Fine-Grained Privacy Leakage Detection in OpenHarmony Apps

Abstract

In recent years, the distributed operating system OpenHarmony has gained significant popularity. As the number of OpenHarmony apps grows rapidly, privacy abuse and data leakage have emerged as critical concerns. However, the untyped and highly flexible nature of Ark bytecode poses substantial challenges. We propose HScope, a novel fine-grained program analysis framework designed to directly analyze OpenHarmony app bytecode and identify privacy risks. HScope employs abstract interpretation to model the dynamic behaviors of OpenHarmony apps, enabling precise resolution of indirect calls and the complex inter-component communication mechanisms. We evaluate HScope on a dataset of 300 real-world OpenHarmony apps. The results demonstrate that HScope is both effective and comprehensive, successfully uncovering 39 previously unknown privacy issues (corresponding to 27 apps). These findings highlight HScope’s potential as a practical and scalable solution for securing the evolving OpenHarmony ecosystem.