Understanding the Evolution of Android App Vulnerabilities

Abstract

The Android ecosystem today is a growing universe of a few billion devices, hundreds of millions of users and millions of applications targeting a wide range of activities where sensitive information is collected and processed. Security of communication and privacy of data are thus of utmost importance in application development. Yet, regularly, there are reports of successful attacks targeting Android users. While some of those attacks exploit vulnerabilities in the Android OS, others directly concern application-level code written by a large pool of developers with varying experience. Recently, a number of studies have investigated this phenomenon, focusing however only on a specific vulnerability type appearing in apps, and based on only a snapshot of the situation at a given time. Thus, the community is still lacking comprehensive studies exploring how vulnerabilities have evolved over time, and how they evolve in a single app across developer updates. Our work fills this gap by leveraging a data stream of 5 million app packages to reconstruct versioned lineages of Android apps and finally obtained 28,564 app lineages (i.e., successive releases of the same Android apps) with more than 10 app versions each, corresponding to a total of 465,037 apks. Based on these app lineages, we apply stateof-the-art vulnerability-finding tools and investigate systematically the reports produced by each tool. In particular, we study which types of vulnerabilities are found, how they are introduced in the app code, where they are located, and whether they foreshadow malware. We provide insights based on the quantitative data as reported by the tools, but we further discuss the potential false positives. Our findings and study artifacts constitute a tangible knowledge to the community. It could be leveraged by developers to focus verification tasks, and by researchers to drive vulnerability discovery and repair research efforts.

Taming Reflection

“…Millions of applications are freely available for download by Android users. However, malware developers keep targeting the platform and trying to get their abusive applications into the Android ecosystem [28,32,44]. For example, 360 Security recently reported that over 500,000 new mobile malware variants targeting the Android platform were found in China in the first quarter of 2019 [65].…”

“…Also, as of early 2020, 1 out of every 1000 app installs from Google's official Play store is from a potentially harmful application, as shown in the recent Google Transparency Report. 1 These numbers demand practical and scalable approaches and tools to support security analysis of large sets of Android apps [28,32,54].…”

A Journey Through Android App Analysis: Solutions and Open Challenges

“…In [13], we explained how we re-construct the versioned lineages of Android apps, by leveraging AndroZoo [5], a popular Android application repository made available to researchers. Then, we performed a large-scale investigation on how vulnerabilities evolve in Android apps.…”

Borrowing your enemy’s arrows: the case of code reuse in Android via direct inter-app code invocation

“…To perform this experiment, we consider app lineages (i.e., different versions of apps over time). To that end, we consider a large lineage dataset proposed by Gao et al [37] based on the AndroZoo repository. Most of the lineages are spread over several years, but for each year, we consider only the latest apk version in that year for a given lineage.…”

“…The statistics of apks per year from the lineage dataset in the literature is listed in Table 4. Table 4: # APKs considered from the Lineage dataset [37] 2011 2012 2013 2014 2015 2016 2017 2018 3,950 6,252 13,191 23924 17,505 30,690 6,995 3,583 We run DICIDer on this dataset and compute the percentage of apks containing DICIs for each year. The result is presented in Figure 6.…”