Breaking and Fixing Origin-Based Access Control in Hybrid Web/Mobile Application Frameworks
Breaking and Fixing Origin-Based Access Control in Hybrid Web/Mobile Application Frameworks
复制标题
DOI：
10.14722/ndss.2014.23323
复制
发表时间：
2014-02
期刊：
影响因子：
--
通讯作者：
Martin Georgiev;S. Jana;Vitaly Shmatikov
中科院分区：
文献类型：
--
作者：
Martin Georgiev;S. Jana;Vitaly Shmatikov
混合移动应用程序(App)结合了Web应用程序和“原生”移动应用程序的功能。与Web应用程序一样，它们也是用可移植的、独立于平台的语言实现的，比如HTML和JavaScript。与本地应用程序一样，它们可以直接访问本地设备资源-文件系统、位置、相机、联系人等。混合应用程序通常使用混合应用程序框架(如PhoneGap)开发。该框架的目的有两个。首先，它提供了一个嵌入式Web浏览器(例如，Android上的WebView)来执行应用程序的Web代码。其次，它提供了“桥”，允许Web代码逃离浏览器并访问设备上的本地资源。我们分析了由混合框架创建的软件堆栈，并证明它没有正确地组合分别管理Web代码和本地代码的访问控制策略。Web代码由同源策略管理，而本地代码由操作系统的访问控制策略(例如，Android中用户授予的权限)管理。框架添加到浏览器的网桥具有与整个应用程序相同的本地访问权限，但没有受到同源策略的正确保护。这为水力压裂攻击打开了大门，这种攻击允许包含在混合应用程序中的外来网络内容(例如，限制在iframe中的广告)穿透各层并直接访问设备资源。水力压裂漏洞很常见：它们影响所有混合框架、所有嵌入式Web浏览器、所有桥接机制以及部署这些框架的所有平台。我们研究了基于PhoneGap框架的免费Android应用程序中水力压裂漏洞的流行程度。每个漏洞都会将敏感的本地资源--读写联系人列表、本地文件等的能力--暴露给数十个潜在的恶意网域。我们还分析了混合框架为防止外来Web内容访问资源而部署的防御措施，并解释了它们无效的原因。然后我们介绍了NoFrak，这是一种基于能力的水力压裂攻击防御系统。NoFrak是独立于平台的，与任何框架和嵌入式浏览器兼容，不需要更改现有混合应用的代码，也不会打破它们以广告支持的商业模式。
Hybrid mobile applications (apps) combine the features of Web applications and "native" mobile apps. Like Web applications, they are implemented in portable, platform-independent languages such as HTML and JavaScript. Like native apps, they have direct access to local device resources-file system, location, camera, contacts, etc. Hybrid apps are typically developed using hybrid application frameworks such as PhoneGap. The purpose of the framework is twofold. First, it provides an embedded Web browser (for example, WebView on Android) that executes the app's Web code. Second, it supplies "bridges" that allow Web code to escape the browser and access local resources on the device. We analyze the software stack created by hybrid frameworks and demonstrate that it does not properly compose the access-control policies governing Web code and local code, respectively. Web code is governed by the same origin policy, whereas local code is governed by the access-control policy of the operating system (for example, user-granted permissions in Android). The bridges added by the framework to the browser have the same local access rights as the entire application, but are not correctly protected by the same origin policy. This opens the door to fracking attacks, which allow foreign-origin Web content included into a hybrid app (e.g., ads confined in iframes) to drill through the layers and directly access device resources. Fracking vulnerabilities are generic: they affect all hybrid frameworks, all embedded Web browsers, all bridge mechanisms, and all platforms on which these frameworks are deployed. We study the prevalence of fracking vulnerabilities in free Android apps based on the PhoneGap framework. Each vulnerability exposes sensitive local resources-the ability to read and write contacts list, local files, etc.-to dozens of potentially malicious Web domains. We also analyze the defenses deployed by hybrid frameworks to prevent resource access by foreign-origin Web content and explain why they are ineffectual. We then present NoFrak, a capability-based defense against fracking attacks. NoFrak is platform-independent, compatible with any framework and embedded browser, requires no changes to the code of the existing hybrid apps, and does not break their advertising-supported business model.