Pith. sign in

REVIEW 4 major objections 5 minor 63 references

ARMOUR US: Android Runtime Zero-permission Sensor Usage Monitoring from User Space

T0 review · 4 major / 5 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read A normal Android app can detect other apps' use of zero-permission sensors by watching the sampling rate of its own sensor data.

desk verdict A genuinely new user-space trick for detecting zero-permission sensor access, backed by a serious 1,398-app measurement study; the main caveat is the under-tested cross-device premise. read the letter →

arxiv 2507.02177 v1 pith:ZIH6FWTA submitted 2025-07-02 cs.CR

Yan Long , Jiancong Cui , Yuqing Yang , Tobias Alam , Zhiqiang Lin , Kevin Fu This is my paper
classification cs.CR
keywords Androidzero-permissionsensorssensorusagemonitoringuser-spacesamplingrateconvergenceprivacymobilesensingruntime
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

ARMOUR claims that Android's sensor framework leaks other apps' sensor activity to any app that listens. Because the OS delivers readings to all listeners of a sensor at one instant rate that converges to the highest rate any running app requested, a defender app can register for accelerometer, gyroscope, and magnetometer data at the minimum supported rate and treat any upward jump in its own packet rate as proof that another app has started using that sensor. The paper builds this into a user-space Android app that needs no root, no special permissions, and no access to other apps' code, and reports that it detected all 50 ground-truth sensor-using apps while producing no false positives in prolonged control runs. Deployed on 1,398 popular Google Play apps, the method reveals widespread unexplained sensor use, including more than half of Book/Reference apps and most Finance apps accessing motion or position sensors.

What carries the argument

The load-bearing object is the sampling-rate convergence rule of Android's SensorManager: for each physical sensor, the OS hands all registered listeners an instantaneous packet rate equal to the highest rate any of them requested, up to the device's supported maximum. ARMOUR operationalizes the rule with a three-stage pipeline: device profiling finds $f^{i}_{\min}$ per sensor and phone, a background monitor records packet timestamps, and a threshold detector declares usage when the cleaned $f_{\mathrm{inst}}$ time series exceeds $f^{i}_{\min} + 0.5$ Hz. The convergence rule is the entire information channel; without it ARMOUR would only ever observe its own rate and learn nothing about other apps.

What would settle it

On a stock Android phone, run two apps on the same accelerometer, one requesting a low rate and one requesting the fastest rate, and record whether the low-rate app's packet timestamps jump to the high rate. Then repeat on a device with a background rate-limiting policy or an OS build that batches sensor events, and check whether the jump disappears; a single such device where the low-rate stream stays flat while the other app senses would refute the convergence premise and break the detection.

Watch

Extended reading notes

Core claim

Android's SensorManager does not give each app an independent sampling rate. When several apps listen to the same sensor, the instantaneous rate $f_{\mathrm{inst}}(t) = 1/(T_a - T_b)$ at which SensorEvent packets arrive at every listener converges to the maximum OS-supported rate requested by any running app, regardless of when the apps registered or whether they run in foreground or background. ARMOUR exploits this convergence as a benign covert channel: it requests the minimum supported rate $f^{i}_{\min}$ for sensor $i$, and when another app asks for a higher rate, ARMOUR's own packet rate rises above $f^{i}_{\min} + 0.5$ Hz, triggering a detection. The paper verifies this rule empirically on six phone models and aligns it with Android's sensor-stack documentation, then shows the resulting detection is immune to code obfuscation, native code, and websites, and costs about 2.6% battery per hour.

Load-bearing premise

The whole detection rests on the empirical premise that Android always gives every listener of the same sensor one shared rate, equal to the fastest rate any app requested, on every device and OS version.

