Secure Integration of Web Content and Applications on Commodity Mobile Operating Systems

Abstract

A majority of today's mobile apps integrate web content of various kinds. Unfortunately, the interactions between app code and web content expose new attack vectors: a malicious app can subvert its embedded web content to steal user secrets; on the other hand, malicious web content can use the privileges of its embedding app to exfiltrate sensitive information such as the user's location and contacts. In this paper, we discuss security weaknesses of the interface between app code and web content through attacks, then introduce defenses that can be deployed without modifying the OS. Our defenses feature WIREframe, a service that securely embeds and renders external web content in Android apps, and in turn, prevents attacks between embedded web and host apps. WIREframe fully mediates the interface between app code and embedded web content. Unlike the existing web-embedding mechanisms, WIREframe allows both apps and embedded web content to define simple access policies to protect their own resources. These policies recognize fine-grained security principals, such as origins, and control all interactions between apps and the web. We also introduce WIRE (Web Isolation Rewriting Engine), an offline app rewriting tool that allows app users to inject WIREframe protections into existing apps. Our evaluation, based on 7166 popular apps and 20 specially selected apps, shows these techniques work on complex apps and incur acceptable end-to-end performance overhead.

DroidCap: OS Support for Capability-based Permissions in Android

“…General attacker model: Lastly, it should be emphasized that DROIDCAP currently primarily targets app developers that want to design their apps more defensively by compartmentalizing them or privilege-separating untrusted code. But, like other compartmentalization solutions like [18], [29], [52], [59], [71] our attacker model does not include malicious developers. DROIDCAP by itself cannot prevent malicious or colluding [40], [13] apps, although it prevents unauthorized delegation of capabilities between apps.…”

“…The general approach to privilege separation is to execute the library or WebView in a distinct sandbox with different UID and permissions than the host app. AdDroid [52], Ad-Split [59], CompARTist [29], and AFrame [71] implement this approach for ad libs; WIRE [18] privilege-separates WebViews this way; and Layercake [56] supports WebViews and ad libs. In contrast, we leverage in DROIDCAP built-in features for compartmentalizing apps (e.g., process manifest attributes of components) introduce Binder capabilities for efficient, leastprivilege privilege-separation of those compartments.…”

“…We argue that this combination of characteristics that retains an ambient authority generally impedes efficiently separating privileges on Android and makes it unnecessarily hard for developers to efficiently create new, least-privileged protection domains and adopting app compartmentalization best-practices. For instance, every component of an app inherits its app's full permission set and also prior works on privilege separation [52], [59], [71], [29], [18] necessarily have to set up new UIDs with separate permissions. There exist some works that refine the authority: for instance, SEAndroid's type enforcement [60] assigns security contexts to processes; different solutions on information flow control (e.g., [45], [46], [70]) assign security labels to processes; few solutions make app components the principal for permission enforcement [64], [57]; and app virtualization [9], [11] can enforce policies perprocess on IPC and syscalls.…”

Automated Generation of Event-Oriented Exploits in Android Hybrid Apps

“…Other defense approaches, such as WIREframe [17] and HybridGuard [29], provided policy enforcement in WebView to protect app-web bridges. However, both of them only focused on JavaScript code and yet ignored HTML code.…”

A Novel Authentication Mechanism to Prevent Unauthorized Service Access for Mobile Device in Distributed Network

“…However, if users need to keep a lot of confidential information, security issues can arise and network overhead can increase. Many research works are being proposed in [1], [2], [3] and [4] which provide a user authentication protocol through session key establishment for the user anonymity in a DCNs. For those attacks that do not protect the secret session key of an attacker, an attacker can falsify the service provider by forging a legal session key.…”