Vulnerability Detection on Android Apps–Inspired by Case Study on Vulnerability Related With Web Functions
Nowadays, people's lifestyle is more and more dependent on mobile applications (Apps), such as shopping, financial management and surfing the internet. However, developers mainly focus on the implementation of Apps and the improvement of user experience while ignoring security issues. In this p...
| Main Authors: | , , , , , |
|---|---|
| Format: | Article |
| Language: | English |
| Published: |
IEEE
2020-01-01
|
| Series: | IEEE Access |
| Subjects: | |
| Online Access: | https://ieeexplore.ieee.org/document/9102313/ |
| _version_ | 1818929450499178496 |
|---|---|
| author | Jiawei Qin Hua Zhang Jing Guo Senmiao Wang Qiaoyan Wen Yijie Shi |
| author_facet | Jiawei Qin Hua Zhang Jing Guo Senmiao Wang Qiaoyan Wen Yijie Shi |
| author_sort | Jiawei Qin |
| collection | DOAJ |
| description | Nowadays, people's lifestyle is more and more dependent on mobile applications (Apps), such as shopping, financial management and surfing the internet. However, developers mainly focus on the implementation of Apps and the improvement of user experience while ignoring security issues. In this paper, we perform the comprehensive study on vulnerabilities caused by misuse of APIs and form a methodology for this type of vulnerability analysis. We investigate the security of three types of Android Apps including finance, shopping and browser which are closely related to human life. And we analyze four vulnerabilities including Improper certificate validation(CWE-295:ICV), WebView bypass certificate validation vulnerability(CVE-2014-5531:WBCVV), WebView remote code execution vulnerability(CVE-2014-1939:WRCEV) and Alibaba Cloud OSS credential disclosure vulnerability(CNVD-2017-09774:ACOCDV). In order to verify the effectiveness of our analysis method in large-scale Apps on the Internet, we propose a novel scalable tool - VulArcher, which is based on heuristic method and used to discover if the above vulnerabilities exist in Apps. We download a total of 6114 of the above three types of samples in App stores, and we use VulArcher to perform the above vulnerability detection for each App. We perform manual verification by randomly selecting 100 samples of each vulnerability. We find that the accuracy rate for ACOCDV can reach 100%, the accuracy rate for WBCVV can reach 95%, and the accuracy rate for the other two vulnerabilities can reach 87%. And one of vulnerabilities detected by VulArcher has been included in China National Vulnerability Database (CNVD) ID(CNVD-2017-23282). Experiments show that our tool is feasible and effective. For the convenience of researchers in related communities, We make our data and tool available at https://buptnsrclab.github.io/blog/2020/01/03/vularcher-site-launched. |
| first_indexed | 2024-12-20T03:45:00Z |
| format | Article |
| id | doaj.art-d82beb1b8f144f19a7080c4fe3b97dab |
| institution | Directory Open Access Journal |
| issn | 2169-3536 |
| language | English |
| last_indexed | 2024-12-20T03:45:00Z |
| publishDate | 2020-01-01 |
| publisher | IEEE |
| record_format | Article |
| series | IEEE Access |
| spelling | doaj.art-d82beb1b8f144f19a7080c4fe3b97dab2022-12-21T19:54:38ZengIEEEIEEE Access2169-35362020-01-01810643710645110.1109/ACCESS.2020.29980439102313Vulnerability Detection on Android Apps–Inspired by Case Study on Vulnerability Related With Web FunctionsJiawei Qin0Hua Zhang1https://orcid.org/0000-0002-0532-9783Jing Guo2Senmiao Wang3Qiaoyan Wen4https://orcid.org/0000-0001-7142-9726Yijie Shi5State Key Laboratory of Networking and Switching Technology, Beijing University of Posts and Telecommunications, Beijing, ChinaState Key Laboratory of Networking and Switching Technology, Beijing University of Posts and Telecommunications, Beijing, ChinaNational Computer Network Emergency Response Technical Team/Coordination Center of China, Beijing, ChinaState Key Laboratory of Networking and Switching Technology, Beijing University of Posts and Telecommunications, Beijing, ChinaState Key Laboratory of Networking and Switching Technology, Beijing University