  Smartphones' cameras, microphones, and device displays enable users to
capture and view memorable moments of their lives. However, adversaries can
trick users into authorizing malicious apps that exploit weaknesses in current
mobile platforms to misuse such on-board I/O devices to stealthily capture
photos, videos, and screen content without the users' consent. Contemporary
mobile operating systems fail to prevent such misuse of I/O devices by
authorized apps due to lack of binding between users' interactions and accesses
to I/O devices performed by these apps. In this paper, we propose Aware, a
security framework for authorizing app requests to perform operations using I/O
devices, which binds app requests with user intentions to make all uses of
certain I/O devices explicit. We evaluate our defense mechanisms through
laboratory-based experimentation and a user study, involving 74 human subjects,
whose ability to identify undesired operations targeting I/O devices increased
significantly. Without Aware, only 18% of the participants were able to
identify attacks from tested RAT apps. Aware systematically blocks all the
attacks in absence of user consent and supports users in identifying 82% of
social-engineering attacks tested to hijack approved requests, including some
more sophisticated forms of social engineering not yet present in available
RATs. Aware introduces only 4.79% maximum performance overhead over operations
targeting I/O devices. Aware shows that a combination of system defenses and
user interface can significantly strengthen defenses for controlling the use of
on-board I/O devices.
