Analyzing Android Browser Apps for file:// Vulnerabilities

Abstract

Abstract. Securing browsers in mobile devices is very challenging, because these browser apps usually provide browsing services to other apps in the same device. A malicious app installed in a device can potentially obtain sensitive information through a browser app. In this paper, we identify four types of attacks in Android, collectively known as FileCross, that exploits the vulnerable file:// to obtain users' private files, such as cookies, bookmarks, and browsing histories. We design an automated system to dynamically test 115 browser apps collected from Google Play and find that 64 of them are vulnerable to the attacks. Among them are the popular Firefox, Baidu and Maxthon browsers, and the more application-specific ones, including UC Browser HD for tablet users, Wikipedia Browser, and Kids Safe Browser. A detailed analysis of these browsers further shows that 26 browsers (23%) expose their browsing interfaces unintentionally. In response to our reports, the developers concerned promptly patched their browsers by forbidding file:// access to private file zones, disabling JavaScript execution in file:// URLs, or even blocking external file:// URLs. We employ the same system to validate the ten patches received from the developers and find one still failing to block the vulnerability.

When Android Apps Open Ports to Handle Network Requests: Functionality or Security Vulnerability?

“…Numerous attack forms have been found and studied by the researchers, such as excess authorization [11], file-based crosszone scripting [18], touchjacking [19], unauthorized origin crossing [20], etc. WebView vulnerabilities are mainly caused by the insecure API invocations from the JS code to the Java or native code in an app.…”

Dynalize: Dynamic Analysis of Mobile Apps in a Platform-as-a-Service Cloud

“…Dynamic analysis has been used to analyze mobile apps with respect to privacy [8], security [22], [27], performance [24], energy consumption [10], [19], [20] and bugs [1], [12], [14], [16], [23]. Several frameworks for large-scale dynamic analysis for mobile apps [4], [11] and automatic test frameworks running in the cloud [17], [25] have emerged.…”

What Mobile Ads Know About Mobile Users

“…To the best of our knowledge, the local resource oracle and the inference attacks it enables have never been reported before. These indirect attacks work regardless of how the same origin policy is implemented in WebView, including the latest implementations that have fixed the vulnerability described in [53].…”

“…Wu and Chang showed how to steal files from mobile devices by exploiting how mobile browsers interpret SOP for file-scheme origins [53], in particular, the fact that old versions of Android's WebView treat all file-scheme URIs as the same origin. This attack is similar to the direct filereading vulnerability in AdMarvel described in Section IV-B.…”