of Posts and Telecommunications, Beijing, ChinaState Key Laboratory of Networking and Switching Technology, Beijing University of Posts and Telecommunications, Beijing, ChinaNowadays, people's lifestyle is more and more dependent on mobile applications (Apps), such as shopping, financial management and surfing the internet. However, developers mainly focus on the implementation of Apps and the improvement of user experience while ignoring security issues. In this paper, we perform the comprehensive study on vulnerabilities caused by misuse of APIs and form a methodology for this type of vulnerability analysis. We investigate the security of three types of Android Apps including finance, shopping and browser which are closely related to human life. And we analyze four vulnerabilities including Improper certificate validation(CWE-295:ICV), WebView bypass certificate validation vulnerability(CVE-2014-5531:WBCVV), WebView remote code execution vulnerability(CVE-2014-1939:WRCEV) and Alibaba Cloud OSS credential disclosure vulnerability(CNVD-2017-09774:ACOCDV). In order to verify the effectiveness of our analysis method in large-scale Apps on the Internet, we propose a novel scalable tool - VulArcher, which is based on heuristic method and used to discover if the above vulnerabilities exist in Apps. We download a total of 6114 of the above three types of samples in App stores, and we use VulArcher to perform the above vulnerability detection for each App. We perform manual verification by randomly selecting 100 samples of each vulnerability. We find that the accuracy rate for ACOCDV can reach 100%, the accuracy rate for WBCVV can reach 95%, and the accuracy rate for the other two vulnerabilities can reach 87%. And one of vulnerabilities detected by VulArcher has been included in China National Vulnerability Database (CNVD) ID(CNVD-2017-23282). Experiments show that our tool is feasible and effective. For the convenience of researchers in related communities, We make our data and tool available at https://buptnsrclab.github.io/blog/2020/01/03/vularcher-site-launched.https://ieeexplore.ieee.org/document/9102313/Static analysisvulnerabilitymobile agentssecurityapplication softwaredetection algorithms |
| spellingShingle | Jiawei Qin Hua Zhang Jing Guo Senmiao Wang Qiaoyan Wen Yijie Shi Vulnerability Detection on Android Apps–Inspired by Case Study on Vulnerability Related With Web Functions IEEE Access Static analysis vulnerability mobile agents security application software detection algorithms |
| title | Vulnerability Detection on Android Apps–Inspired by Case Study on Vulnerability Related With Web Functions |
| title_full | Vulnerability Detection on Android Apps–Inspired by Case Study on Vulnerability Related With Web Functions |
| title_fullStr | Vulnerability Detection on Android Apps–Inspired by Case Study on Vulnerability Related With Web Functions |
| title_full_unstemmed | Vulnerability Detection on Android Apps–Inspired by Case Study on Vulnerability Related With Web Functions |
| title_short | Vulnerability Detection on Android Apps–Inspired by Case Study on Vulnerability Related With Web Functions |
| title_sort | vulnerability detection on android apps x2013 inspired by case study on vulnerability related with web functions |
| topic | Static analysis vulnerability mobile agents security application software detection algorithms |
| url | https://ieeexplore.ieee.org/document/9102313/ |
| work_keys_str_mv | AT jiaweiqin vulnerabilitydetectiononandroidappsx2013inspiredbycasestudyonvulnerabilityrelatedwithwebfunctions AT huazhang vulnerabilitydetectiononandroidappsx2013inspiredbycasestudyonvulnerabilityrelatedwithwebfunctions AT jingguo vulnerabilitydetectiononandroidappsx2013inspiredbycasestudyonvulnerabilityrelatedwithwebfunctions AT senmiaowang vulnerabilitydetectiononandroidappsx2013inspiredbycasestudyonvulnerabilityrelatedwithwebfunctions AT qiaoyanwen vulnerabilitydetectiononandroidappsx2013inspiredbycasestudyonvulnerabilityrelatedwithwebfunctions AT yijieshi vulnerabilitydetectiononandroidappsx2013inspiredbycasestudyonvulnerabilityrelatedwithwebfunctions |