Editorial extensions

If this is right

  • A lay user can install ARMOUR as a background monitor and be notified whenever any installed app, obfuscated or not, reads the accelerometer, gyroscope, or magnetometer, without rooting the phone.
  • Security researchers can run ARMOUR as an app-agnostic probe to map when, which, and at what rates commercial apps collect zero-permission sensor data, as demonstrated on 1,448 apps across 35 categories.
  • The method also catches sensor access triggered by web pages and by GUI events such as login buttons, so it exposes usage that static analysis and short launch-window tests miss.
  • The measurements quantify Android 12's high-sampling-rate regulation: highest-rate motion sensor use dropped from about 20% to 25% of apps on Android 10 to under 1% on Android 12, while some OEM builds still expose 206 Hz above the 200 Hz cap.
  • Because the monitor can only attribute a detected usage to a specific app when that app is the only other sensor user, practical attribution on busy devices will require correlating ARMOUR's timing with per-app activity data.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • If the convergence rule holds OS-wide, the same side channel is available to attackers: any app could watch its own sensor rate to learn when any other app, including a privacy monitor, starts sensing, so the channel is not confidential.
  • A single OEM build or future Android version that gives each app an independent per-app sampling rate, or that batches sensor events per app, would erase the signal entirely; a public registry of measured rates per device would show how fragile the premise is.
  • The technique should transfer to any sensor multiplexed through SensorManager and to Android-compatible OSes with the same framework semantics, so the three-sensor implementation is a special case of a general monitoring channel.
  • Because apps that deliberately request the minimum supported rate remain invisible by design, the method's long-term recall depends on whether such evasion becomes common; if it does, the detection problem becomes statistical rather than deterministic.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. The paper presents ARMOUR, a user-space Android application that monitors when other applications access zero-permission sensors (accelerometer, gyroscope, magnetometer) by subscribing to the same sensors at the minimum supported sampling rate and detecting upward jumps in its own instantaneous sampling rate. The method exploits the Android sensor framework's empirical convergence behavior, by which concurrent listeners on the same sensor all receive the highest requested sampling rate. The authors evaluate detection on 50 apps known to use sensors (100% detection), report no false positives in prolonged control tests, cross-check negative results against a Frida instrumentation baseline on 830 apps, and use the tool to characterize sensor usage in 1,398 popular Google Play apps across 35 categories. They also analyze the effect of Android 12's HIGH_SAMPLING_RATE_SENSORS permission and present case studies of suspicious sensor access, including persistent background access and shake-to-ad behavior.

Significance. If the underlying convergence behavior holds across platforms, ARMOUR provides a genuinely novel, lightweight, root-free monitoring capability that complements static analysis and hooking-based dynamic analysis, and addresses a real privacy information asymmetry. The paper is honest about the empirical nature of the core premise and ships an open-source tool and dataset, which are valuable community resources. The measurement study on 1,398 apps, the Frida cross-check, and the analysis of Android version differences give the central empirical claim a solid basis on the tested devices. However, the generality of the convergence rule is verified on only six phone models spanning Android 10–13, and several secondary claims (web sensor detection, cross-device comparisons) are less well supported. The contribution is significant as a new detection technique and a first-of-its-kind dataset, provided the load-bearing empirical assumption is either more broadly validated or explicitly scoped.

