When program analysis meets mobile security: an industrial study of misusing Android internet sockets
When program analysis meets mobile security: an industrial study of misusing Android internet sockets
复制标题
DOI：
10.1145/3106237.3117764
复制
发表时间：
2017-08
期刊：
影响因子：
--
通讯作者：
Wenqi Bu;Minhui Xue;Lihua Xu;Yajin Zhou;Zhushou Tang;Tao Xie
中科院分区：
文献类型：
--
作者：
Wenqi Bu;Minhui Xue;Lihua Xu;Yajin Zhou;Zhushou Tang;Tao Xie
尽管最近在程序分析技术方面取得了进展，以识别Android应用程序中的漏洞，但将这些技术应用于大规模工业环境仍然存在重大挑战。现代软件安全提供商，如奇虎360和Pwnzen（中国的两家领先公司），每次运行通常需要处理超过1000万个移动的应用程序。在这项工作中，我们专注于有效和高效地识别脆弱的使用互联网套接字在工业环境中。为了实现这一目标，我们提出了一种实用的混合方法，可以在工业环境中实现轻量级而精确的检测。特别是，我们将潜在易受攻击的应用程序分类过程与分析技术相结合，以减少不可避免的人工检查工作。我们根据漏洞特征对潜在的易受攻击应用进行分类，以减少静态分析的负担。我们灵活地集成了每个已识别系列中应用程序的静态和动态分析，以细化系列签名，从而实现精确检测。我们在一个实际的系统中实现我们的方法，并将系统部署在Pwnzen平台上。通过使用该系统，我们识别并向开发人员报告了24个易受攻击的应用程序（分为3个漏洞家族）的潜在漏洞，其中一些报告的漏洞是以前未知的。每个漏洞家族的应用程序总下载量超过5000万次。我们还提出了对策，并强调了技术转让的有前途的方向。
Despite recent progress in program analysis techniques to identify vulnerabilities in Android apps, significant challenges still remain for applying these techniques to large-scale industrial environments. Modern software-security providers, such as Qihoo 360 and Pwnzen (two leading companies in China), are often required to process more than 10 million mobile apps at each run. In this work, we focus on effectively and efficiently identifying vulnerable usage of Internet sockets in an industrial setting. To achieve this goal, we propose a practical hybrid approach that enables lightweight yet precise detection in the industrial setting. In particular, we integrate the process of categorizing potential vulnerable apps with analysis techniques, to reduce the inevitable human inspection effort. We categorize potential vulnerable apps based on characteristics of vulnerability signatures, to reduce the burden on static analysis. We flexibly integrate static and dynamic analyses for apps in each identified family, to refine the family signatures and hence target on precise detection. We implement our approach in a practical system and deploy the system on the Pwnzen platform. By using the system, we identify and report potential vulnerabilities of 24 vulnerable apps (falling into 3 vulnerability families) to their developers, and some of these reported vulnerabilities are previously unknown. The apps of each vulnerability family in total have over 50 million downloads. We also propose countermeasures and highlight promising directions for technology transfer.