LazyTainter: Memory-Efficient Taint Tracking in Managed Runtimes

The leakage of private information is of great concern on mobile devices since they contain a great deal of sensitive information. This has spurred interest in the use of taint tracking systems to track and monitor the flow of private information on a mobile device. Taint tracking systems impose memory overhead, as taint information must be maintained for every piece of information an application stores in memory. This memory cost is at odds with the growing number of low-end, memory-constrained devices, which makes up the majority mobile device growth in emerging markets. To make taint tracking affordable and to benefit a broader range of mobile devices, we present LazyTainter, which is a memory-efficient taint tracking system designed for managed runtimes. To implement LazyTainter, we enhanced TaintDroid with hybrid taint tracking, which combines lazy and eager tainting, to reduce memory usage with only negligible performance loss. Our experimental results demonstrate that LazyTainter can reduce heap usage by as much as 26.5% when compared to TaintDroid while imposing a negligible 1% increase in performance overhead.