Characterizing Android App Signing Issues
Characterizing Android App Signing Issues
复制标题
DOI：
10.1109/ase.2019.00035
复制
发表时间：
2019-11
期刊：
影响因子：
--
通讯作者：
Haoyu Wang;Hongxuan Liu;Xusheng Xiao;Guozhu Meng;Yao Guo
中科院分区：
文献类型：
--
作者：
Haoyu Wang;Hongxuan Liu;Xusheng Xiao;Guozhu Meng;Yao Guo
在应用程序发布过程中，Android要求所有应用程序在分发之前使用证书进行数字签名。Android使用此证书来识别作者并确保应用程序的完整性。然而，最近报告了一些签名问题，威胁到Android应用程序的安全和隐私。在本文中，我们提出了第一个大规模的系统测量研究与Android应用程序签名的问题。我们首先创建一个分类法，涵盖四种类型的应用程序签名问题（共21个反模式），包括漏洞、潜在攻击、发布错误和兼容性问题。然后，我们开发了一个自动化工具，用于描述从Google Play和24个替代Android应用市场中抓取的超过500万个应用项目（300万个不同的apk）中与签名相关的问题。我们的实证研究结果表明，尽管Google已经引入了apk级别的签名方案（V2和V3）来克服一些已知的安全问题，但超过93%的应用程序仍然只使用apk签名方案（V1），这会带来很大的安全威胁。此外，我们还发现，在25个被研究的市场中，7%至45%的应用程序被发现至少存在一个签名问题，而大量应用程序暴露于安全漏洞、攻击和兼容性问题。其中，我们发现的相当一部分应用程序是下载量数百万的热门应用程序。最后，我们的演变分析表明，大多数问题在经过相当长的时间后并没有得到缓解。结果揭示了检测和修复应用程序签名问题的紧急情况。
In the app releasing process, Android requires all apps to be digitally signed with a certificate before distribution. Android uses this certificate to identify the author and ensure the integrity of an app. However, a number of signature issues have been reported recently, threatening the security and privacy of Android apps. In this paper, we present the first large-scale systematic measurement study on issues related to Android app signatures. We first create a taxonomy covering four types of app signing issues (21 anti-patterns in total), including vulnerabilities, potential attacks, release bugs and compatibility issues. Then we developed an automated tool to characterize signature-related issues in over 5 million app items (3 million distinct apks) crawled from Google Play and 24 alternative Android app markets. Our empirical findings suggest that although Google has introduced apk-level signing schemes (V2 and V3) to overcome some of the known security issues, more than 93% of the apps still use only the JAR signing scheme (V1), which poses great security threats. Besides, we also revealed that 7% to 45% of the apps in the 25 studied markets have been found containing at least one signing issue, while a large number of apps have been exposed to security vulnerabilities, attacks and compatibility issues. Among them a considerable number of apps we identified are popular apps with millions of downloads. Finally, our evolution analysis suggested that most of the issues were not mitigated after a considerable amount of time across markets. The results shed light on the emergency for detecting and repairing the app signing issues.