Ripple: Reflection Analysis for Android Apps in Incomplete Information Environments

Transcription

1 Ripple: Reflection Analysis for Android Apps in Incomplete Information Environments Yifei Zhang, Tian Tan, Yue Li and Jingling Xue Programming Languages and Compilers Group University of New South Wales March 30, 2017

2 How do static Android security analyses work? 2

3 Android Apps Security Analysis dex Files Intermediate Represetations Call Graph Android Manifest Layout Files Intent Filters Callbacks... Decompilation Inter-procedural Control-flow Graph Pointer Analysis Resources Files File Extraction 3

4 Android Apps Security Analysis dex Files Intermediate Represetations Call Graph Android Manifest Layout Files Intent Filters Callbacks... Decompilation Inter-procedural Control-flow Graph Pointer Analysis Resources Files File Extraction 4

5 Android Apps Security Analysis dex Files Intermediate Represetations Call Graph Android Manifest Layout Files Intent Filters Callbacks... Decompilation Inter-procedural Control-flow Graph Pointer Analysis Resources Files File Extraction 5

6 Android Apps Security Analysis dex Files Intermediate Represetations Call Graph Android Manifest Layout Files Intent Filters Callbacks... Decompilation Inter-procedural Control-flow Graph Pointer Analysis Resources Files File Extraction ICSE CCS Usenix Security PLDI ASE FSE CCS NDSS POPL FSE Taint Analysis, API Misuse Analysis, Intent Injection Detection... 6

7 Taint Analysis: Goal Sensitive Data Sources User Identity, Private Information Data-flows Sinks Internet, Log Files 7

8 Taint Analysis: Method Enter main Enter foo Call foo Return foo Exit foo Exit main 8

9 Taint Analysis: Method Enter main Source Enter foo Call foo Sink Return foo Exit foo Exit main 9

10 Reflection: An Obstacle of Security Analysis Enter main Source method.invoke(o, args) Exit main 10

11 Reflection: An Obstacle of Security Analysis Enter main Source Arguments method.invoke(o, args) Method Meta-object Receiver Object Exit main 11

12 Reflection: An Obstacle of Security Analysis Enter main Source method.invoke(o, args) Enter bar Method bar Return bar Sink Exit main Exit bar 12

13 Reflection: An Obstacle of Security Analysis Enter main Source method.invoke(o, args) Enter bar Method bar Return bar Sink Exit main Exit bar 13

14 Ripple: Static Reflection analysis for Android Apps Enter main Source method.invoke(o, args) Enter bar Taint Analysis, API Misuse Analysis, Intent Injection Detection... Method bar Exit main Return bar Sink Exit bar Ripple ICSE CCS Usenix Security PLDI ASE FSE CCS NDSS POPL FSE 14

15 Backgrounds of Reflection 15

16 What is reflection? A dynamic programming language feature Enable developers to create objects and invoke methods by their names 16

17 Why Do We Use Reflection? A dynamic programming language feature Enable developers to create objects and invoke methods by their names Intensively being used to Provide plugin and external library support Invoke hidden APIs 17

18 Goals of Static Reflection Analysis Static reflection Analysis aims to Find reflective call targets: the type of the objects and methods being reflectively created and invoked 18

19 Goals of Static Reflection Analysis Static reflection Analysis aims to Find reflective call targets: the type of the objects and methods being reflectively created and invoked Enter main Source method.invoke(o, args) Enter bar Method bar Return bar Sink Exit bar Exit main Ripple 19

20 State-of-the-art Reflection Analysis for Android: String Constant Resolution Method: Using constant class and method names 20

21 State-of-the-art Reflection Analysis for Android: String Constant Resolution Method: Using constant class and method names Weakness The nature of reflection: providing flexibility. Sting constants do not always present Obfuscation: encrypted class and method names 21

22 Insight: Incomplete Information Environments (IIE) IIEs cause missing data-flows, which exacerbates static reflection analysis Undetermined Intents Unresolved Containers Sources of IIEs Behavior-Unknown Libraries Unmodeled Services IIE-Aware Reflection Analysis String Constant Reflection Resolution Type Inference Reflection Resolution Client Analyses 22

23 Insight: Incomplete Information Environments (IIE) IIEs cause missing data-flows, which exacerbates static reflection analysis Undetermined Intents Unresolved Containers Sources of IIEs Behavior-Unknown Libraries Unmodeled Services IIE-Aware Reflection Analysis String Constant Reflection Resolution Type Inference Reflection Resolution Client Analyses 23

24 Methodology An example to illustrate how Ripple works 24

25 Ripple: IIE-aware Reflection Analysis 1 String mname = getintent().getstringextra("methodname"); 2 Method logmtd = Log.class.getMethod(mName, String.class, String.class); 3 String tag = "..."; 4 String msg = "..."; 5 logmtd.invoke(null, tag, msg); } } 25

26 Ripple: IIE-aware Reflection Analysis IIE 1 String mname = getintent().getstringextra("methodname"); 2 Method logmtd = Log.class.getMethod(null, String.class, String.class); 3 String tag = "..."; 4 String msg = "..."; 5 logmtd.invoke(null, tag, msg); } } 26

