WhiteLie: Runtime Data Mediation for Privacy Protection on Android

Android employs a permission framework that empowers users to either accept or deny sharing their private data (eg, location) with an app. However, many apps tend to crash when they are denied permission, leaving users no choice but to allow access to their data in order to use the app. In this paper, we introduce WhiteLie, a deployable user data spoofing framework that mediates sensitive data at runtime by supplying controlled, fabricated values to applications in place of real user information. Additionally, it detects privacy-violating behaviours, automatically responding by supplying spoofed data instead of the user’s real data, without crashing or disrupting the apps. Unlike prior approaches, WhiteLie requires neither device rooting nor altering the app’s binary, making it deployable on stock Android devices. Through experiments on over 70 popular Android apps, we demonstrate that WhiteLie can effectively deceive apps into accepting spoofed data without detection, enabling users to maintain privacy while preserving app functionality. Furthermore, our evaluation shows that WhiteLie introduces negligible overhead in terms of battery usage, CPU consumption, and app execution latency.