing the attack surface: an application to Android
ASE 2012
Computer Science