SMV-Hunter: Large Scale, Automated Detection of SSL/TLS Man-in-the-Middle Vulnerabilities in Android Apps
SMV-Hunter: Large Scale, Automated Detection of SSL/TLS Man-in-the-Middle Vulnerabilities in Android Apps
复制标题
DOI：
10.14722/ndss.2014.23205
复制
发表时间：
2014
影响因子：
3.5
通讯作者：
David Sounthiraraj;Justin Sahs;G. Greenwood;Zhiqiang Lin;L. Khan
中科院分区：
文献类型：
--
作者：
David Sounthiraraj;Justin Sahs;G. Greenwood;Zhiqiang Lin;L. Khan
许多Android应用程序使用SSL/TLS来安全地传输敏感信息。但是，开发人员通常提供自己的标准SSL/TLS证书验证过程的实现。不幸的是，许多这样的自定义实现都有微妙的错误，自签名证书有内置的例外，或者盲目地断言所有证书都是有效的，这使得许多Android应用程序容易受到SSL/TLS中间人攻击。在本文中，我们提出了SMV-HUNTER，一个系统的自动化，大规模识别这样的漏洞，结合静态和动态分析。静态组件检测何时给出自定义验证过程，从而识别潜在易受攻击的应用程序，并提取用于指导动态分析的信息，然后使用用户界面枚举和自动化技术在主动中间人攻击下触发潜在易受攻击的代码。我们已经实现了SMV-HUNTER，并在从Google Play市场下载的23，418个应用程序上对其进行了评估，其中1，453个应用程序通过静态分析被确定为可能存在漏洞，每个应用程序的平均开销约为4秒，并行运行在16个线程上。在这些潜在易受攻击的应用程序中，使用我们的动态分析确认有726个易受攻击，每个应用程序的平均开销约为44秒，并行运行在8个模拟器上。
Many Android apps use SSL/TLS to transmit sensitive information securely. However, developers often provide their own implementation of the standard SSL/TLS certificate validation process. Unfortunately, many such custom implementations have subtle bugs, have built-in exceptions for self-signed certificates, or blindly assert all certificates are valid, leaving many Android apps vulnerable to SSL/TLS Man-in-the-Middle attacks. In this paper, we present SMV-HUNTER, a system for the automatic, large-scale identification of such vulnerabilities that combines both static and dynamic analysis. The static component detects when a custom validation procedure has been given, thereby identifying potentially vulnerable apps, and extracts information used to guide the dynamic analysis, which then uses user interface enumeration and automation techniques to trigger the potentially vulnerable code under an active Man-in-the-Middle attack. We have implemented SMV-HUNTER and evaluated it on 23,418 apps downloaded from the Google Play market, of which 1,453 apps were identified as being potentially vulnerable by static analysis, with an average overhead of approximately 4 seconds per app, running on 16 threads in parallel. Among these potentially vulnerable apps, 726 were confirmed vulnerable using our dynamic analysis, with an average overhead of about 44 seconds per app, running on 8 emulators in parallel.