Automated Generation of Event-Oriented Exploits in Android Hybrid Apps

Size: px

Start display at page:

Download "Automated Generation of Event-Oriented Exploits in Android Hybrid Apps"

Hilary Caldwell
6 years ago
Views:

1 Automated Generation of Event-Oriented Exploits in Android Hybrid Apps Guangliang Yang, Jeff Huang, and Guofei Gu *Secure Communication and Computer Systems Lab Texas A&M University

2 In Android, the hybrid development approach is popular The use of the embedded browser, known as "WebView" rendering web content and running JavaScript code without leaving apps (i.e., hybrid apps) Advantages Easy to deploy Re-using existing web code

3 Event Handler: A unique WebView feature Through the event handler feature, developers can handle/customize web events. Security Flaws! Changing web UI, such as drawing web alert dialogs Supporting customized URL, such as tel:800 -> making a call 94.2% apps use the event handler feature

4 Event Handler: A unique WebView feature Handling/Customizing web events via Event Handler WebView HTML/JavaScript Code Web Event Native (Java) Event Handler Hybrid App

5 Event Handler: A unique WebView feature Handling/Customizing web events via Event Handler WebView HTML/JavaScript Code Native (Java) Event Handler Hybrid App

6 Attacking Event Handlers Potential Attack#1: triggering an event handler with appropriate input WebView HTML/JavaScript Code Server Native (Java) Event Handler Hybrid App Android Device

7 Attacking Event Handlers Potential Attack#1: triggering an event handler with appropriate input WebView <a href = mmsdk://c1.c2?args=...&callback=... Native shouldoverrideurlloading(webview view, String url) { } function1 hashmap(c1. c2) result = function1(args) loadurl( javascript: + callback + ( + result + ) );

8 Attacking Event Handlers Potential Attack#1: triggering an event handler with appropriate input WebView <a href = mmsdk://c1.c2?args=...&callback=... Native shouldoverrideurlloading(webview view, String url) { ) ); } function1 hashmap(c1. c2) Implicit Flow result = function1(args) loadurl( javascript: + callback + ( + result +

9 Attacking Event Handlers Potential Attack#1: triggering an event handler with appropriate input WebView Native 1. Recording audio <a href = mmsdk://c1.c2?args=...&callback= Using camera to take pictures shouldoverrideurlloading(webview view, String url) { 3. Leaking device ID 4. Attacking other apps using Intent 5. ) ); } function1 hashmap(c1. c2) Implicit Flow result = function1(args) loadurl( javascript: + callback + ( + result +

10 Attacking Event Handlers Potential Attack#1: triggering an event handler with appropriate input Event Handler#1 Target

11 Attacking Event Handlers Potential Attack#1: triggering an event handler with appropriate input Event Handler#1 Target

12 Attacking Event Handlers Potential Attack#1: triggering an event handler with appropriate input Event Handler#1 Target

13 Attacking Event Handlers Potential Attack#1: triggering an event handler with appropriate input Event Handler#2 Event Handler#1 Target

14 Attacking Event Handlers Potential Attack#1: triggering an event handler with appropriate input Event Handler#2 Event Handler#1 Target

15 Attacking Event Handlers Potential Attack#1: triggering an event handler with appropriate input Event Handler#2 Event Handler#1 Event Handler#2 Event Handler#1 Target

16 Attacking Event Handlers Potential Attack#2: Playing web events as gadgets The target program state is S t State transitions: [S 1 S 2... S t ] Web events triggering: [E 1 E 2... E t ]

17 Attacking Event Handlers Potential Attack#2: Playing web events as gadgets The target program state is S t [S 1 S 2... S t ] [E 1 E 2... E t ] Generalizing Attacks: Event Oriented Exploits (EOE) [EH 1 EH 2... EH t ]

18 Event Oriented Exploits Consequences Cross-origin/frame DOM manipulation Phishing Sensitive information leakage (such as IMEI and GPS) Local resource access (such as local database), etc. Detecting and verifying existing apps against EOE

19 Detecting and verifying apps against EOE Exiting techniques face significant challenges Static analysis (AppIntent, IntelliDroid, TriggerScope, etc.) False positives lack of real data and context False negatives Java Reflection Implicit flows

20 Detecting and verifying apps against EOE Recap WebView <a href = mmsdk://c1.c2?args=...&callback=... Native shouldoverrideurlloading(webview view, String url) { function1 hashmap(c1. c2) Implicit Flow }

21 Detecting and verifying apps against EOE Exiting techniques face significant challenges Static analysis (AppIntent, IntelliDroid, TriggerScope, etc.) False positives Lack of real data and context False negatives Java Reflection Implicit flows (Google Ads, etc.)

