Mobile Application Web API Reconnaissance: Web-to-Mobile Inconsistencies & Vulnerabilities

Abstract

Modern mobile apps use cloud-hosted HTTP-based API services and heavily rely on the Internet infrastructure for data communication and storage. To improve performance and leverage the power of the mobile device, input validation and other business logic required for interfacing with web API services are typically implemented on the mobile client. However, when a web service implementation fails to thoroughly replicate input validation, it gives rise to inconsistencies that could lead to attacks that can compromise user security and privacy. Developing automatic methods of auditing web APIs for security remains challenging.In this paper, we present a novel approach for automatically analyzing mobile app-to-web API communication to detect inconsistencies in input validation logic between apps and their respective web API services. We present our system, WARDroid, which implements a static analysis-based web API reconnaissance approach to uncover inconsistencies on real world API services that can lead to attacks with severe consequences for potentially millions of users throughout the world. Our system utilizes program analysis techniques to automatically extract HTTP communication templates from Android apps that encode the input validation constraints imposed by the apps on outgoing web requests to web API services. WARDroid is also enhanced with blackbox testing of server validation logic to identify inconsistencies that can lead to attacks. We evaluated our system on a set of 10,000 popular free apps from the Google Play Store. We detected problematic logic in APIs used in over 4,000 apps, including 1,743 apps that use unencrypted HTTP communication. We further tested 1,000 apps to validate web API hijacking vulnerabilities that can lead to potential compromise of user privacy and security and found that millions of users are potentially affected from our sample set of tested apps.

Web APIs in Android through the Lens of Security

“…Mendoza et al studied the inconsistencies in input validation logic between apps and their respective web API services [5]. They developed a tool to extract requests to web API services from an app, and to infer sample input values that violate the implemented constraints found in the app, such as email address or JSON content validation executed on the client side.…”

“…https://github.com/skylot/jadx 3 https://javaparser.org 4 https://github.com/javaparser/javasymbolsolver5 The HTTP request header is a plain text record providing input details for the web API request.…”

Geo-locating Drivers: A Study of Sensitive Data Leakage in Ride-Hailing Services

“…Inferring the protocol format is not the primary goal of our analysis. Recently, WARDroid [27] introduces a static-analysis based method to extract web APIs, but it focuses on the implementation logic, which is not the objective of our analysis. However, our technique can certainly integrate these techniques to recognize the message format in addition to the discovery of the web APIs.…”

Web Service Testing Techniques: A Systematic Literature Review

“…Most of the time, in order to exchange data and information, a system must interact with other systems using different mechanism. For web service security testing [54,55], this is a critical element, as the mechanism or tool should have the ability to make sure the security interrelate and then manage with remaining components. b) Performance specifies the ability of the mechanism to ensure performance quality and also is a measure of how fast a request of service can be completed.…”

“…Mentioned parameters have become leading issues in web service testing due to its distinctive scalability [11] and confidentiality concerns. Furthermore, real challenging task [12][13][14] in web service testing domain is that it has no Graphic User Interface (GUI) [15]. Thus, web service has no GUI to be verified and tested.…”