27 Ripple: IIE-aware Reflection Analysis Method { Class Type: Log Name: Unknown } IIE 1 String mname = getintent().getstringextra("methodname"); 2 Method logmtd = Log.class.getMethod(null, String.class, String.class); 3 String tag = "..."; 4 String msg = "..."; 5 logmtd.invoke(null, tag, msg); } } 27

28 Ripple: IIE-aware Reflection Analysis Method { Class Type: Log Name: Unknown } Static (String, String) IIE 1 String mname = getintent().getstringextra("methodname"); 2 Method logmtd = Log.class.getMethod(null, String.class, String.class); 3 String tag = "..."; 4 String msg = "..."; 5 logmtd.invoke(null, tag, msg); } } 28

29 Ripple: IIE-aware Reflection Analysis Method { Class Type: Log Name: Unknown } Static (String, String) IIE 1 String mname = getintent().getstringextra("methodname"); 2 Method logmtd = Log.class.getMethod(null, String.class, String.class); 3 String tag = "..."; 4 String msg = "..."; 5 logmtd.invoke(null, tag, msg); } } 1 public class Log { 2 public static int i(string tag, String msg) {} 3 public static int d(string tag, String msg) {} 4 public static int w(string tag, String msg) {} 5 public static int e(string tag, String msg) {} 6 public static int v(string tag, String msg) {} 7 public static int wtf(string tag, String msg) {} Other 11 methods... } 29

30 Ripple: IIE-aware Reflection Analysis Method { Class Type: Log Name: Unknown } Static (String, String) IIE 1 String mname = getintent().getstringextra("methodname"); 2 Method logmtd = Log.class.getMethod(null, String.class, String.class); 3 String tag = "..."; 4 String msg = "..."; 5 logmtd.invoke(null, tag, msg); } } 1 public class Log { 2 public static int i(string tag, String msg) {} 3 public static int d(string tag, String msg) {} Sink 4 public static int w(string tag, String msg) {} Calls 5 public static int e(string tag, String msg) {} 6 public static int v(string tag, String msg) {} 7 public static int wtf(string tag, String msg) {} Other 11 methods... } 30

31 Ripple: IIE-aware Reflection Analysis Method { Class Type: Log Name: Unknown } Static (String, String) IIE 1 String mname = getintent().getstringextra("methodname"); 2 Method logmtd = Log.class.getMethod(null, String.class, String.class); 3 String tag = "..."; 4 String msg = "..."; 5 logmtd.invoke(null, tag, msg); } } 1 public class Log { 2 public static int i(string tag, String msg) {} 3 public static int d(string tag, String msg) {} Sink 4 public static int w(string tag, String msg) {} Calls 5 public static int e(string tag, String msg) {} 6 public static int v(string tag, String msg) {} 7 public static int wtf(string tag, String msg) {} Other 11 methods... } In one of the top-chart Android app named Twist, resolving logmtd.invoke() causes 12 more data leaks to be reported by FlowDroid. 31

32 Implementation & Evaluation 32

33 Implementation Ripple is built upon SOOT analysis framework Ripple works with SPARK pointer analysis Most significant reflective APIs that affect the static analysis are handled Entry methods: Class.forName() Member-instrospecting Methods: Method.getMethod(), Method.getDeclaredMethod(), Method.getMethods(), and Method.getDeclaredMethods() Side-effect methods: Class.newInstance(), Method.invoke() 33

34 Evaluation: Precision Real-world Apps: 17 top-chart Android apps from Google Play 34

35 Evaluation: Precision Real-world Apps: 17 top-chart Android apps from Google Play Ripple: 232 true targets with a low false positive rate 21.9% String inference: 160 true targets A net gain of 72 true targets are yielded and thus a 45% increase in soundness on reflection analysis 35

36 Evaluation: Effectiveness Integrate Ripple into FlowDroid, a taint analysis framework for Android apps More sound callgraph: 13 out of the 17 apps being evaluated Data leaks detected: 310 more sensitive data leakages are detected by FlowDroid 36

37 Android Security Analyses: A Revisit 37

38 Revisit Android Apps Security Analysis dex Files Intermediate Represetations Call Graph Android Manifest Layout Files Intent Filters Callbacks... Decompilation Inter-procedural Control-flow Graph Pointer Analysis Resources Files File Extraction Taint Analysis, API Misuse Analysis, Intent Injection Detection... 38

39 Revisit Android Apps Security Analysis dex Files Intermediate Represetations Call Graph Android Manifest Layout Files Intent Filters Callbacks... Decompilation Inter-procedural Control-flow Graph Pointer Analysis Ripple Resources Files File Extraction Taint Analysis, API Misuse Analysis, Intent Injection Detection... 39

40 Yifei Zhang Mail: Homepage: cse.unsw.edu.au/~yzhang Open source program analysis tools on Java, C and C++ shared by our group can be found at cse.unsw.edu.au/~jingling/tools.html