CHEX: statically vetting Android apps for component hijacking vulnerabilities

ABSTRACT

An enormous number of apps have been developed for Android in recent years, making it one of the most popular mobile operating systems. However, the quality of the booming apps can be a concern [4]. Poorly engineered apps may contain security vulnerabilities that can severally undermine users' security and privacy. In this paper, we study a general category of vulnerabilities found in Android apps, namely the component hijacking vulnerabilities. Several types of previously reported app vulnerabilities, such as permission leakage, unauthorized data access, intent spoofing, and etc., belong to this category.

We propose CHEX, a static analysis method to automatically vet Android apps for component hijacking vulnerabilities. Modeling these vulnerabilities from a data-flow analysis perspective, CHEX analyzes Android apps and detects possible hijack-enabling flows by conducting low-overhead reachability tests on customized system dependence graphs. To tackle analysis challenges imposed by Android's special programming paradigm, we employ a novel technique to discover component entry points in their completeness and introduce app splitting to model the asynchronous executions of multiple entry points in an app.

We prototyped CHEX based on Dalysis, a generic static analysis framework that we built to support many types of analysis on Android app bytecode. We evaluated CHEX with 5,486 real Android apps and found 254 potential component hijacking vulnerabilities. The median execution time of CHEX on an app is 37.02 seconds, which is fast enough to be used in very high volume app vetting and testing scenarios.

