Static Analysis of Implicit Control Flow: Resolving Java Reflection and Android Intents (T)

Abstract

Implicit or indirect control flow is a transfer of control between procedures using some mechanism other than an explicit procedure call. Implicit control flow is a staple design pattern that adds flexibility to system design. However, it is challenging for a static analysis to compute or verify properties about a system that uses implicit control flow.This paper presents static analyses for two types of implicit control flow that frequently appear in Android apps: Java reflection and Android intents. Our analyses help to resolve where control flows and what data is passed. This information improves the precision of downstream analyses, which no longer need to make conservative assumptions about implicit control flow.We have implemented our techniques for Java. We enhanced an existing security analysis with a more precise treatment of reflection and intents. In a case study involving ten real-world Android apps that use both intents and reflection, the precision of the security analysis was increased on average by two orders of magnitude. The precision of two other downstream analyses was also improved.

DroidRA: taming reflection to support whole-program analysis of Android apps

“…The closest work to ours was concurrently proposed by Barros et al [11] within their Checker framework. Their work differs from ours in several ways: first, the design of their approach focus on helping developers checking the information-flow in their own apps, using annotations in the source code; this limits the potential use of their approach by security analysts in large markets of Android apps such as GooglePlay or AppChina.…”

“…The approach proposed by Barros et al [11] is the closest work to ours. Their recent publication presents an approach, hereon referred to as Checker, to address reflection in the Information Checker Framework (IFC) [12].…”

“…We thank Paulo Barros, René Just and Michael Ernst, from the Checker [11] team, for sharing detailed results of their approach to deal with reflection. This work was supported by the Fonds National de la Recherche (FNR), Luxembourg, under the project AndroMap C13/IS/5921289.…”

“…However, there is a nascent commitment in the Android research community to propose solutions for improving the analysis of reflection. For example, in a recent work [11], Barros et al propose an approach for resolving reflective calls in their Checker static analysis framework [12]. Their approach however 1) requires application source code (which is not available for most Android apps), 2) targets specific check analyses based on developer annotations (which thus needs additional developer efforts, e.g., learn the target framework, find the right place to annotate, etc.)…”

Boosting static analysis of Android apps through code instrumentation

“…Most recently, Barros et al [4] propose to tackle Android ICC and reflection challenges at the same time within their Checker framework. They use annotations on top of source code to help developers checking information flows in their own apps.…”