major comments (4)
  1. [§3.2.1, Table 3] The detection mechanism rests entirely on the empirical convergence rule that all listeners of the same sensor receive the highest requested sampling rate. This rule is verified on six phone models (Android 10–13) from Google, Samsung, and OnePlus, and the paper does not test Android 14/15, other major vendors (Xiaomi, Oppo/ColorOS), or apps that use maxReportLatency/event batching, which can decouple hardware sampling from per-app event delivery. Since the 100% detection result in §4.2.1, the no-false-positive controls, and all category statistics in §4.3 inherit this premise, a single untested platform that throttles per-app rates or imposes a floor would invalidate the headline monitoring capability. The paper should either expand the device/batching coverage or explicitly scope the claims to the tested configurations and add a device self-check that verifies the convergence property, not just f_min and fluctuation range.
  2. [§4.2.1, §5] The claim that ARMOUR 'could successfully detect all sensor usage' is made on a 50-app set whose lowest observed sampling rate was about 50 Hz; apps using the minimum supported rate f_min (1–5 Hz on the test devices) are undetectable by design. The Frida baseline in §5 quantifies this blind spot: 38/830 (4.49%) of apps for which ARMOUR reported no accelerometer usage actually used the accelerometer at f_min. The evaluation section should state this recall limitation prominently when presenting the detection performance, and the abstract's 'effectiveness' phrasing should be qualified accordingly.
  3. [§4.3] The sentence 'the Samsung Galaxy S9 and OnePlus Nord N200 devices have different f_accel_min which result in 5.5 Hz and 1.5 Hz accelerometer usage detection thresholds respectively' is inconsistent with Table 3, which lists f_accel_min = 1 Hz for the S9 and 5 Hz for the OnePlus, implying thresholds of 1.5 Hz and 5.5 Hz. This swap makes the Android 10 vs. Android 12 comparison in §4.3 difficult to interpret and must be corrected.
  4. [§3.2.2] The statement that ARMOUR 'is also able to detect zero-permission sensor usage from the web' is made without any experimental evidence in §4; no web-access scenario is evaluated. Either add a minimal experiment (e.g., a browser page with the DeviceMotion API) or temper the claim to avoid an unsupported capability.
minor comments (5)
  1. [§4.2.3] The power overhead numbers are internally inconsistent: the text states battery usage increased from 2.0% to 5.6% per hour, which is a 3.6% increase, yet the next sentence reports an overhead of approximately 2.6% per hour.
  2. [§5] The Frida cross-check mentions 830 apps for which ARMOUR did not detect sensor usage, but Table 1 reports 583 sensor-using apps out of 1,398, implying 815 negative apps; the discrepancy should be explained.
  3. [Throughout] There are several typos: 'minium' in §3.2.2 should be 'minimum'; 'occured' in §4.5.1 should be 'occurred'; 'measreument' in §4.6 should be 'measurement'.
  4. [Table 3] The caption 'Examples of Android Phones’ Parameters' lists six specific phones; it would be clearer to state explicitly that these are the test devices used in the evaluation and that the table defines f_min values for each sensor.
  5. [§3.3, Figure 10] Figure 10, which illustrates the outlier-cleaning effect, is only placed in the appendix; the text would benefit from a note that the figure is illustrative and from a brief description of the axes and the cleaning outcome.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: ARMOUR's mechanism is an empirically characterized Android behavior, and its detection performance is validated against external ground truth and a Frida-based baseline.

full rationale

The paper's central claim is not a derivation but an empirical measurement technique based on the Android sensor framework's convergence behavior. Section 3.2.1 states the rule as a hypothesis ('we hypothesize that...') and verifies it with custom test apps, then aligns it with AOSP documentation; the convergence rule is not assumed true by definition nor reduced to ARMOUR's output. The detection threshold f_min + 0.5 is calibrated from observed fluctuation bounds (always <0.4 Hz) and from per-device profiling of f_min, but this calibration is not fitted to the evaluation's target labels; detection accuracy is measured against a separately constructed 50-app ground-truth set and a Frida dynamic-instrumentation baseline, and false positives are checked in prolonged no-usage controls. The cited prior works by the same authors appear in related-work and background contexts only (e.g., sensor exploitation and side channels) and are not load-bearing for the convergence mechanism. The concern that convergence may not hold on all OEM builds is an external-validity risk, not circularity. No step in the derivation chain reduces by construction to its own inputs.

Assumptions & free parameters 2 free parameters · 3 assumptions · 0 invented entities

No new physical or conceptual entities are postulated; ARMOUR is a software tool built from existing Android APIs. The free parameters are engineering thresholds chosen from pilot measurements, and the axioms are empirical claims about Android's sensor delivery behavior.

