Challenges for Dynamic Analysis of iOS Applications

Abstract

Recent research indicates that mobile platforms, such as Android and Apple's iOS increasingly face the threat of malware. These threats range from spyware that steals privacy sensitive information, such as location data or address book contents to malware that tries to collect ransom from users by locking the device and therefore rendering the device useless. Therefore, powerful analysis techniques and tools are necessary to quickly provide an analyst with the necessary information about an application to assess whether this application contains potentially malicious functionality. In this work, we focus on the challenges and open problems that have to be overcome to create dynamic analysis solutions for iOS applications. Additionally, we present two proof-of-concept implementations tackling two of these challenges. First, we present a basic dynamic analysis approach for iOS applications demonstrating the feasibility of dynamic analysis on iOS. Second, addressing the challenge that iOS applications are almost always user interface driven, we also present an approach to automatically exercise an application's user interface. The necessity of exercising application user interfaces is demonstrated by the difference in code coverage that we achieve with (69%) and without (16%) such techniques. Therefore, this work is a first step towards comprehensive dynamic analysis for iOS applications.

Code Smells in iOS Apps: How Do They Compare to Android?

“…While this architecture is widely used for desktop operating systems, mobile software systems rather use the ARM architecture, which is completely different [68]. Consequently, the existing dynamic analysis techniques cannot be used for analyzing iOS apps.…”

“…Another constraint for the dynamic analysis of iOS applications is the general adoption of event-based graphic user interfaces, which makes application features depending on the events triggered by the user. Moreover, a finite number of automatic runs of the app may be unable to cover all the execution paths [68]. Therefore, a relevant dynamic analysis of iOS apps requires necessarily an interaction with the graphic interface.…”

Dynamic Analysis Methods of IOS Application Security

“…Dynamic analysis technology refers to the process of the implementation of the program, through the control of input variables and the operating environment of the program to analyze, to detect whether there are security risks in the applications [1].…”

Specification Based Testing of on Android Systems

“…One research area is to investigate the ways malicious behavior are triggered. For example, a group of malwares can stay dormant until the occurrence of an specific event [24]. Some events are independent of user interactions with applications (i.e.…”