Characterizing and identifying misexposed activities in Android applications

ABSTRACT

Exported Activity (EA), a kind of activities in Android apps that can be launched by external components, is one of the most important inter-component communication (ICC) mechanisms to realize the interaction and cooperation among multiple apps. Existing works have pointed out that, once exposed, an activity will be vulnerable to malicious ICC attacks, such as permission leakage attack. Unfortunately, it is observed that a considerable number of activities in commercial apps are exposed inadvertently, while few works have studied the necessity and reasonability of such exposure. This work takes the first step to systematically study the exposing behavior of EAs through analyzing 13,873 Android apps. It utilizes the EA associated call relationships extracted from byte-code via data-flow analysis, as well as the launch conditions obtained from the manifest files, to guide the study on the usage and misexposure of EAs. The empirical findings are that the EA mechanism is widely adopted in development and the activities are liable to be misexposed due to the developers' misunderstanding or carelessness. Further study on subsets of apps selected according to different criteria indicates that the misexposed EAs have specific characteristics, which are manually summarized into six typical misuse patterns. As a consequence, ten heuristics are designed to decide whether an activity should be exposed or not and are implemented into an automatic tool called Mist. Experiments on the collected apps show that around one fifth EAs are unnecessarily exposed and there are more than one third EAs whose exposure may not be suggested.

