Content Provider Leakage Vulnerability Detection in Android Applications

Abstract

Although much research effort has focused on Android malware detection, very little attention has been given to implementationlevel vulnerabilities. This paper focuses on Content Provider Leakage vulnerability that can be exploited by viewing or editing sensitive data through malware. We present a new technique for detecting content provider leakage vulnerability. We propose Kullback-Leibler Divergence (KLD) as a measure to detect the content provider leakage vulnerability. In particular, our contribution includes the development of a set of elements and mapping the elements to programming principles for secure implementation of content provider classes. These elements are captured from the implementation to form the initial population set. The population set is used to measure the divergence of a newly implemented application with content provider to identify potential vulnerabilities. We also apply a back-off smoothing technique to compute the KLD value. We implement a java prototype tool to evaluate a set of content provider implementations to show the effectiveness of the proposed approach. The initial results show that by choosing an appropriate threshold level, KLD is an effective method for detecting content provider leakage vulnerability.

An Exploratory Study on the Occurrence of Self-Admitted Technical Debt in Android Apps

“…For instance, work by Carvalho et al [11] on the presentation layer identifies code smells involving components such as Activities, Fragments, and Listeners, which developers also mention in SATD comments. Furthermore, Content Providers, which are associated with leakage vulnerabilities [4], are also present in our findings. This opens up an interesting avenue of research for the community to examine the extent to which such debt items can lead to app vulnerabilities.…”

“…However, like non-mobile systems, mobile apps are also software systems, and are subject to poor code quality when app developers deviate from established best practices and guidelines [3]. For instance, poor code quality of a mobile app can lead to various issues for end-users, such as security vulnerabilities [4], poor user experience [5] (including accessibility concerns [6]), and performance degradation [7]. Further, app developers face maintainability challenges due to their app's poor code quality [8].…”

ConsiDroid: A Concolic-based Tool for Detecting SQL Injection Vulnerability in Android Apps

“…TaintDroid [34] is a dynamic taint analysis tool for capturing information leakages in android apps, which its dynamic approach is not concolic or symbolic. Shahriar et al [35] presenting KLD-based detection of content leakage vulnerabilities based on three secure programming principles. Their approach focused on ContentProvider leakage, which ConsiDroid can detect them with the symbolic mock class idea.…”

When Android Apps Open Ports to Handle Network Requests: Functionality or Security Vulnerability?

“…To understand the universality of port-opening Android apps, we made a statistical analysis to the apps downloaded from Google Play 4 and Wandoujia (a famous Android app store in China 5 ). The download time of the apps is from July 2016 to October 2016.…”

“…A vulnerable and exported component can be visited by the other apps in the same device, which can lead to many types of vulnerabilities, e.g., capability leak [1,2], content provider leakage [3,4], privilege escalation [5,6], confused deputy [7], component hijacking [8,9], intent spoofing [10], etc. But these vulnerabilities can only be exploited locally (the vulnerable app and the malicious app must run in a same device).…”