Understanding Illicit UI in iOS apps Through Hidden UI Analysis

Abstract

In Chameleon apps, benign UIs are displayed during Apple App vetting while their hidden potentially-harmful illicit UIs (PHI-UI) are revealed once they reached App Store. In this paper, we report the first systematic study on iOS Chameleon apps, which sheds light on a largely overlooked threat that the illicit activities are launched solely based on UI. Our research employed CHAMELEON-HUNTER, a new static analysis approach that determines the suspiciousness of a PHI-UI leveraging the semantic features generated from iOS app UI and metadata. The approach is based on the observation that PHI-UI not only is structurally hidden but also has notable semantic inconsistency with the benign UI. Our evaluation shows that CHAMELEON-HUNTER is highly effective, achieving 92.6% precision and 94.7% recall. From 28K Apple App Store apps, we found 142 new Chameleon apps, which were confirmed and promptly removed by Apple. Our work reveals that Chameleon apps can easily bypass the App store vetting and conduct a set of suspicious activities including collecting users' private information, swindling money with fake monetary services, and leading the user to a pirated app store.

Measuring and Understanding Crowdturfing in the App Store

“…In our study, we not only further measure the activity of crowdturfing reviews in the App Store but also combine the extracted features with multiple machine learning methods to obtain an effective detection model. The authors of [2] discovered and measured crowdturfing content hidden behind the UIs of apps and proposed a new triage methodology to identify iOS apps that may contain hidden crowdturfing UIs. They focused more on program analysis and semantic analysis in the UI and how crowdturfing blends into the app markets by hiding in the apps.…”

“…mturk.com, accessed on 7 July 2023) and Microworkers (https://www.microworkers.com, accessed on 7 July 2023). Crowdturfing leverages the crowdsourcing operation by hiring a lot of low-paid workers to perform suspicious and malicious tasks online [2]. The purpose of crowdturfing is to increase the exposure and visibility of the item, thus improving the ranking in the search engines and attracting more genuine users to find and visit it, e.g., posting fake reviews, reposting and likes on social media, and falsifying the number of downloads and installations in mobile application markets.…”

CydiOS: A Model-Based Testing Framework for iOS Apps

“…Previous approaches [51,52,59] directly perform data flow analysis on assembly/IR code, thus they cannot resolve the target of indirect jumps. As a result, some data flow paths cannot be correctly resolved, leading to missing some VC transitions.…”

“…Table 2 lists the experiment results. Cruiser represents the model we generated by following the previous approaches (i.e, analyzing the assembly code) [51,59]. "Transition" column represents the screen transitions discovered by tools.…”

“…However, applying static analysis to iOS apps' binary is non-trivial. State-of-the-art approaches [51,59] perform data flow analysis directly on the disassembled code. Considering there are some indirect jumps in app binary, where the target address is stored in the memory and remains unknown until execution [22], these approaches cannot resolve some data flow paths correctly.…”