free parameters (2)
  • detection threshold margin = 0.5 Hz
    Chosen empirically after observing that instant-sampling-rate fluctuation errors stay within 0.4 Hz (Section 3.3). The threshold determines false positives and ability to detect near-minimum rates.
  • outlier cleaning window = fewer than 3 consecutive occurrences
    In Section 3.3, outliers are defined as rate values with fewer than three consecutive occurrences and replaced by a neighbor; this parameter is a design choice from pilot data.
assumptions (3)
  • domain assumption Android's sensor framework delivers a converged instant sampling rate to all apps listening to a given sensor, equal to the highest requested rate among them.
    This is the core signal ARMOUR exploits. It is empirically verified on six devices and supported by AOSP documentation, but not formally guaranteed across all OEM implementations (Section 3.2.1).
  • domain assumption SensorEvent timestamps reflect the actual sensor sampling instants, so the defender's received-packet rate faithfully indicates the OS-provided sampling rate.
    ARMOUR computes f_inst from timestamps (Equation 1); event batching or buffering could break the correspondence.
  • domain assumption The defender can keep a low-rate sensor listener active in the background without being throttled.
    ARMOUR requires continuous reception at f_min; Android 9+ background sensor restrictions require a foreground service, and OEM battery optimizations could interfere (Section 3.3, Section 5).

how reviews work

0 comments
Cite this review

Pith. "Pith review of ARMOUR US: Android Runtime Zero-permission Sensor Usage Monitoring from User Space." pith.science (2026). https://pith.science/paper/ZIH6FWTA

@misc{pith2026250702177,
  author       = {Pith},
  title        = {Pith review of: ARMOUR US: Android Runtime Zero-permission Sensor Usage Monitoring from User Space},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/ZIH6FWTA}},
  note         = {Machine review of arXiv:2507.02177}
}
read the original abstract

This work investigates how to monitor access to Android zero-permission sensors which could cause privacy leakage to users. Moreover, monitoring such sensitive access allows security researchers to characterize potential sensor abuse patterns. Zero-permission sensors such as accelerometers have become an indispensable part of Android devices. The critical information they provide has attracted extensive research investigating how data collectors could capture more sensor data to enable both benign and exploitative applications. In contrast, little work has explored how to enable data providers, such as end users, to understand sensor usage. While existing methods such as static analysis and hooking-based dynamic analysis face challenges of requiring complicated development chains, rooting privilege, and app-specific reverse engineering analysis, our work aims to bridge this gap by developing ARMOUR for user-space runtime monitoring, leveraging the intrinsic sampling rate variation and convergence behaviors of Android. ARMOUR enables privacy-aware users to easily monitor how third-party apps use sensor data and support security researchers to perform rapid app-agnostic sensor access analysis. Our evaluation with 1,448 commercial applications shows the effectiveness of ARMOUR in detecting sensor usage in obfuscated code and other conditions, and observes salient sensor abuse patterns such as 50% of apps from seemingly sensor-independent categories accessing data of multiple zero-permission sensors. We analyze the impact of Android's recent policy changes on zero-permission sensors and remaining technical and regulatory problems.

Figures

Figures reproduced from arXiv: 2507.02177 by the authors.

Figure 1
Figure 1. Although third-party apps can collect zero [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. The change of instant sampling rates detected by an [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗
Figure 3
Figure 3. summarizes the process of using ARMOUR to characterize sensor usage on an Android device. The core component is the ARMOUR app that continuously monitors in the background. The current implementation detects the usage of the three mostly used zero-permission sensors: accelerometers, gyroscopes, and magnetometers. Other sensors can be easily added to accommodate more specialized use cases. Device Profiling. The profi… view at source ↗
Figures from the paper (5 more)
Figure 4
Figure 4. Figure 4: Zero-permission sensor usage by different categories. [PITH_FULL_IMAGE:figures/full_fig_p007_4.png]
Figure 5
Figure 5. Figure 5: Background sensor usage tends to have decreasing [PITH_FULL_IMAGE:figures/full_fig_p008_5.png]
Figure 7
Figure 7. Figure 7: Examples of unexpected zero-permission sensor [PITH_FULL_IMAGE:figures/full_fig_p009_7.png]
Figure 9
Figure 9. Figure 9: Variation ranges of received instant sampling rates [PITH_FULL_IMAGE:figures/full_fig_p012_9.png]
Figure 10
Figure 10. Figure 10: Example of the effect of outlier cleaning in [PITH_FULL_IMAGE:figures/full_fig_p012_10.png]

