Fine-Grained Access Control for HTML5-Based Mobile Applications in Android

Abstract

HTML5-based mobile applications are becoming more and more popular because they can run on different platforms. Several newly introduced mobile OS natively support HTML5-based applications. For those that do not provide native support, such as Android, iOS, and Windows Phone, developers can develop HTML5-based applications using middlewares, such as PhoneGap [17]. In these platforms, programs are loaded into a web component, called WebView, which can render HTML5 pages and execute JavaScript code. In order for the program to access the system resources, which are isolated from the content inside WebView due to its sandbox, bridges need to be built between JavaScript and the native code (e.g. Java code in Android). Unfortunately, such bridges break the existing protection that was originally built into WebView.In this paper, we study the potential risks of HTML5-based applications, and investigate how the existing mobile systems' access control supports these applications. We focus on Android and the PhoneGap middleware. However, our ideas can be applied to other platforms. Our studies indicate that Android does not provide an adequate access control for this kind of applications. We propose a finegrained access control mechanism for the bridge in Android system. We have implemented our scheme in Android and have evaluated its effectiveness and performance.

Reducing Attack Surface on Cordova-based Hybrid Mobile Apps

“…Jin et al [8] addressed the security problems encountered due the existence of bridges between PhoneGap and Android, those bridges break the protection that was already implemented in the WebView because they create holes in the sandbox of the WebView usage architecture. They study the reduction of the permission reachability without effecting business model so they designed a permission based access control model to control permission usage based on frames, it allow developers to assign different permissions to different frames.…”

“…This study is based on current implementation of the latest Apache Cordova version (3.5.0) released on (June 12, 2014). Security of such platforms has recently gained the attention, several studies [1,4,8] have analyzed possible security threats and have proposed possible solutions. In this paper, our study focuses on the plugin access model implemented by Cordova framework, which to the best of our knowledge has not been addressed nor analyzed in previous studies.…”

On the Static Analysis of Hybrid Mobile Apps

“…There have been several works introducing more fine-grained access control mechanism for the cross-language interface in hybrid mobile apps, particularly Cordova, such as NoFrak [10], MobileIFC [22], and others [12,21]. They all identified the breach of the sandbox security and that Cordova fails to restrict access to plugins by untrusted JavaScript code as the major security and privacy concern.…”

TD‐WS: a threat detection tool of WebSocket and Web Storage in HTML5 websites

“…Recent works applied the access control and the privilege separation mechanisms in JavaScript and presented several sandbox mechanisms to protect its users from the malicious scripts in the traditional web applications and the HTML5 applications.…”