Detecting Vulnerabilities of Broadcast Receivers in Android Applications
نویسنده
چکیده
As being a representative mobile operating system in the world, Android OS has been part of users’ daily life. Unfortunately, the rapid expansion of Android third-markets introduces malware aiming at Android applications at an alarming rate, which poses great threats to its users. Current research about the privacy leakage in Android mostly focuses on Activity, Service and Content Providers. Little attention has been paid to the vulnerability of Broadcast Receiver, which is expected to assist intercomponent collaboration and facilitate component reutilization. In this thesis, we first present a detailed analysis on vulnerabilities of Broadcast Receiver. Then, we design and develop a Broadcast Receiver Vulnerability Detection (BRVD) system that examines such vulnerabilities, using a combination of semantic analysis and taint analysis. Furthermore, we perform experimental evaluation by analyzing 55 applications from Android third-markets using the proposed system; and 132 registered receivers are found with 11 vulnerable receivers being verified.
منابع مشابه
Detecting Passive Content Leaks and Pollution in Android Applications
In this paper, we systematically study two vulnerabilities and their presence in existing Android applications (or “apps”). These two vulnerabilities are rooted in an unprotected Android component, i.e., content provider, inside vulnerable apps. Because of the lack of necessary access control enforcement, affected apps can be exploited to either passively disclose various types of private in-ap...
متن کاملSecurity considerations related to the use of mobile devices in the operation of critical infrastructures
An increasing number of attacks by mobile malware have begun to target critical infrastructure assets. Since malware attempts to defeat the security mechanisms provided by an operating system, it is of paramount importance to understand the strengths and weaknesses of the security frameworks of mobile device operating systems such as Android. Many recently discovered vulnerabilities suggest tha...
متن کاملA Survey on Potential Privacy Leaks of GPS Information in Android Applications
....................................................................... iii ACKNOWLEDGEMENTS...................................................... iv TABLE OF CONTENTS......................................................... v LIST OF TABLES................................................................. ix LIST OF FIGURES............................................................... x CHAPTE...
متن کاملAndroid Inter-App Communication Threats, Solutions, and Challenges
Researchers and commercial companies have made a lot of efforts on detecting malware in Android platform. However, a recent malware threat, App collusion, makes malware detection challenging. In App collusion, two or more Apps collaborate to perform malicious actions by communicating with each other, which makes single App analysis insufficient. In this paper, we first introduce Android securit...
متن کاملStatic Detection and Automatic Exploitation of Intent Message Vulnerabilities in Android Applications
Android’s Inter-Component Communication (ICC) mechanism strongly relies on Intent messages. Unfortunately, due to the lack of message origin verification in Intents, implementing security policies based on message sources is hard in practice, and completely relies on the programmer’s skill and attention. In this paper, we present a framework for automatically detecting Intent input validation v...
متن کامل