References

1. Android and security. http://googlemobile.blogspot.com/2012/02/android-and-security.html.
2. Baksmali: a disassembler for Android's dex format. http://code.google.com/p/smali/.
3. Google's 10 billion android app downloads. www.wired.com/gadgetlab/2011/12/10-billion-apps-detailed/.
4. Quality of Android market apps is pathetically low. http://www.huffingtonpost.com/2011/06/20/android-market-quality_n_880478.html.
5. WALA: T.J. Watson libraries for analysis. http://wala.sourceforge.netl.
6. Android application components. http://developer.android.com/guide/topics/fundamentals.html#Components, 2012.
7. BANDHAKAVI, S., KING, S. T., MADHUSUDAN, P., AND WINSLETT, M. Vex: vetting browser extensions for security vulnerabilities. In Proceedings of the 19th USENIX Security Symposium (2010).
8. BUGIEL, S., DAVI, L., DMITRIENKO, A., FISCHER, T., AND SADEGHI, A.-R. Xmandroid: A new android evolution to mitigate privilege escalation attacks. Tech. Rep. TR-2011-04, Technische Universitat Darmstadt, 2011.
9. CHEN, H., AND WAGNER, D. Mops: an infrastructure for examining security properties of software. In Proceedings of the 9th ACM CCS (2002).
10. CHIN, E., FELT, A. P., GREENWOOD, K., AND WAGNER, D. Analyzing inter-application communication in android. In Proceedings of the 9th MobiSys (2011).
11. DAVI, L., DMITRIENKO, A., SADEGHI, A.-R., AND WINANDY, M. Privilege escalation attacks on android. In Proceedings of the 13th ISC (2010).
12. DIETZ, M., SHEKHAR, S., PISETSKY, Y., SHU, A., AND WALLACH, D. S. Quire: Lightweight provenance for smart phone operating systems. In Proceedings of the 20th USENIX Security Symposium (2011).
13. EFSTATHOPOULOS, P., KROHN, M., VANDEBOGART, S., FREY, C., ZIEGLER, D., KOHLER, E., MAZIÈRES, D., KAASHOEK, F., AND MORRIS, R. Labels and event processes in the asbestos operating system. In Proceedings of the 20th ACM SOSP (2005).
14. EGELE, M., KRUEGEL, C., KIRDA, E., AND VIGNA, G. Pios: Detecting privacy leaks in ios applications. In Proceedings of the 19th NDSS (2011).
15. ENCK, W., GILBERT, P., CHUN, B.-G., COX, L. P., JUNG, J., MCDANIEL, P., AND SHETH, A. N. Taintdroid: an information-flow tracking system for realtime privacy monitoring on smartphones. In Proceedings of the 9th USENIX OSDI (2010).
16. ENCK, W., OCTEAU, D., MCDANIEL, P., AND CHAUDHURI, S. A study of android application security. In Proceedings of the 20th USENIX Security Symposium (2011).
17. ENCK, W., ONGTANG, M., AND MCDANIEL, P. On lightweight mobile phone application certification. In Proceedings of the 16th ACM CCS (2009).
18. FELMETSGER, V., CAVEDON, L., KRUEGEL, C., AND VIGNA, G. Toward automated detection of logic vulnerabilities in web applications. In Proceedings of the 19th USENIX Security Symposium (2010).
19. FELT, A. P., CHIN, E., HANNA, S., SONG, D., AND WAGNER, D. Android permissions demystified. In Proceedings of the 18th ACM CCS (2011).
20. FELT, A. P., WANG, H. J., MOSHCHUK, A., HANNA, S., AND CHIN, E. Permission re-delegation: attacks and defenses. In Proceedings of the 20th USENIX Security Symposium (2011).
21. GRACE, M., ZHOU, Y., WANG, Z., AND JIANG, X. Systematic detection of capability leaks in stock Android smartphones. In Proceedings of the 19th NDSS (2012).
22. GUNDOTRA, V., AND BARRA, H. Android: Momentum, mobile and more at Google I/O. http://www.google.com/events/io/2011/.
23. HARDY, N. The confused deputy: (or why capabilities might have been invented). SIGOPS Oper. Syst. Rev. 22, 4 (1988), 36--38.
24. HORNYACK, P., HAN, S., JUNG, J., SCHECHTER, S., AND WETHERALL, D. These aren't the droids you're looking for: retrofitting android to protect data from imperious applications. In Proceedings of the 18th ACM CCS (2011).
25. HORWITZ, S., REPS, T., AND BINKLEY, D. Interprocedural slicing using dependence graphs. SIGPLAN Not. 23, 7 (1988), 35--46.
26. JOVANOVIC, N., KRUEGEL, C., AND KIRDA, E. Pixy: A static analysis tool for detecting web application vulnerabilities (short paper). In Proceedings of the IEEE S&P'06 (2006).
27. LINEBERRY, A., RICHARDSON, D. L., AND WYATT, T. These aren't permissions you're looking for. In Proceedings of the Blackhat'10 (2010).
28. LIVSHITS, V. B., AND LAM, M. S. Finding security vulnerabilities in java applications with static analysis. In Proceedings of the 14th USENIX Security Symposium (2005).
29. MYERS, A. C. Jflow: practical mostly-static information flow control. In Proceedings of the 26th ACM POPL (1999).
30. STAIGER, S. Reverse engineering of graphical user interfaces using static analyses. In Proceedings of the 14th IEEE WCRE (2007).
31. STAIGER, S. Static analysis of programs with graphical user interface. In Proceedings of the 11th IEEE CSMR (2007).
32. TRIPP, O., PISTOIA, M., FINK, S. J., SRIDHARAN, M., AND WEISMAN, O. TAJ: effective taint analysis of web applications. In Proceedings of the ACM PLDI '09 (2009).
33. WASSERMANN, G., AND SU, Z. Static detection of cross-site scripting vulnerabilities. In Proceedings of the 30th ACM ICSE (2008).
34. ZELDOVICH, N., BOYD-WICKIZER, S., KOHLER, E., AND MAZIÈRES, D. Making information flow explicit in histar. In Proceedings of the 7th USENIX OSDI (2006).
35. ZHOU, W., ZHOU, Y., JIANG, X., AND NING, P. DroidMOSS: Detecting repackaged smartphone applications in third-party android. In Proceedings of ACM CODASPY'12 (2012).
36. ZHOU, Y., AND JIANG, X. Dissecting android malware: Characterization and evolution. In Proceedings of the IEEE Symposium on S&P'12 (2012).
37. ZHOU, Y., WANG, Z., ZHOU, W., AND JIANG, X. Hey, you, get off of my market: Detecting malicious apps in official and alternative android markets. In Proceedings of the 20th NDSS (2012).

Index Terms

• General and reference

  • Cross-computing tools and techniques

    • Validation

• Software and its engineering

  • Software creation and management

    • Software verification and validation

      • Empirical software validation

      • Process validation

        • Walkthroughs