PaddyFrog: systematically detecting confused deputy vulnerability in Android applications

Abstract

An enormous number of applications have been developed for Android in recent years, making it one of the most popular mobile operating systems. However, it is obvious that more vulnerabilities would appear along with the booming amounts of applications. Poorly designed applications may contain security vulnerabilities that can dramatically undermine users' security and privacy. In this paper, we studied a kind of recently reported application vulnerability named confused deputy – a specific type of privilege escalation vulnerability, which can result in unauthorized operations, and so on. We proposed a novel system with code‐level static analysis to analyze the applications and automatically detect possible confused deputy vulnerabilities. To tackle analysis challenges imposed by Android's component‐based programming paradigm, we employed special control flow graph construction techniques to build call relations among components and function call graph within components. We developed a prototype of this system named PaddyFrog and evaluated with 7190 real world Android applications from two of the most popular markets in China. We found 1240 applications with confused deputy vulnerability and proved to be exploitable. The median execution time of this system on an application is 14.4s, which is fast enough to be used in volumes of applications testing scenarios. Copyright © 2015 John Wiley & Sons, Ltd.

Vulnerability Detection on Android Apps–Inspired by Case Study on Vulnerability Related With Web Functions

“…Chen et al [41] manually analysed several OAuth providers for Apps and determined how differences between the Apps and browser environments lead to the OAuth vulnerability. Wu et al [1] proposed a detection method for the confused deputy vulnerability in Android applications based on features of An-droidManifest.xml file and Control Flow Graph (CFG). Fang et al [5] studyed an input validation vulnerability in Android inter-component communication.…”

“…The security issues of Apps are complex and challenging. Related research on Android security has been proposed, including static [1]- [8] and dynamic [9], [10] methods. Wei et al [11] just analyzed Android vulnerabilities which are assosiated with JavaScript.…”

When Android Apps Open Ports to Handle Network Requests: Functionality or Security Vulnerability?

“…The slicing algorithm of APOVD contains two aspects-intra-procedural and inter-procedural slicing, which is based on the program slicer of Indus 7 and has made some improvements on it. Then the generated program slices are used by APOVD to judge the strength of access control in the path from NWP to s. The judgment method is that if there exists a CCJS c in Cs that satisfies one of the following conditions, APOVD considers that there exists adequate access control in the path from NWP to s:…”

“…A vulnerable and exported component can be visited by the other apps in the same device, which can lead to many types of vulnerabilities, e.g., capability leak [1,2], content provider leakage [3,4], privilege escalation [5,6], confused deputy [7], component hijacking [8,9], intent spoofing [10], etc. But these vulnerabilities can only be exploited locally (the vulnerable app and the malicious app must run in a same device).…”

Large-Scale Analysis of Remote Code Injection Attacks in Android Apps

“…As with other state-of-the-art static analysis studies for Android apps (such as Bartel et al [23], Geneiatakis et al [24], Woodpecker [25], Chex [26], and Paddyfrog [27]), our detection tool first translates Dalvik bytecode to an intermediate representation and then constructs an interprocedural control-flow graph (ICFG) (it is also known as a super control-flow graph (sCFG)) representing all possible execution paths of an app, for a given .apk file. Because the accuracy of static analysis relies on the controlflow graph, a precise ICFG needs to be constructed in order to improve the precision of static analysis.…”