Who You Gonna Call? Analyzing Web Requests in Android Applications

Abstract

Relying on ubiquitous Internet connectivity, applications on mobile devices frequently perform web requests during their execution. They fetch data for users to interact with, invoke remote functionalities, or send user-generated content or metadata. These requests collectively reveal common practices of mobile application development, like what external services are used and how, and they point to possible negative effects like security and privacy violations, or impacts on battery life. In this paper, we assess different ways to analyze what web requests Android applications make. We start by presenting dynamic data collected from running 20 randomly selected Android applications and observing their network activity. Next, we present a static analysis tool, Stringoid, that analyzes string concatenations in Android applications to estimate constructed URL strings. Using Stringoid, we extract URLs from 30, 000 Android applications, and compare the performance with a simpler constant extraction analysis. Finally, we present a discussion of the advantages and limitations of dynamic and static analyses when extracting URLs, as we compare the data extracted by Stringoid from the same 20 applications with the dynamically collected data.

What did really change with the new release of the app?

“…As dynamic analysis might miss relevant parts of the code, we also implement a module that inspects the bytecode for network activity. This module relies on Stringoid [23], a static analysis tool that takes as input an APK and produces a set of string patterns representing URLs. We use it to extract constructed URL strings from applications, estimating the domains the app connects to.…”

Web APIs in Android through the Lens of Security

“…Rapoport et al studied web requests in Android apps [1]. They demonstrated that a large number of web requests are not immediately traceable to source code and need dynamic analysis.…”

“…Apps access the internet through web APIs in order to use an increasing number of public web services, or to communicate with private backends. Researchers have recently studied the use of such APIs in mobile apps, and, for instance, found that a large number of web requests are not directly traceable to source code [1], cloud and mail service credentials are hard-coded in the apps [2], many web requests are harmful [3], many web links targeting well-known advertisement networks impose serious risks on users [4], and lax input validation in many web APIs could compromise the security and privacy of millions of users [5].…”

“…The tool and the obtained results in this study are available online. 1 The remainder of this paper is organized as follows. We describe the methodology of our web API mining approach in section II, and we present the results of our empirical study in section III.…”

Benchmarking Web API Quality

“…For example, Oumaziz et al perform static analysis on mobile applications to assess if and to what extent they interact with web APIs [22]. Rapoport et al combine static analysis with a dynamic execution of selected mobile applications, exploring how to best detect consumption of web APIs [23]. Finally, Wittern et al studied how to detect the use of web APIs in JavaScript-based application code mined from GitHub using static analysis [24].…”