{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,10,12]],"date-time":"2025-10-12T04:24:01Z","timestamp":1760243041235,"version":"build-2065373602"},"reference-count":25,"publisher":"MDPI AG","issue":"6","license":[{"start":{"date-parts":[[2015,6,10]],"date-time":"2015-06-10T00:00:00Z","timestamp":1433894400000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Entropy"],"abstract":"<jats:p>To log in to a mobile social network service (SNS) server, users must enter their ID and password to get through the authentication process. At that time, if the user sets up the automatic login option on the app, a sort of security token is created on the server based  on the user\u2019s ID and password. This security token is called a credential. Because such credentials are convenient for users, they are utilized by most mobile SNS apps. However, the current state of credential management for the majority of Android SNS apps is very weak. This paper demonstrates the possibility of a credential cloning attack. Such attacks occur when an attacker extracts the credential from the victim\u2019s smart device and inserts it into their own smart device. Then, without knowing the victim\u2019s ID and password, the attacker can access the victim\u2019s account. This type of attack gives access to various  pieces of personal information without authorization. Thus, in this paper, we analyze the vulnerabilities of the main Android-based SNS apps to credential cloning attacks, and examine the potential leakage of personal information that may result. We then introduce effective countermeasures to resolve these problems.<\/jats:p>","DOI":"10.3390\/e17063947","type":"journal-article","created":{"date-parts":[[2015,6,10]],"date-time":"2015-06-10T14:05:21Z","timestamp":1433945121000},"page":"3947-3962","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":8,"title":["Personal Information Leaks with Automatic Login in Mobile Social Network Services"],"prefix":"10.3390","volume":"17","author":[{"given":"Jongwon","family":"Choi","sequence":"first","affiliation":[{"name":"School of Computer Science and Engineering, Soongsil University, Seoul 156-743, Korea"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Haehyun","family":"Cho","sequence":"additional","affiliation":[{"name":"School of Computer Science and Engineering, Soongsil University, Seoul 156-743, Korea"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Jeong","family":"Yi","sequence":"additional","affiliation":[{"name":"School of Computer Science and Engineering, Soongsil University, Seoul 156-743, Korea"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"1968","published-online":{"date-parts":[[2015,6,10]]},"reference":[{"key":"ref_1","first-page":"23","article-title":"A grid-based cloaking area creation scheme for continuous lbs queries in distributed systems","volume":"4","author":"Kim","year":"2013","journal-title":"J. Converg"},{"key":"ref_2","unstructured":"Kim, J., Yoon, Y., Yi, K., and Shin, J. Available online: http:\/\/www.mostconf.org\/2012\/papers\/26.pdf."},{"key":"ref_3","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1186\/s13673-014-0014-x","article-title":"Detecting misinformation in online social networks using cognitive psychology","volume":"4","author":"Kumar","year":"2014","journal-title":"Hum. Centric Comput. Inf. Sci."},{"key":"ref_4","first-page":"37","article-title":"PPS-RTBF: Privacy protection system for right to be forgotten","volume":"5","author":"Lee","year":"2014","journal-title":"J. Converg"},{"key":"ref_5","first-page":"26","article-title":"Analysis of covert hardware attacks","volume":"5","author":"Moein","year":"2014","journal-title":"J. Converg"},{"key":"ref_6","doi-asserted-by":"crossref","first-page":"618","DOI":"10.3745\/JIPS.01.0003","article-title":"A step towards user privacy while using location-based services","volume":"10","author":"Abbas","year":"2014","journal-title":"J. Inf. Process. Syst."},{"key":"ref_7","doi-asserted-by":"crossref","first-page":"189","DOI":"10.3745\/JIPS.2013.9.2.189","article-title":"The confinement problem: 40 years later","volume":"9","author":"Crowell","year":"2013","journal-title":"J. Inf. Process. Syst."