Secure Integration of Web Content and Applications on Commodity Mobile Operating Systems
Secure Integration of Web Content and Applications on Commodity Mobile Operating Systems
复制标题
DOI：
10.1145/3052973.3052998
复制
发表时间：
2017-04
期刊：
影响因子：
--
通讯作者：
Drew Davidson;Yaohui Chen;F. George;Long Lu;S. Jha
中科院分区：
文献类型：
--
作者：
Drew Davidson;Yaohui Chen;F. George;Long Lu;S. Jha
今天的大多数移动的应用程序都集成了各种各样的Web内容。不幸的是，应用程序代码和Web内容之间的交互暴露了新的攻击向量：恶意应用程序可以破坏其嵌入的Web内容以窃取用户机密;另一方面，恶意Web内容可以使用其嵌入应用程序的权限来泄露敏感信息，例如用户的位置和联系人。在本文中，我们通过攻击讨论应用程序代码和Web内容之间的接口的安全弱点，然后介绍可以在不修改操作系统的情况下部署的防御措施。我们的防御措施包括WIREframe，一种在Android应用程序中安全嵌入和呈现外部Web内容的服务，从而防止嵌入式Web和主机应用程序之间的攻击。WIREframe完全中介应用程序代码和嵌入式Web内容之间的接口。与现有的Web嵌入机制不同，WIREframe允许应用程序和嵌入的Web内容定义简单的访问策略来保护自己的资源。这些策略识别细粒度的安全主体，如来源，并控制应用程序和Web之间的所有交互。我们还介绍了WIRE（Web隔离重写引擎），这是一个离线应用重写工具，允许应用用户将WIREframe保护注入现有应用。我们的评估基于7166个流行应用程序和20个特别选择的应用程序，显示这些技术适用于复杂的应用程序，并产生可接受的端到端性能开销。
A majority of today's mobile apps integrate web content of various kinds. Unfortunately, the interactions between app code and web content expose new attack vectors: a malicious app can subvert its embedded web content to steal user secrets; on the other hand, malicious web content can use the privileges of its embedding app to exfiltrate sensitive information such as the user's location and contacts. In this paper, we discuss security weaknesses of the interface between app code and web content through attacks, then introduce defenses that can be deployed without modifying the OS. Our defenses feature WIREframe, a service that securely embeds and renders external web content in Android apps, and in turn, prevents attacks between em- bedded web and host apps. WIREframe fully mediates the interface between app code and embedded web content. Un- like the existing web-embedding mechanisms, WIREframe allows both apps and embedded web content to define simple access policies to protect their own resources. These policies recognize fine-grained security principals, such as origins, and control all interactions between apps and the web. We also introduce WIRE (Web Isolation Rewriting Engine), an offline app rewriting tool that allows app users to inject WIREframe protections into existing apps. Our evaluation, based on 7166 popular apps and 20 specially selected apps, shows these techniques work on complex apps and incur acceptable end-to-end performance overhead.