Breaking and Fixing Origin-Based Access Control in Hybrid Web/Mobile Application Frameworks

Abstract

Hybrid mobile applications (apps) combine the features of Web applications and "native" mobile apps. Like Web applications, they are implemented in portable, platform-independent languages such as HTML and JavaScript. Like native apps, they have direct access to local device resources -file system, location, camera, contacts, etc.Hybrid apps are typically developed using hybrid application frameworks such as PhoneGap. The purpose of the framework is twofold. First, it provides an embedded Web browser (for example, WebView on Android) that executes the app's Web code. Second, it supplies "bridges" that allow Web code to escape the browser and access local resources on the device.We analyze the software stack created by hybrid frameworks and demonstrate that it does not properly compose the access-control policies governing Web code and local code, respectively. Web code is governed by the same origin policy, whereas local code is governed by the accesscontrol policy of the operating system (for example, user-granted permissions in Android). The bridges added by the framework to the browser have the same local access rights as the entire application, but are not correctly protected by the same origin policy. This opens the door to fracking attacks, which allow foreign-origin Web content included into a hybrid app (e.g., ads confined in iframes) to drill through the layers and directly access device resources. Fracking vulnerabilities are generic: they affect all hybrid frameworks, all embedded Web browsers, all bridge mechanisms, and all platforms on which these frameworks are deployed.We study the prevalence of fracking vulnerabilities in free Android apps based on the PhoneGap framework. Each vulnerability exposes sensitive local resources-the ability to read and write contacts list, local files, etc.-to dozens of potentially malicious Web domains. We also analyze the defenses deployed by hybrid frameworks to prevent resource access by foreign-origin Web content and explain why they are ineffectual.We then present NOFRAK, a capability-based defense against fracking attacks. NOFRAK is platformindependent, compatible with any framework and embedded browser, requires no changes to the code of the existing hybrid apps, and does not break their advertising-supported business model.

Automated Generation of Event-Oriented Exploits in Android Hybrid Apps

“…However, as shown in prior work [19], [26], such a feature also introduces potential security flaws. More specially, it opens a bridge that links web code to^Ğ However, up to now it still remains unclear how adversaries involve the event handler feature in their attack vectors in practice.…”

What Mobile Ads Know About Mobile Users

“…Furthermore, WebView enforces the standard same origin policy [8,42] on the displayed content. An advertising creative displayed in a WebView can interact with the host app through exposed bridge objects [19], but an AdSDK can restrict which bridges are available in its WebViews.…”

On the Static Analysis of Hybrid Mobile Apps

“…To limit the typical web application threats, WebViews are re-using the wellknown security mechanism from web browsers such as the same-origin policy [10]. Moreover, WebViews are separated from the regular web browsers on Android, e. g., WebViews have their own cache and cookie store.…”

“…Moreover, WebViews are separated from the regular web browsers on Android, e. g., WebViews have their own cache and cookie store. Still, there are subtle differences that make implementing secure Cordova apps even for experienced web application developers a challenge [9,10].…”

“…There have been several works introducing more fine-grained access control mechanism for the cross-language interface in hybrid mobile apps, particularly Cordova, such as NoFrak [10], MobileIFC [22], and others [12,21]. They all identified the breach of the sandbox security and that Cordova fails to restrict access to plugins by untrusted JavaScript code as the major security and privacy concern.…”