一句话：提出 VPDroid，用 Android 系统级虚拟化定制设备指纹、模拟数据克隆攻击，揭示仅靠客户端设备一致性检查的自动登录仍不安全。
移动 App 为提升体验普遍支持自动登录，其依赖本地存储的设备相关数据。攻击者可将这些数据克隆到自己的手机，突破登录设备数限制、隐蔽登录受害者账号，即“数据克隆攻击”。常规防御是校验设备指纹一致性：若新设备指纹与之前不同，就禁用自动登录。本文提出 VPDroid，一个面向安全测试的透明 Android 系统级虚拟化平台。分析人员无需用户态 API hooking，即可在虚拟手机中定制 CPU 型号、Android ID、电话号码等设备特征；其隔离机制可防止虚拟手机中的用户态 App 察觉设备特征差异。作者用 VPDroid 在五种虚拟手机环境中对 234 个下载量最高的 App 模拟数据克隆攻击，成功欺骗了所有执行设备一致性检查的 App（如 Twitter、WeChat、PayPal），19 家厂商已确认该零日漏洞。结果表明，仅在客户端强制设备一致性检查仍无法抵御高级数据克隆攻击。
Limited by the small keyboard, most mobile apps support the automatic login feature for better user experience. Therefore, users avoid the inconvenience of retyping their ID and password when an app runs in the foreground again. However, this auto-login function can be exploited to launch the so-called "data-clone attack": once the locally-stored, auto-login depended data are cloned by attackers and placed into their own smartphones, attackers can break through the login-device number limit and log in to the victim's account stealthily. A natural countermeasure is to check the consistency of devicespecific attributes. As long as the new device shows different device fingerprints with the previous one, the app will disable the auto-login function and thus prevent data-clone attacks. In this paper, we develop VPDroid, a transparent Android OSlevel virtualization platform tailored for security testing. With VPDroid, security analysts can customize different device artifacts, such as CPU model, Android ID, and phone number, in a virtual phone without user-level API hooking. VPDroid's isolation mechanism ensures that user-mode apps in the virtual phone cannot detect device-specific discrepancies. To assess Android apps' susceptibility to the data-clone attack, we use VPDroid to simulate data-clone attacks with 234 most-downloaded apps. Our experiments on five different virtual phone environments show that VPDroid's device attribute customization can deceive all tested apps that perform device-consistency checks, such as Twitter, WeChat, and PayPal. 19 vendors have confirmed our report as a zero-day vulnerability. Our findings paint a cautionary tale: only enforcing a device-consistency check at client side is still vulnerable to an advanced data-clone attack.
DOI 原文 · arXiv · PDF（开放获取） · DBLP
@inproceedings{abs-2103-03511,
title = {App’s Auto-Login Function Security Testing via Android OS-Level Virtualization},
author = {Wenna Song and Jiang Ming and Lin Jiang and Han Yan and Yi Xiang and Yuan Chen and Jianming Fu and Guojun Peng},
booktitle = {ICSE},
year = {2021},
doi = {10.1109/icse43902.2021.00149}
}