References

1. Erika Chin, Adrienne Porter Felt, Kate Greenwood, and David A. Wagner. Analyzing inter-application communication in Android. In Proceedings of the 9th International Conference on Mobile Systems, Applications, and Services (MobiSys 2011), pages 239–252, 2011.
2. Roee Hay, Omer Tripp, and Marco Pistoia. Dynamic detection of inter-application communication vulnerabilities in Android. In Proceedings of the 2015 International Symposium on Software Testing and Analysis, pages 118–128, 2015.
3. Adrienne Porter Felt, Erika Chin, Steve Hanna, Dawn Song, and David A. Wagner. Android permissions demystified. In Proceedings of the 18th ACM Conference on Computer and Communications Security, CCS, pages 627–638, 2011.
4. Li Li, Alexandre Bartel, Tegawendé F. Bissyandé, Jacques Klein, Yves Le Traon, Steven Arzt, Siegfried Rasthofer, Eric Bodden, Damien Octeau, and Patrick Mc-Daniel. IccTA: Detecting inter-component privacy leaks in Android apps. In Proceedings of the 37th IEEE/ACM International Conference on Software Engineering, pages 280–291, 2015.
5. Michael C. Grace, Yajin Zhou, Zhi Wang, and Xuxian Jiang. Systematic detection of capability leaks in stock Android smartphones. In 19th Annual Network and Distributed System Security Symposium, NDSS, 2012.
6. Hamid Bagheri, Alireza Sadeghi, Joshua Garcia, and Sam Malek. COVERT: compositional analysis of Android inter-app permission leakage. IEEE Transactions on Software Engineering, 41(9):866–886, 2015.
7. Joshua Garcia, Mahmoud Hammad, Negar Ghorbani, and Sam Malek. Automatic generation of inter-component communication exploits for Android applications. In Proceedings of the 2017 11th Joint Meeting on Foundations of Software Engineering, ESEC/FSE, pages 661–671, 2017.
8. Jun Ma, Shaocong Liu, Yanyan Jiang, Xianping Tao, Chang Xu, and Jian Lu. Lesdroid - a tool for detecting exported service leaks of Android applications. The preprint is available at website http://moon.nju.edu.cn/people/junma/static/ files/LesDroid(pre-print).pdf, 2018.
9. Fengguo Wei, Sankardas Roy, Xinming Ou, and Robby. Amandroid: A precise and general inter-component data flow analysis framework for security vetting of Android apps. In Proceedings of the 2014 ACM SIGSAC Conference on Computer and Communications Security, pages 1329–1341, 2014.
10. activity | Android Developers. https://developer.android.com/guide/topics/ manifest/activity-element.html, 2017.
11. Intents and Intent Filters | Android Developers. https://developer.android.com/ guide/components/intents-filters.html, 2017.
12. intent filter | Android Developers. https://developer.android.com/guide/topics/ manifest/intent-filter-element.html, 2017.
13. Online APK Downloader | Download APK Directly From Google Play To Your Computer. http://apkleecher.com/, 2017.
14. Open SDK. https://open.weixin.qq.com/cgi-bin/showdocument?action=dir_list& t=resource/res_list&verify=1&id=1417751808&token=&lang=en_US, 2017.
15. Soot. http://www.bodden.de/2008/09/22/soot-intra, 2017.
16. Reaching definition | Wikipedia. https://en.wikipedia.org/wiki/Reaching_ definition, 2017.
17. Use-define chain - Wikipedia. https://en.wikipedia.org/wiki/Use-define_chain, 2017.
18. Markus M. Breunig, Hans-Peter Kriegel, Raymond T. Ng, and Jörg Sander. LOF: identifying density-based local outliers. In Proceedings of the 2000 ACM SIGMOD International Conference on Management of Data, pages 93–104, 2000.
19. William F Clocksin and Christopher S Mellish. Programming in PROLOG. Springer Science & Business Media, 2003.
20. Dennis Merritt. Building expert systems in Prolog. Springer Science & Business Media, 2012.
21. covert. http://www.ics.uci.edu/~seal/projects/covert/index.html.
22. Steven Arzt, Siegfried Rasthofer, Christian Fritz, Eric Bodden, Alexandre Bartel, Jacques Klein, Yves Le Traon, Damien Octeau, and Patrick McDaniel. Flowdroid: precise context, flow, field, object-sensitive and lifecycle-aware taint analysis for Android apps. In Proceedings of the 2014 ACM SIGPLAN Conference on Programming Language Design and Implementation, pages 29:1–29:11, 2014.
23. Michael I. Gordon, Deokhwan Kim, Jeff H. Perkins, Limei Gilham, Nguyen Nguyen, and Martin C. Rinard. Information flow analysis of Android applications in droidsafe. In 22nd Annual Network and Distributed System Security Symposium, 2015.
24. Wei Huang, Yao Dong, Ana Milanova, and Julian Dolby. Scalable and precise taint analysis for Android. In Proceedings of the 2015 International Symposium on Software Testing and Analysis, pages 106–117, 2015.
25. Vitalii Avdiienko, Konstantin Kuznetsov, Alessandra Gorla, Andreas Zeller, Steven Arzt, Siegfried Rasthofer, and Eric Bodden. Mining apps for abnormal usage of sensitive data. In Proceedings of the 37th IEEE/ACM International Conference on Software Engineering, pages 426–436, 2015.
26. Songyang Wu, Pan Wang, Xun Li, and Yong Zhang. Effective detection of Android malware based on the usage of data flow APIs and machine learning. Information & Software Technology, 75:17–25, 2016.
27. Wei Yang, Xusheng Xiao, Benjamin Andow, Sihan Li, Tao Xie, and William Enck. Appcontext: Differentiating malicious and benign mobile app behaviors using context. In 37th IEEE/ACM International Conference on Software Engineering, pages 303–313, 2015.
28. Waqar Ahmad, Christian Kästner, Joshua Sunshine, and Jonathan Aldrich. Interapp communication in Android: developer challenges. In Proceedings of the 13th International Conference on Mining Software Repositories, MSR 2016, pages 177–188, 2016.
29. Damien Octeau, Patrick D. McDaniel, Somesh Jha, Alexandre Bartel, Eric Bodden, Jacques Klein, and Yves Le Traon. Effective inter-component communication mapping in Android: An essential step towards holistic security analysis. In Proceedings of the 22th USENIX Security Symposium, pages 543–558, 2013.
30. Damien Octeau, Daniel Luchaup, Matthew Dering, Somesh Jha, and Patrick McDaniel. Composite Constant Propagation: Application to Android Inter-Component Communication Analysis. In Proceedings of the 37th International Conference on Software Engineering, pages 77–88, 2015.
31. Li Li, Alexandre Bartel, Tegawendé F. Bissyandé, Jacques Klein, and Yves Le Traon. Apkcombiner: Combining multiple Android apps to support inter-app analysis. In Proceedings of 30th International Conference on ICT Systems Security and Privacy Protection, pages 513–527, 2015.
32. Epicc. http://siis.cse.psu.edu/epicc/.
33. Li Lyna Zhang, Chieh-Jan Mike Liang, Yunxin Liu, and Enhong Chen. Systematically testing background services of mobile apps. In Proceedings of the 32nd IEEE/ACM International Conference on Automated Software Engineering, ASE, pages 4–15, 2017.

Index Terms

• General and reference

  • Cross-computing tools and techniques

    • Empirical studies

• Software and its engineering

  • Software creation and management

    • Software verification and validation

      • Software defect analysis

        • Software testing and debugging