22 Detecting and verifying apps against EOE Exiting techniques face significant challenges Dynamic analysis False negatives low code coverage Our Solution: EOEDroid

23 Our Solution: EOEDroid 1. Dynamic Symbolic Execution 2. Static backward analysis 3. Log analysis

24 Our Solution: EOEDroid 1. Dynamic Symbolic Execution 2. Static backward analysis 3. Log analysis

25 How does EOEDroid work? Event Handler#2 Event Handler#1 Target

26 How does EOEDroid work? Event Handler#2 Event Handler#1 Target

27 Our Solution: EOEDroid 1. Dynamic Symbolic Execution 2. Static backward analysis 3. Log analysis

28 How does EOEDroid work? Event Handler#2 Event Handler#1 Target

29 How does EOEDroid work? Event Handler#2 Event Handler#1 Event Handler#2 Event Handler#1 Target

30 Our Solution: EOEDroid 1. Dynamic Symbolic Execution 2. Static backward analysis 3. Log analysis

31 Our Solution: EOEDroid 1. Dynamic Symbolic Execution 2. Static backward analysis 3. Log analysis

32 Phase1: Event Handler Analysis Symbolic Execution Challenges Path explosion Discovering interesting paths Unsupported Fork() Keeping analysis contexts clean Hooking external-contentwriting Android ICC: intent Linking intent senders and receivers Implicit Flows Converting implicit flows to regular conditional statements

33 Our Solution: EOEDroid 1. Dynamic Symbolic Execution 2. Static backward analysis 3. Log analysis

34 Phase2: Program State Analysis Event handler input generation Computing path constraints Event handler execution order generation Static backward analysis

35 Our Solution: EOEDroid 1. Dynamic Symbolic Execution 2. Static backward analysis 3. Log analysis

36 Phase3: Exploit Code Generation Conducting the systematic study of event handler triggering code and constraints Web events -> Native event handlers Transferring data Triggering constraints

37 Our Solution: EOEDroid Recap WebView <a href = mmsdk://c1.c2?args=...&callback=... Native shouldoverrideurlloading(webview view, String url) { ) ); } loadurl( javascript: + callback + ( + result +

38 Phase3: Exploit Code Generation JavaScript Code Syntax Analysis Analyzing Abstracted Syntax Tree

39 RESULTS / EVALUATION

40 Evaluation Dataset 3,652 popular apps Testbed Android Nexus 10 Methodology Monkey + Mitmproxy

41 Results 97 vulnerabilities 58 vulnerable apps Low false positives & false negatives Analysis time / per app: ~4 minutes

42 CASE STUDY

43 Case Study: Discovering a potential backdoor A high-profile browser (com.mx.xxxx) 10 million downloads Using EOE to leverage a potential backdoor Stealing IMEI

44 Case Study: Discovering a potential backdoor

45 Case Study: Discovering a potential backdoor Phase#1: applying symbolic execution to analyze each event handler

46 Case Study: Discovering a potential backdoor

47 Case Study: Discovering a potential backdoor Phase#2: applying static analysis to generate the required event handler execution order

48 Case Study: Discovering a potential backdoor Phase#2: applying static analysis to generate the required event handler execution order onpagefinished() shouldoverrideurlloading()

49 Case Study: Discovering a potential backdoor Phase#3: Generating exploit code onpagefinished() shouldoverrideurlloading()

50 CONCLUSION

51 Conclusion Despite existing discussion, the event handler feature continues to be problematic in existing apps. In this paper, we discovered the event handler feature may cause serious consequences. We propose a novel vulnerability detection and verification tool (EOEDroid), and also verified our tool is accurate and effective.

52 Thanks!

53 Detecting and verifying apps against EOE Recap WebView <a href = mmsdk://c1.c2?args=...&callback=... Native shouldoverrideurlloading(webview view, String url) { function1 hashmap(c1. c2) Implicit Flow }

54 Phase1: Event Handler Analysis Implicit Flows Converting implicit flows to regular conditional statements Hashmap r = hashmap.get(k) [k 0, k 1, k 2,..., k n ] Conversion

55 Phase3: Exploit Code Generation Conducting the systematic study of event handler triggering code and constraints Web events -> Native event handlers Transferring data Triggering constraints JavaScript Code Syntax Analysis Analyzing Abstracted Syntax Tree

56 Related Work NoFrak, MobileIFC, and Draco: extending same origin policy (SOP) to the native layer, or providing access control on event handlers Hard to deploy Hard to upgrade Course-grained WIREframe and HybridGuard: providing policy enforcement They only focus on JavaScript code. They can be bypassed by EOE.

57 Countermeasure Using safe connection channel: HTTPS Checking the frame level and the origin information of the event handler caller Upgrade WebView to the newest version Providing new APIs with rich information

Study and Mitigation of Origin Stripping Vulnerabilities in Hybrid-postMessage Enabled Mobile Applications

Study and Mitigation of Origin Stripping Vulnerabilities in Hybrid-postMessage Enabled Mobile Applications Guangliang Yang, Jeff Huang, Guofei Gu, and Abner Mendoza Texas A&M University {ygl, jeffhuang,