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

63 extracted references · 63 canonical work pages

  1. [1]

    AccuBattery

    2023. AccuBattery. https://accubatteryapp.com/

    work page 2023

  2. [2]

    Access Dots - iOS cam/mic/gps

    2025. Access Dots - iOS cam/mic/gps. https://play.google.com/store/apps/details? id=you.in.spark.access.dots&hl=en_US ARMOUR US: Monitoring Android Zero-permission Sensor Usage From User Space WiSec 2025, June 30-July 3, 2025, Arlington, V A, USA

    work page 2025

  3. [3]

    Safe Dot

    2025. Safe Dot. https://github.com/kamaravichow/safe-dot-android?tab=readme- ov-file

    work page 2025

  4. [4]

    S Abhishek Anand, Chen Wang, Jian Liu, Nitesh Saxena, and Yingying Chen. 2019. Spearphone: A speech privacy exploit via accelerometer-sensed reverberations from smartphone loudspeakers. arXiv preprint arXiv:1907.05972 (2019)

    work page Pith review arXiv 2019

  5. [5]

    Android Developers. 2024. Android UIAutomator2. https://github.com/appium/ appium-uiautomator2-driver

    work page 2024

  6. [6]

    Appfigures. 2025. Top Ranked Google Play Apps. https://appfigures.com/top- apps/google-play/united-states/top-overall

    work page 2025

  7. [7]

    Appsflyer. 2025. Pay for real customers, not bots, with advanced sensor analysis. https://www.appsflyer.com/products/fraud-protection/

    work page 2025

  8. [8]

    Steven Arzt, Siegfried Rasthofer, Christian Fritz, Eric Bodden, Alexandre Bartel, Jacques Klein, Yves Le Traon, Damien Octeau, and Patrick McDaniel. 2014. Flowdroid: Precise context, flow, field, object-sensitive and lifecycle-aware taint analysis for android apps. Acm Sigplan Notices 49, 6 (2014), 259–269

    work page 2014

Show all 63 references
  1. [9]

    Zhongjie Ba, Tianhang Zheng, Xinyu Zhang, Zhan Qin, Baochun Li, Xue Liu, and Kui Ren. 2020. Learning-based Practical Smartphone Eavesdropping with Built-in Accelerometer.. In NDSS, Vol. 2020. 1–18

    2020

  2. [10]

    Xiaolong Bai, Jie Yin, and Yu-Ping Wang. 2017. Sensor Guardian: prevent privacy inference on Android sensors. EURASIP Journal on Information Security 2017 (2017), 1–17

    2017

  3. [11]

    Michael Benisch, Patrick Gage Kelley, Norman Sadeh, and Lorrie Faith Cranor

  4. [12]

    David Berend, Shivam Bhasin, and Bernhard Jungk. 2018. There goes your pin: Exploiting smartphone sensor fusion under single and cross user setting. In Proceedings of the 13th International Conference on A vailability, Reliability and Security. 1–10

    2018

  5. [13]

    Kenneth Block and Guevara Noubir. 2018. My magnetometer is telling you where i’ve been? a mobile device permissionless location attack. In Proceedings of the 11th ACM Conference on Security & Privacy in Wireless and Mobile Networks . 260–270

    2018

  6. [14]

    Connor Bolton, Kevin Fu, Josiah Hester, and Jun Han. 2020. How to curtail oversensing in the home. Commun. ACM 63, 6 (2020), 20–24

    2020

  7. [15]

    Connor Bolton, Yan Long, Jun Han, Josiah Hester, and Kevin Fu. 2023. Characterizing and Mitigating Touchtone Eavesdropping in Smartphone Motion Sensors. In Proceedings of the 26th International Symposium on Research in Attacks, Intrusions and Defenses. 164–178

    2023

  8. [16]

    Liang Cai and Hao Chen. 2011. TouchLogger: inferring keystrokes on touch screen from smartphone motion. HotSec 11, 2011 (2011), 9

