Race detection for event-driven mobile applications

Hsiao, Chun-Hung; Yu, Jie; Narayanasamy, Satish; Kong, Ziyun; Pereira, Cristiano; Pokam, Gilles; Chen, Peter M.; Flinn, Jason

doi:10.1145/2666356.2594330

Cited by 51 publications

(12 citation statements)

References 20 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Clearly, the precise modeling of the Looper component is a challenging task [20]. However, we found that our current data flow analysis successfully determines registration-callback pairs, even for those cases where the Android Looper is involved (e.g., onClick).…”

Section: Discussionmentioning

confidence: 87%

EdgeMiner: Automatically Detecting Implicit Control Flow Transitions through the Android Framework

Cao¹,

Fratantonio²,

Bianchi³

et al. 2015

Proceedings 2015 Network and Distributed System Security Symposium

143

View full text Add to dashboard Cite

A wealth of recent research proposes static data flow analysis for the security analysis of Android applications. One of the building blocks that these analysis systems rely upon is the computation of a precise control flow graph. The callback mechanism provided and orchestrated by the Android framework makes the correct generation of the control flow graph a challenging endeavor. From the analysis' point of view, the invocation of a callback is an implicit control flow transition facilitated by the framework. Existing static analysis tools model callbacks either through manually-curated lists or ad-hoc heuristics. This work demonstrates that both approaches are insufficient, and allow malicious applications to evade detection by state-of-theart analysis systems. To address the challenge of implicit control flow transitions (i.e., callbacks) through the Android framework, we are the first to propose, implement, and evaluate a systematic treatment of this aspect. Our implementation, called EDGEMINER, statically analyzes the entire Android framework to automatically generate API summaries that describe implicit control flow transitions through the Android framework. We use EDGEMINER to analyze three major versions of the Android framework. EDGEMINER identified 19,647 callbacks in Android 4.2, suggesting that a manual treatment of this challenge is likely infeasible. Our evaluation demonstrates that the current insufficient treatment of callbacks in state-of-the-art analysis tools results in unnecessary imprecision. For example, FlowDroid misses a variety of leaks of privacy sensitive data from benign off-the-shelf Android applications because of its inaccurate handling of callbacks. Of course, malicious applications can also leverage this blind spot in current analysis systems to evade detection at will. The results of our work allow existing tools to comprehensively address the challenge of callbacks and identify previously undetected leakage of privacy sensitive data.

show abstract

Section: Discussionmentioning

confidence: 87%

EdgeMiner: Automatically Detecting Implicit Control Flow Transitions through the Android Framework

Cao¹,

Fratantonio²,

Bianchi³

et al. 2015

Proceedings 2015 Network and Distributed System Security Symposium

143

View full text Add to dashboard Cite

show abstract

“…Event race detection algorithms have also been developed for Android, using similar techniques as those targeting JavaScript, but with more sophisticated happens-before relations [5,9,19]. Adapting our technique to Android is an interesting opportunity for future work.…”

Section: Related Workmentioning

confidence: 99%

Repairing Event Race Errors by Controlling Nondeterminism

Adamsen

Möller

Karim

et al. 2017

2017 IEEE/ACM 39th International Conference on Software Engineering (ICSE)

View full text Add to dashboard Cite

Modern web applications are written in an eventdriven style, in which event handlers execute asynchronously in response to user or system events. The nondeterminism arising from this programming style can lead to pernicious errors. Recent work focuses on detecting event races and classifying them as harmful or harmless. However, since modifying the source code to prevent harmful races can be a difficult and error-prone task, it may be preferable to steer away from the bad executions. In this paper, we present a technique for automated repair of event race errors in JavaScript web applications. Our approach relies on an event controller that restricts event handler scheduling in the browser according to a specified repair policy, by intercepting and carefully postponing or discarding selected events. We have implemented the technique in a tool called EventRaceCommander, which relies entirely on source code instrumentation, and evaluated it by repairing more than 100 event race errors that occur in the web applications from the largest 20 of the Fortune 500 companies. Our results show that applicationindependent repair policies usually suffice to repair event race errors without excessive negative impact on performance or user experience, though application-specific repair policies that target specific event races are sometimes desirable.

show abstract

“…Races in event-based programs Event-based programs, such as web applications and other UI applications, suffer from data races that result from the non-deterministic execution order of event handlers. Recent work detects such races in web applications [29,33] and Android applications [18,22]. Other approaches filter potential harmful races by analyzing their effects on persistent state [27] and on the DOM [20].…”

Section: Ui-level Testingmentioning

confidence: 99%

Systematic black-box analysis of collaborative web applications

2017

View full text Add to dashboard Cite

Web applications, such as collaborative editors that allow multiple clients to concurrently interact on a shared resource, are difficult to implement correctly. Existing techniques for analyzing concurrent software do not scale to such complex systems or do not consider multiple interacting clients. This paper presents Simian, the first fully automated technique for systematically analyzing multi-client web applications. Naively exploring all possible interactions between a set of clients of such applications is practically infeasible. Simian scales to real-world applications by using a twophase black-box approach. The first phase systematically explores the application with a single client to infer potential conflicts between client events. The second phase synthesizes multi-client interactions targeted at triggering misbehavior that may result from the potential conflicts, and reports an inconsistency if the clients do not converge to a consistent state. We evaluate the analysis on three widely used systems, Google Docs, Firepad, and ownCloud Documents, where it reports a variety of inconsistencies, such as incorrect formatting and misplaced text fragments. Moreover, we find that the two-phase approach runs 10x faster than exhaustive exploration, making systematic analysis feasible.

show abstract

Race detection for event-driven mobile applications

Cited by 51 publications

References 20 publications

EdgeMiner: Automatically Detecting Implicit Control Flow Transitions through the Android Framework

EdgeMiner: Automatically Detecting Implicit Control Flow Transitions through the Android Framework

Repairing Event Race Errors by Controlling Nondeterminism

Systematic black-box analysis of collaborative web applications

Contact Info

Product

Resources

About