Access Control to Prevent Malicious JavaScript Code Exploiting Vulnerabilities of WebView in Android OS

Abstract

SUMMARYAndroid applications that using WebView can load and display web pages. Interaction with web pages allows JavaScript code within the web pages to access resources on the Android device by using the Java object, which is registered into WebView. If this WebView feature were exploited by an attacker, JavaScript code could be used to launch attacks, such as stealing from or tampering personal information in the device. To address these threats, we propose an access control on the security-sensitive APIs at the Java object level. The proposed access control uses static analysis to identify these security-sensitive APIs, detects threats at runtime, and notifies the user if threats are detected, thereby preventing attacks from web pages.

Web access monitoring mechanism via Android WebView for threat analysis

“…Moreover, this API makes it possible to invoke all the public methods in these Java objects from the JavaScript loaded within WebView. However, some attacks exploiting this API have been reported [4,[6][7][8]13,14]. To address these attacks and improve the security of WebView, some previous studies have proposed some access control mechanisms.…”

“…Moreover, Android app developers can set access permissions by specifying a resource's URL. Yu et al [7] have proposed an access control mechanism that can control the access to security-sensitive APIs in Android from the JavaScript code by controlling the registration of Java objects through addJavascriptInterface API. Draco [8] can control access to device resources from web content, which are of different web origins, so as to prevent the attack that exploits the addJavascriptInterface API.…”

“…Although WebView can use only Google Safe Browsing, this measure alone is not enough to protect web access via WebView, especially from fake virus alerts, which use malvertising to redirect the users to web pages and scam the users into installing the suspicious Android app. Moreover, previous studies have reported attacks exploiting WebView and presented countermeasures against these attacks [4][5][6][7][8][9][10][11][12][13][14][15][16]. Some studies have presented access control methods to prevent malicious JavaScript codes from exploiting the vulnerabilities of WebView [6][7][8] and to prevent app-repackage attacks in Cordova-based hybrid applications [9].…”

Access Control Mechanism to Mitigate Cordova Plugin Attacks in Hybrid Applications

“…On the other hand, to improve the security of the Android platform, Backes et al [13], Nauman et al [14], Wang et al [15], Conti et al [16], Bugiel et al [17], and Yu et al [18] proposed fine-grained access control mechanisms on Android. In the range of control objects, previous researches [13], [14], [15], [16], [17], [18] showed that control can be achieved regardless of the Android application type. The proposed technique can control when an Android application uses the Cordova framework.…”

Access Control for Plugins in Cordova-Based Hybrid Applications

“…On the other hand, to improve security of Android, Backes et al [12], Nauman et al [13], Wang et al [14], Conti et al [15], Bugiel et al [16], and Yu et al [17] proposed fine-grained access control mechanisms on Android. Previous research modifies the Android OS and the Android framework, requiring mobile users to replace them with these defenses.…”