Dynamic detection of inter-application communication vulnerabilities in android

2015 International Symposium on Software Testing and Analysis, ISSTA 2015 - Proceedings

Volumn , Issue , 2015, Pages 118-128

  Hay, Roee ^a   Tripp, Omer ^b   Pistoia, Marco ^b  

^a IBM   (Israel)

^b IBM T J WATSON RESEARCH CENTER   (United States)

Author keywords

Algorithms; Experimentation; Security

Indexed keywords

ALGORITHMS; ANDROID (OPERATING SYSTEM); MESSAGE PASSING; SOFTWARE TESTING;

ANDROID PLATFORMS; AUTOMATED DISCOVERY; COMPREHENSIVE TESTING; DYNAMIC DETECTION; EFFECTIVE SOLUTION; EXPERIMENTATION; INTER-APPLICATION COMMUNICATIONS; SECURITY;

MOBILE SECURITY;

EID: 84963711206     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1145/2771783.2771800     Document Type: Conference Paper

References (23)

1. E. Chin, A. Felt, K. Greenwood, and D. Wagner. Analyzing inter-application communication in android. In Proceedings of the 9th International Conference on Mobile Systems, Applications, and Services, pages 239-252, 2011.
2. E. Chin, A. F. Porter, K. Greenwood, and D. Wagner. Analyzing inter-application communication in android. In Proceedings of the 9th International Conference on Mobile Systems, Applications, and Services, pages 239-252, 2011.
3. A. Cozzette, K. Lingel, S. Matsumoto, O. Ortlieb, J. Alexander, J. Betser, L. Florer, G. Kuenning, J. Nilles, and P. L. Reiher. Improving the security of android inter-component communication. In IM, pages 808-811, 2013.
4. W. Enck, P. Gilbert, B. G. Chun, L. P. Cox, J. Jung, P. McDaniel, and A. N. Sheth. Taintdroid: An information-flow tracking system for realtime privacy monitoring on smartphones. In Proceedings of the 9th USENIX Conference on Operating Systems Design and Implementation, pages 1-6, 2010.
5. W. Enck, M. Ongtang, and P. McDaniel. Understanding android security. IEEE Security and Privacy, 7(1):50-57, 2009.
6. R. Hay and Y. Amit. Android browser cross-application scripting (cve-2011-2357), August 2011.
7. IDC. Smartphone os market share, q1 2015, 2015.
8. D. Kantola, E. Chin, W. He, and D. Wagner. Reducing attack surfaces for intra-application communication in android. In SPSM, pages 69-80, 2012.
9. L. Lu, Z. Li, Z. Wu, W. Lee, and G. Jiang. Chex: Statically vetting android apps for component hijacking vulnerabilities. In Proceedings of the 2012 ACM Conference on Computer and Communications Security, pages 229-240.
10. T. Luo, H. Hao, W. Du, Y. Wang, and H. Yin. Attacks on webview in the android system. In Proceedings of the 27th Annual Computer Security Applications Conference, pages 343-352, 2011.
11. A. K. Maji, F. A. Arshad, S. Bagchi, and J. S. Rellermeyer. An empirical study of the robustness of inter-component communication in android. In DSN, pages 1-12, 2012.
12. R. Naraine. Google android vulnerable to drive-by browser exploit, 2008.
13. D. Octeau, P. McDaniel, S. Jha, A. Bartel, E. Bodden, J. Klein, and Y. L. Traon. Effective inter-component communication mapping in android with epicc: An essential step towards holistic security analysis. In Proceedings of the 22Nd USENIX Conference on Security, pages 543-558, 2013.
14. G. Portokalidis, P. Homburg, K. Anagnostakis, and H. Bos. Paranoid android: Versatile protection for smartphones. In Proceedings of the 26th Annual Computer Security Applications Conference, pages 347-356, 2010.
15. S. Rasthofer, S. Arzt, E. Lovat, and E. Bodden. Droidforce: Enforcing complex, data-centric, system-wide policies in android. In Proceedings of the 9th International Conference on Availability, Reliability and Security (ARES), 2014.
16. V. Rastogi, Y. Chen, and W. Enck. Appsplayground: Automatic security analysis of smartphone applications. In Proceedings of the Third ACM Conference on Data and Application Security and Privacy, pages 209-220, 2013.
17. M. Sagiv, T. Reps, and S. Horwitz. Precise interprocedural dataow analysis with applications to constant propagation. In Theor. Comput. Sci., pages 131-170, 1996.
18. R. Sasnauskas and J. Regehr. Intent fuzzer: Crafting intents of death. In Proceedings of the 2014 Joint International Workshop on Dynamic Analysis (WODA) and Software and System Performance Testing, Debugging, and Analytics (PERTEA), pages 1-5, 2014.
19. O. Shacham, E. Yahav, G. G. Gueta, A. Aiken, N. Bronson, M. Sagiv, and M. Vechev. Verifying atomicity via data independence. In Proceedings of the 2014 International Symposium on Software Testing and Analysis, pages 26-36, 2014.
20. T. Terada. a-A-S attacking android browsers via intent scheme urls, 2014.
21. P. Wolper. Expressing interesting properties of programs in propositional temporal logic. In Proceedings of the 13th ACM SIGACT-SIGPLAN Symposium on Principles of Programming Languages, pages 184-193, 1986.
22. K. Yang, J. Zhuge, Y. Wang, L. Zhou, and H. Duan. Intentfuzzer: Detecting capability leaks of android applications. In Proceedings of the 9th ACM Symposium on Information, Computer and Communications Security, pages 531-536, 2014.
23. H. Ye, S. Cheng, L. Zhang, and F. Jiang. Droidfuzzer: Fuzzing the android apps with intent-filter tag. In Proceedings of International Conference on Advances in Mobile Computing and Multimedia, pages 68:68-68:74, 2013.