EdgeMiner: Automatically Detecting Implicit Control Flow Transitions through the Android Framework

Abstract

A wealth of recent research proposes static data flow analysis for the security analysis of Android applications. One of the building blocks that these analysis systems rely upon is the computation of a precise control flow graph. The callback mechanism provided and orchestrated by the Android framework makes the correct generation of the control flow graph a challenging endeavor. From the analysis' point of view, the invocation of a callback is an implicit control flow transition facilitated by the framework. Existing static analysis tools model callbacks either through manually-curated lists or ad-hoc heuristics. This work demonstrates that both approaches are insufficient, and allow malicious applications to evade detection by state-of-theart analysis systems. To address the challenge of implicit control flow transitions (i.e., callbacks) through the Android framework, we are the first to propose, implement, and evaluate a systematic treatment of this aspect. Our implementation, called EDGEMINER, statically analyzes the entire Android framework to automatically generate API summaries that describe implicit control flow transitions through the Android framework. We use EDGEMINER to analyze three major versions of the Android framework. EDGEMINER identified 19,647 callbacks in Android 4.2, suggesting that a manual treatment of this challenge is likely infeasible. Our evaluation demonstrates that the current insufficient treatment of callbacks in state-of-the-art analysis tools results in unnecessary imprecision. For example, FlowDroid misses a variety of leaks of privacy sensitive data from benign off-the-shelf Android applications because of its inaccurate handling of callbacks. Of course, malicious applications can also leverage this blind spot in current analysis systems to evade detection at will. The results of our work allow existing tools to comprehensively address the challenge of callbacks and identify previously undetected leakage of privacy sensitive data.

Generating Predicate Callback Summaries for the Android Framework

“…Pre-computed Summaries: EdgeMiner [12] is the closest work to our approach. Their goal is to map Android API methods to callbacks invoked in the methods.…”

When Android Apps Open Ports to Handle Network Requests: Functionality or Security Vulnerability?

“…Started from the dummy main method, APOVD constructs the CFG of the app based on Soot's CFG construction module. Besides, the results generated by EdgeMiner [13] are incorporated by APOVD to achieve a more complete CFG.…”

Synthesizing framework models for symbolic execution

“…EdgeMiner [6] ran backward data-flow analysis over the Android source code to find implicit flows. Modelgen [9] infers a model in terms of information flows, to support taint analysis.…”