Extractocol

Choi, Hyunwoo; Kim, Jeongmin; Hong, Hyunwook; Kim, Yong‐Dae; Lee, Jong-Hyup; Han, Dongsu

doi:10.1145/2829988.2790003

Cited by 2 publications

(2 citation statements)

References 3 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…In order to extract the Jimple slices, we implement a forward and backward slicing algorithm (see Appendix A), which are based on the networkaware program slicing approach proposed by Choi et al [29,30]. The slicing algorithm works bidirectionally based on the ICFG constructed in the previous step.…”

Section: Program Slicermentioning

confidence: 99%

“…In this case, a dependency exists between responseA and requestB. To identify this, we leverage the taint-based approach proposed by Choi et al [29,30], in which the dependency is determined by identifying the data flow from the source (line (1) in responseA) to the sink (line (1) in requestB). Finally, the program slicer records Jimple slices consisting of HTTP request/response and its dependencies for the next step, in which code snippets meeting the three conditions for vulnerability to remote code injection attacks are identified.…”

Section: Fileoutputstreamwrite()mentioning

confidence: 99%

See 1 more Smart Citation

Large-Scale Analysis of Remote Code Injection Attacks in Android Apps

Choi

Kim

2018

Security and Communication Networks

Self Cite

View full text Add to dashboard Cite

It is pretty well known that insecure code updating procedures for Android allow remote code injection attack. However, other than codes, there are many resources in Android that have to be updated, such as temporary files, images, databases, and configurations (XML and JSON). Security of update procedures for these resources is largely unknown. This paper investigates general conditions for remote code injection attacks on these resources. Using this, we design and implement a static detection tool that automatically identifies apps that meet these conditions. We apply the detection tool to a large dataset comprising 9,054 apps, from three different types of datasets: official market, third-party market, and preinstalled apps. As a result, 97 apps were found to be potentially vulnerable, with 53 confirmed as vulnerable to remote code injection attacks.

show abstract

Section: Program Slicermentioning

confidence: 99%

Section: Fileoutputstreamwrite()mentioning

confidence: 99%

Large-Scale Analysis of Remote Code Injection Attacks in Android Apps

Choi

Kim

2018

Security and Communication Networks

Self Cite

View full text Add to dashboard Cite

show abstract

Mobile Application Web API Reconnaissance: Web-to-Mobile Inconsistencies & Vulnerabilities

Mendoza

2018

2018 IEEE Symposium on Security and Privacy (SP)

View full text Add to dashboard Cite

Modern mobile apps use cloud-hosted HTTP-based API services and heavily rely on the Internet infrastructure for data communication and storage. To improve performance and leverage the power of the mobile device, input validation and other business logic required for interfacing with web API services are typically implemented on the mobile client. However, when a web service implementation fails to thoroughly replicate input validation, it gives rise to inconsistencies that could lead to attacks that can compromise user security and privacy. Developing automatic methods of auditing web APIs for security remains challenging.In this paper, we present a novel approach for automatically analyzing mobile app-to-web API communication to detect inconsistencies in input validation logic between apps and their respective web API services. We present our system, WARDroid, which implements a static analysis-based web API reconnaissance approach to uncover inconsistencies on real world API services that can lead to attacks with severe consequences for potentially millions of users throughout the world. Our system utilizes program analysis techniques to automatically extract HTTP communication templates from Android apps that encode the input validation constraints imposed by the apps on outgoing web requests to web API services. WARDroid is also enhanced with blackbox testing of server validation logic to identify inconsistencies that can lead to attacks. We evaluated our system on a set of 10,000 popular free apps from the Google Play Store. We detected problematic logic in APIs used in over 4,000 apps, including 1,743 apps that use unencrypted HTTP communication. We further tested 1,000 apps to validate web API hijacking vulnerabilities that can lead to potential compromise of user privacy and security and found that millions of users are potentially affected from our sample set of tested apps.

show abstract

Extractocol

Cited by 2 publications

References 3 publications

Large-Scale Analysis of Remote Code Injection Attacks in Android Apps

Large-Scale Analysis of Remote Code Injection Attacks in Android Apps

Mobile Application Web API Reconnaissance: Web-to-Mobile Inconsistencies & Vulnerabilities

Contact Info

Product

Resources

About