A large scale analysis of Android
- Many Android applications embed webpages via WebView components and execute JavaScript code within Android. Hybrid applications leverage dedicated APIs to load a resource and render it in a WebView. Furthermore, Android objects can be shared with the JavaScript world. However, bridging the interfaces of the Android and JavaScript world might also incur severe security threats: Potentially untrusted webpages and their JavaScript might interfere with the Android environment and its access to native features. No general analysis is currently available to assess the implications of such hybrid apps bridging the two worlds. To understand the semantics and effects of hybrid apps, we perform a large-scale study on the usage of the hybridization APIs in the wild. We analyze and categorize the parameters to hybridization APIs for 7,500 randomly selected and the 196 most popular applications from the Google Playstore as well as 1000 malware samples. Our results advance the general understanding of hybrid applications, as well as implicationsMany Android applications embed webpages via WebView components and execute JavaScript code within Android. Hybrid applications leverage dedicated APIs to load a resource and render it in a WebView. Furthermore, Android objects can be shared with the JavaScript world. However, bridging the interfaces of the Android and JavaScript world might also incur severe security threats: Potentially untrusted webpages and their JavaScript might interfere with the Android environment and its access to native features. No general analysis is currently available to assess the implications of such hybrid apps bridging the two worlds. To understand the semantics and effects of hybrid apps, we perform a large-scale study on the usage of the hybridization APIs in the wild. We analyze and categorize the parameters to hybridization APIs for 7,500 randomly selected and the 196 most popular applications from the Google Playstore as well as 1000 malware samples. Our results advance the general understanding of hybrid applications, as well as implications for potential program analyses, and the current security situation: We discovered thousands of flows of sensitive data from Android to JavaScript, the vast majority of which could flow to potentially untrustworthy code. Our analysis identified numerous web pages embedding vulnerabilities, which we exemplarily exploited. Additionally, we discovered a multitude of applications in which potentially untrusted JavaScript code may interfere with (trusted) Android objects, both in benign and malign applications.…
Author details: | Abhishek TiwariORCiDGND, Jyoti PrakashORCiD, Sascha GroßORCiDGND, Christian HammerORCiD |
---|---|
DOI: | https://doi.org/10.1016/j.jss.2020.110775 |
ISSN: | 0164-1212 |
ISSN: | 1873-1228 |
Title of parent work (English): | The journal of systems and software |
Subtitle (English): | Web hybridization |
Publisher: | Elsevier |
Place of publishing: | New York |
Publication type: | Article |
Language: | English |
Date of first publication: | 2020/08/18 |
Publication year: | 2020 |
Release date: | 2023/03/24 |
Tag: | Android hybrid apps; information flow control; static analysis |
Volume: | 170 |
Article number: | 110775 |
Number of pages: | 17 |
Funding institution: | German Federal Ministry of Education and Research (BMBF)Federal Ministry; of Education & Research (BMBF) [16KIS0760]; German Research Foundation; (DFG) via the collaborative research center ``Methods and Tools for; Understanding and Controlling Privacy''German Research Foundation (DFG); [SFB 1223] |
Organizational units: | Mathematisch-Naturwissenschaftliche Fakultät / Institut für Informatik und Computational Science |
DDC classification: | 0 Informatik, Informationswissenschaft, allgemeine Werke / 00 Informatik, Wissen, Systeme / 000 Informatik, Informationswissenschaft, allgemeine Werke |
Peer review: | Referiert |