},{"key":"ref_8","doi-asserted-by":"crossref","first-page":"99","DOI":"10.1145\/2494522","article-title":"Taintdroid: An information flow tracking system for real-time privacy monitoring on smartphones","volume":"57","author":"Enck","year":"2014","journal-title":"Commun. ACM"},{"key":"ref_9","doi-asserted-by":"crossref","first-page":"50","DOI":"10.1109\/MSP.2009.26","article-title":"Understanding android security","volume":"7","author":"Enck","year":"2009","journal-title":"IEEE Secur. Priv"},{"key":"ref_10","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1186\/s13673-014-0015-9","article-title":"Sensing spatial and temporal coordination in teams using the smartphone","volume":"4","author":"Feese","year":"2014","journal-title":"Hum. Centric Comput. Inf. Sci."},{"key":"ref_11","doi-asserted-by":"crossref","first-page":"81","DOI":"10.3745\/JIPS.2014.10.1.081","article-title":"Push-n-scheme with timeout for content delivery of social networking services","volume":"10","author":"Jun","year":"2014","journal-title":"J. Inf. Process. Syst."},{"key":"ref_12","unstructured":"Available online: http:\/\/developer.android.com\/training\/articles\/security-tips.html."},{"key":"ref_13","doi-asserted-by":"crossref","first-page":"1421","DOI":"10.1007\/s11277-013-1258-x","article-title":"Repackaging attack on android banking applications and its countermeasures","volume":"73","author":"Jung","year":"2013","journal-title":"Wirel. Pers. Commun."},{"key":"ref_14","doi-asserted-by":"crossref","unstructured":"Piao, Y., Jung, J.H., and Yi, J.H. (2014). Server-based code obfuscation scheme for apk tamper detection. Secur. Commun. Netw.","DOI":"10.1002\/sec.936"},{"key":"ref_15","doi-asserted-by":"crossref","unstructured":"Bianchi, A., Oakley, I., Kostakos, V., and Kwon, D.S. (2011, January 23\u201326). The Phone Lock: Audio and Haptic Shoulder-Surfing Resistant Pin Entry Methods for Mobile Devices, Funchal, Madeira, Portugal.","DOI":"10.1145\/1935701.1935740"},{"key":"ref_16","doi-asserted-by":"crossref","first-page":"3497","DOI":"10.4028\/www.scientific.net\/AMM.284-287.3497","article-title":"Shoulder-Surfing Resistant Smartphone Authentication Scheme Using Virtual Joystick, Applied Mechanics and Materials","volume":"284","author":"Kim","year":"2013","journal-title":"Appl. Mech. Mater"},{"key":"ref_17","first-page":"1","article-title":"Smudge attacks on smartphone touch screens","volume":"10","author":"Aviv","year":"2010","journal-title":"WOOT"},{"key":"ref_18","doi-asserted-by":"crossref","first-page":"S24","DOI":"10.1016\/j.diin.2012.05.007","article-title":"Forensic analysis of social networking applications on mobile devices","volume":"9","author":"Baggili","year":"2012","journal-title":"Digit. Investig"},{"key":"ref_19","unstructured":"Vidas, T., Votipka, D., and Christin, N. All Your Droid are belong to us: A Survey of Current Android Attacks, Carrollton, TX, USA."},{"key":"ref_20","unstructured":"Jeon, J., Micinski, K.K., Vaughan, J.A., Fogel, A., Reddy, N., Foster, J.S., Millstein, T. (2012, January 16\u201318). Fine-Grained Permissions in Android Applications, Raleigh, NC, USA."},{"key":"ref_21","unstructured":"Lafortune, E. Available online: http:\/\/proguard.sourceforge.net."},{"key":"ref_22","unstructured":"Loureiro, S., Molva, R., and Roudier, Y. (2000, January 1\u20133). Mobile code security, Toulouse, France."},{"key":"ref_23","doi-asserted-by":"crossref","first-page":"1667","DOI":"10.1016\/S0140-3664(00)00253-X","article-title":"Countermeasures for mobile agent security","volume":"23","author":"Jansen","year":"2000","journal-title":"Comput. Commun."},{"key":"ref_24","doi-asserted-by":"crossref","unstructured":"Dietrich, K., and Winter, J. (2009, January 6\u20138). Implementation Aspects of Mobile and Embedded Trusted Computing, Oxford, UK. Lecture Notes in Computer Science.","DOI":"10.1007\/978-3-642-00587-9_3"},{"key":"ref_25","unstructured":"Sander, T., and Tschudin, C.F. (1998, January 3\u20136). Towards mobile cryptography, Oakland, CA, USA."}],"container-title":["Entropy"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/1099-4300\/17\/6\/3947\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,10,11]],"date-time":"2025-10-11T20:47:43Z","timestamp":1760215663000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/1099-4300\/17\/6\/3947"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2015,6,10]]},"references-count":25,"journal-issue":{"issue":"6","published-online":{"date-parts":[[2015,6]]}},"alternative-id":["e17063947"],"URL":"https:\/\/doi.org\/10.3390\/e17063947","relation":{},"ISSN":["1099-4300"],"issn-type":[{"type":"electronic","value":"1099-4300"}],"subject":[],"published":{"date-parts":[[2015,6,10]]}}}