    2011

  9. [17]

    L Jean Camp and Vafa Andalibi. 2021. Sbom vulnerability assessment & corresponding requirements. NTIA Response to Notice and Request for Comments on Software Bill of Materials Elements and Considerations (2021)

    2021

  10. [18]

    Yushi Cheng, Xiaoyu Ji, Wenyuan Xu, Hao Pan, Zhuangdi Zhu, Chuang-Wen You, Yi-Chao Chen, and Lili Qiu. 2019. Magattack: Guessing application launching and operation via smartphone. In Proceedings of the 2019 ACM Asia Conference on Computer and Communications Security . 283–294

    2019

  11. [19]

    Andrea Continella, Yanick Fratantonio, Martina Lindorfer, Alessandro Puccetti, Ali Zand, Christopher Kruegel, Giovanni Vigna, et al. 2017. Obfuscation-Resilient Privacy Leak Detection for Mobile Apps Through Differential Analysis.. In NDSS, Vol. 17. 10–14722

    2017

  12. [20]

    International Data Corporation. 2023. Smartphone Market Share. https://www. idc.com/promo/smartphone-market-share

    2023

  13. [21]

    Anupam Das, Gunes Acar, Nikita Borisov, and Amogh Pradeep. 2018. The Web’s Sixth Sense: A Study of Scripts Accessing Smartphone Sensors. In Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security . 1515–1532

    2018

  14. [22]

    Erhan Davarci, Betul Soysal, Imran Erguler, Sabri Orhun Aydin, Onur Dincer, and Emin Anarim. 2017. Age group detection using smartphone motion sensors. In 2017 25th European Signal Processing Conference (EUSIPCO) . IEEE, 2201–2205

    2017

  15. [23]

    Android Developers. 2018. Android 9 behavior changes. https://developer. android.com/about/versions/pie/android-9.0-changes-all#bg-sensor-access

    2018

  16. [24]

    Android Developers. 2021. Android 12 behavior changes. https: //developer.android.com/about/versions/12/behavior-changes-12#motion- sensor-rate-limiting

    2021

  17. [25]

    Android Developers. 2023. Manifest.permission: HIGH_SAMPLING_RATE_SENSORS. https://developer.android.com/ reference/android/Manifest.permission#HIGH_SAMPLING_RATE_SENSORS

    2023

  18. [26]

    Android Developers. 2023. Monitoring Sensor Events. https://developer.android. com/guide/topics/sensors/sensors_overview#sensors-monitor

    2023

  19. [27]

    Android Developers. 2025. Create your own accessibility service. https:// developer.android.com/guide/topics/ui/accessibility/service

    2025

  20. [28]

    Android Developers. 2025. Sensor Rate-Limiting. https://developer.android. com/develop/sensors-and-location/sensors/sensors_overview#sensors-rate- limiting

    2025

  21. [29]

    Android Developers. 2025. System restrictions on background work. https://developer.android.com/develop/background-work/background-tasks/ bg-work-restrictions?utm_source=chatgpt.com#user-initiated-restrictions

    2025

  22. [30]

    e Foundation. 2024. PayPal: Data transfer to over 600 third-party companies + metadata. https://community.e.foundation/t/paypal-data-transfer-to-over-600- third-party-companies-metadata/61888

    2024

  23. [31]

    Gabriella M Harari, Sandrine R Müller, Min SH Aung, and Peter J Rentfrow. 2017. Smartphone sensing methods for studying behavior in everyday life. Current opinion in behavioral sciences 18 (2017), 83–90

    2017

  24. [32]

    Pengfei Hu, Hui Zhuang, Panneer Selvam Santhalingam, Riccardo Spolaor, Parth Pathak, Guoming Zhang, and Xiuzhen Cheng. 2022. Accear: Accelerometer acoustic eavesdropping with unconstrained vocabulary. In 2022 IEEE Symposium on Security and Privacy (SP) . IEEE, 1757–1773

    2022

  25. [33]

