一句话：通过 LibRARIAN 识别 Android 应用中原生库版本，实证发现热门应用长期使用含已知 CVE 的过时库。
Android 应用常引入预编译的第三方原生库以提升性能并复用功能，但开发者往往未能及时更新这些库，导致已知漏洞在补丁发布多年后仍被使用。由于开发者常重命名或修改库，识别库及其版本十分困难。本文提出 LibRARIAN（LibRAry veRsion IdentificAtioN），基于新颖的 bin2sim 相似度度量，利用库元数据和只读段字符串等特征，准确识别应用中的原生库及版本。作者对 Google Play 上 200 个热门免费应用从 2013 年 9 月至 2020 年 5 月进行实证研究。结果发现 53/200（26.5%）应用包含带已知 CVE 的易受攻击版本，其中 14 个仍未修复；应用开发者平均需 528.71±40.20 天应用安全补丁，而库开发者平均 54.59±8.12 天发布补丁，更新速度慢约 10 倍。
Android apps include third-party native libraries to increase performance and to reuse functionality. Native code is directly executed from apps through the Java Native Interface or the Android Native Development Kit. Android developers add precompiled native libraries to their projects, enabling their use. Unfortunately, developers often struggle or simply neglect to update these libraries in a timely manner. This results in the continuous use of outdated native libraries with unpatched security vulnerabilities years after patches became available. To further understand such phenomena, we study the security updates in native libraries in the most popular 200 free apps on Google Play from Sept. 2013 to May 2020. A core difficulty we face in this study is the identification of libraries and their versions. Developers often rename or modify libraries, making their identification challenging. We create an approach called LibRARIAN (LibRAry veRsion IdentificAtioN) that accurately identifies native libraries and their versions as found in Android apps based on our novel similarity metric bin2sim. LibRARIAN leverages different features extracted from libraries based on their metadata and identifying strings in read-only sections. We discovered 53/200 popular apps (26.5%) with vulnerable versions with known CVEs between Sept. 2013 and May 2020, with 14 of those apps remaining vulnerable. We find that app developers took, on average, 528.71±40.20 days to apply security patches, while library developers release a security patch after 54.59 ± 8.12 days-a 10 times slower rate of update.
@inproceedings{AlmaneeUPG21,
title = {Too Quiet in the Library: An Empirical Study of Security Updates in Android Apps' Native Code},
author = {Sumaya Almanee and Arda Unal and Mathias Payer and Joshua Garcia},
booktitle = {ICSE},
year = {2021},
doi = {10.1109/icse43902.2021.00122}
}