TY - JOUR A1 - Tiwari, Abhishek A1 - Prakash, Jyoti A1 - Groß, Sascha A1 - Hammer, Christian T1 - A large scale analysis of Android BT - Web hybridization JF - The journal of systems and software N2 - Many Android applications embed webpages via WebView components and execute JavaScript code within Android. Hybrid applications leverage dedicated APIs to load a resource and render it in a WebView. Furthermore, Android objects can be shared with the JavaScript world. However, bridging the interfaces of the Android and JavaScript world might also incur severe security threats: Potentially untrusted webpages and their JavaScript might interfere with the Android environment and its access to native features. No general analysis is currently available to assess the implications of such hybrid apps bridging the two worlds. To understand the semantics and effects of hybrid apps, we perform a large-scale study on the usage of the hybridization APIs in the wild. We analyze and categorize the parameters to hybridization APIs for 7,500 randomly selected and the 196 most popular applications from the Google Playstore as well as 1000 malware samples. Our results advance the general understanding of hybrid applications, as well as implications for potential program analyses, and the current security situation: We discovered thousands of flows of sensitive data from Android to JavaScript, the vast majority of which could flow to potentially untrustworthy code. Our analysis identified numerous web pages embedding vulnerabilities, which we exemplarily exploited. Additionally, we discovered a multitude of applications in which potentially untrusted JavaScript code may interfere with (trusted) Android objects, both in benign and malign applications. KW - Android hybrid apps KW - static analysis KW - information flow control Y1 - 2020 U6 - https://doi.org/10.1016/j.jss.2020.110775 SN - 0164-1212 SN - 1873-1228 VL - 170 PB - Elsevier CY - New York ER - TY - CHAP A1 - Lass, Sander A1 - Bender, Benedict T1 - Dedicated Data Sovereignty as Enabler for Platform-Based Business Models T2 - Proceedings of the 2. Conference on Production Systems and Logistics N2 - The digitalization of value networks holds out the prospect of many advantages for the participating compa- nies. Utilizing information platforms, cross-company data exchange enables increased efficiency of collab- oration and offers space for new business models and services. In addition to the technological challenges, the fear of know-how leakage appears to be a significant roadblock that hinders the beneficial realization of new business models in digital ecosystems. This paper provides the necessary building blocks of digital participation and, in particular, classifies the issue of trust creation within it as a significant success factor. Based on these findings, it presents a solution concept that, by linking the identified building blocks, offers the individual actors of the digital value network the opportunity to retain sovereignty over their data and know-how and to use the potential of extensive networking. In particular, the presented concept takes into account the relevant dilemma, that every actor (e. g. the machine users) has to be able to control his commu- nicated data at any time and have sufficient possibilities for intervention that, on the one hand, satisfy the need for protection of his knowledge and, on the other hand, do not excessively diminish the benefits of the system or the business. Taking up this perspective, this paper introduces dedicated data sovereignty and shows a possible implementation concept. KW - information gateway KW - data security KW - information flow control KW - platform acceptance Y1 - 2021 U6 - https://doi.org/10.15488/11299 SP - 382 EP - 393 PB - publish-Ing. CY - Hannover ER -