    Wei-Han Lee and Ruby B Lee. 2017. Implicit smartphone user authentication with sensors and contextual machine learning. In 2017 47th Annual IEEE/IFIP International Conference on Dependable Systems and Networks (DSN) . IEEE, 297– 308

    2017

  26. [34]

    Xing Liu, Jiqiang Liu, Wei Wang, Yongzhong He, and Xiangliang Zhang. 2018. Discovering and understanding android sensor usage behaviors with data flow analysis. World Wide Web 21 (2018), 105–126

    2018

  27. [35]

    Yan Long and Kevin Fu. 2022. Side Auth: Synthesizing Virtual Sensors for Authentication. In Proceedings of the 2022 New Security Paradigms Workshop . 35–44

    2022

  28. [36]

    Yan Long, Qinhong Jiang, Chen Yan, Tobias Alam, Xiaoyu Ji, Wenyuan Xu, and Kevin Fu. 2024. EM Eye: Characterizing electromagnetic side-channel eavesdropping on embedded cameras. (2024)

    2024

  29. [37]

    Yan Long, Pirouz Naghavi, Blas Kojusner, Kevin Butler, Sara Rampazzi, and Kevin Fu. 2023. Side eye: Characterizing the limits of pov acoustic eavesdropping from smartphone cameras with rolling shutters and movable lenses. In 2023 IEEE symposium on security and privacy (SP) . I...

    2023

  30. [38]

    Anindya Maiti, Ryan Heard, Mohd Sabra, and Murtuza Jadliwala. 2018. Towards inferring mechanical lock combinations using wrist-wearables as a side-channel. In Proceedings of the 11th ACM Conference on Security & Privacy in Wireless and Mobile Networks. 111–122

    2018

  31. [39]

    Sumit Majumder and M Jamal Deen. 2019. Smartphone sensors for health monitoring and diagnosis. Sensors 19, 9 (2019), 2164

    2019

  32. [40]

    Yan Michalevsky, Dan Boneh, and Gabi Nakibly. 2014. Gyrophone: Recognizing speech from gyroscope signals. In23rd{USENIX} Security Symposium ({USENIX} Security 14). 1053–1067

    2014

  33. [41]

    Reham Mohamed, Habiba Farrukh, Yidong Lu, He Wang, and Z Berkay Celik

  34. [42]

    Sashank Narain, Triet D Vo-Huu, Kenneth Block, and Guevara Noubir. 2016. Inferring user routes and locations using zero-permission mobile sensors. In2016 IEEE Symposium on Security and Privacy (SP) . IEEE, 397–413

    2016

  35. [43]

    Emmanuel Owusu, Jun Han, Sauvik Das, Adrian Perrig, and Joy Zhang

  36. [44]

    Hao Pan, Lanqing Yang, Honglu Li, Chuang-Wen You, Xiaoyu Ji, Yi-Chao Chen, Zhenxian Hu, and Guangtao Xue. 2021. Magthief: Stealing private app usage data on mobile devices via built-in magnetometer. In 2021 18th Annual IEEE International Conference on Sensing, Communication, a...

    2021

  37. [45]

    Jan Pennekamp, Martin Henze, and Klaus Wehrle. 2017. A survey on the evolution of privacy enforcement on smartphones and the road ahead.Pervasive and Mobile Computing 42 (2017), 58–76

    2017

  38. [46]

    Android Open Source Project. 2022. Android Sensor Stack. https://source. android.com/docs/core/interaction/sensors/sensor-stack#framework

    2022

  39. [47]

    Ole André V. Ravnås. 2025. Frida: A world-class dynamic instrumentation toolkit. https://frida.re/docs/android/

    2025

  40. [48]

    Google Samples. 2021. High sensor sampling rate code warning. https://googlesamples.github.io/android-custom-lint-rules/checks/ HighSamplingRate.md.html

    2021

  41. [49]

    Nina Shamsi, Yan Long, and Kevin Fu. 2023. EyeHearYou: Probing Location Identification via Occluded Smartphone Cameras and Ultrasound. In 2023 IEEE International Symposium on Hardware Oriented Security and Trust (HOST) . IEEE, 36–47

    2023

  42. [50]

    Cong Shi, Xiangyu Xu, Tianfang Zhang, Payton Walker, Yi Wu, Jian Liu, Nitesh Saxena, Yingying Chen, and Jiadi Yu. 2021. Face-Mic: inferring live speech and speaker identity via subtle facial dynamics captured by AR/VR motion sensors. In Proceedings of the 27th Annual Internati...

