Borrowing your enemy’s arrows: the case of code reuse in Android via direct inter-app code invocation

Abstract

The Android ecosystem offers different facilities to enable communication among app components and across apps to ensure that rich services can be composed through functionality reuse. At the heart of this system is the Inter-component communication (ICC) scheme, which has been largely studied in the literature. Less known in the community is another powerful mechanism that allows for direct inter-app code invocation which opens up for different reuse scenarios, both legitimate or malicious. This paper exposes the general workflow for this mechanism, which beyond ICCs, enables app developers to access and invoke functionalities (either entire Java classes, methods or object fields) implemented in other apps using official Android APIs. We experimentally showcase how this reuse mechanism can be leveraged to łplagiarize" supposedly-protected functionalities. Typically, we were able to leverage this mechanism to bypass security guards that a popular video broadcaster has placed for preventing access to its video database from outside its provided app. We further contribute with a static analysis toolkit, named DICIDer, for detecting direct inter-app code invocations in apps. An empirical analysis of the usage prevalence of this reuse mechanism is then conducted. Finally, we discuss the usage contexts as well as the implications of this studied reuse mechanism. CCS CONCEPTS • Security and privacy → Software security engineering.

On the Impact of Sample Duplication in Machine-Learning-Based Android Malware Detection

“…Ideally, mobile apps should be intensively analyzed to check their security and privacy requirements conformance. However, when performed statically, app analysis is often time-consuming, may produce many false positives, and will not identify all problems that occur at runtime [26,42]. On the other hand, dynamic analysis does not scale and often cannot cover the whole codebase [19,34,45].…”

A Journey Through Android App Analysis: Solutions and Open Challenges

“…Less known in the community is another powerful mechanism that allows for direct inter-app code invocation which opens up for different reuse scenarios, both legitimate or malicious. In a FSE 2020 paper [12], we exposed the general workflow for this mechanism, which beyond ICCs, enables app developers to access and invoke functionalities (either entire Java classes, methods or object fields) implemented in other apps using official Android APIs. We experimentally showcased how this reuse mechanism can be leveraged to "plagiarize" supposedly protected functionalities.…”

KnowledgeZooClient

“…Researchers have spent tremendous efforts in analyzing and improving Android apps and their running framework systems, as well as the overall Android ecosystem [3,12,13]. They have attempted to detect security issues of Android apps [14][15][16], dissect malicious behaviors of Android malware [7,17], characterize compatibility issues of Android apps [18][19][20][21], improve code qualities of Android apps [22,23], mitigate energy concerns of Android apps [24,25], etc.…”