    2021

  43. [51]

    Amit Kumar Sikder, Hidayet Aksu, and A Selcuk Uluagac. 2017. 6thSense: A Context-aware Sensor-based Attack Detector for Smart Devices.. In USENIX Security Symposium. 397–414

    2017

  44. [52]

    Amit Kumar Sikder, Giuseppe Petracca, Hidayet Aksu, Trent Jaeger, and A Selcuk Uluagac. 2021. A survey on sensor-based threats and attacks to smart devices and applications. IEEE Communications Surveys & Tutorials 23, 2 (2021), 1125–1159

    2021

  45. [53]

    GitHub skylot. 2025. jadx: Dex to Java decompiler. https://github.com/skylot/jadx WiSec 2025, June 30-July 3, 2025, Arlington, V A, USA Yan Long, Jiancong Cui, Yuqing Yang, Tobias Alam, Zhiqiang Lin, and Kevin Fu

    2025

  46. [54]

    Raphael Spreitzer. 2014. Pin skimming: exploiting the ambient-light sensor in mobile devices. In Proceedings of the 4th ACM Workshop on Security and Privacy in Smartphones & Mobile Devices . 51–62

    2014

  47. [55]

    Ke Sun, Chunyu Xia, Songlin Xu, and Xinyu Zhang. 2023. StealthyIMU: Stealing permission-protected private information from smartphone voice assistant using zero-permission sensors. Network and Distributed System Security (NDSS) Symposium

    2023

  48. [56]

    Xiaoyu Sun, Xiao Chen, Kui Liu, Sheng Wen, Li Li, and John Grundy. 2021. Characterizing sensor leaks in android apps. In 2021 IEEE 32nd International Symposium on Software Reliability Engineering (ISSRE) . IEEE, 498–509

    2021

  49. [57]

    Verifone. 2024. PayPal Magnes. https://verifone.cloud/docs/online-payments/ apm/paypal-ecom/paypal-magnes

    2024

  50. [58]

    Yi Wu, Cong Shi, Tianfang Zhang, Payton Walker, Jian Liu, Nitesh Saxena, and Yingying Chen. 2023. Privacy leakage via unrestricted motion-position sensors in the age of virtual reality: A study of snooping typed input on virtual keyboards. In 2023 IEEE Symposium on Security an...

    2023

  51. [59]

    Zhi Xu and Sencun Zhu. 2015. Semadroid: A privacy-aware sensor management framework for smartphones. In Proceedings of the 5th ACM Conference on Data and Application Security and Privacy . 61–72

    2015

  52. [60]

    Yuqing Yang, Mohamed Elsabagh, Chaoshun Zuo, Ryan Johnson, Angelos Stavrou, and Zhiqiang Lin. 2022. Detecting and Measuring Misconfigured Manifests in Android Apps. In Proceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security. 3063–3077. A Appendix:...

    2022

  53. [2011]

    Personal and Ubiquitous Computing 15 (2011), 679–694

    Capturing location-privacy preferences: quantifying accuracy and user- burden tradeoffs. Personal and Ubiquitous Computing 15 (2011), 679–694

    2011

  54. [2012]

    In proceedings of the twelfth workshop on mobile computing systems & applications

    Accessory: password inference using accelerometers on smartphones. In proceedings of the twelfth workshop on mobile computing systems & applications . 1–6

  55. [2023]

    Proceedings on Privacy Enhancing Technologies 2 (2023), 79–96

    iStelan: Disclosing Sensitive User Information by Mobile Magnetometer from Finger Touches. Proceedings on Privacy Enhancing Technologies 2 (2023), 79–96

    2023

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.