一句话：通过分析1.3万余个Android应用，总结EA误暴露的六种模式，提出十种启发式并实现工具Mist自动识别。
Exported Activity（EA）是Android应用间通信的重要机制，但一旦暴露便易受权限泄露等恶意ICC攻击。现有工作多关注攻击，却少有研究暴露行为本身的必要性与合理性。本文首次系统分析13,873个Android应用，利用数据流分析从字节码提取EA相关调用关系，并结合manifest中的启动条件，研究EA的使用与误暴露。实证发现EA机制被广泛采用，且开发者因误解或疏忽常导致误暴露；根据不同标准筛选子集后，手动总结出六种典型误用模式。基于此设计十种启发式判断Activity是否应暴露，并实现自动工具Mist。实验表明，约五分之一EA为不必要暴露，超过三分之一EA的暴露可能并不建议。
Exported Activity (EA), a kind of activities in Android apps that can be launched by external components, is one of the most important inter-component communication (ICC) mechanisms to realize the interaction and cooperation among multiple apps. Existing works have pointed out that, once exposed, an activity will be vulnerable to malicious ICC attacks, such as permission leakage attack. Unfortunately, it is observed that a considerable number of activities in commercial apps are exposed inadvertently, while few works have studied the necessity and reasonability of such exposure. This work takes the first step to systematically study the exposing behavior of EAs through analyzing 13,873 Android apps. It utilizes the EA associated call relationships extracted from byte-code via data-flow analysis, as well as the launch conditions obtained from the manifest files, to guide the study on the usage and misexposure of EAs. The empirical findings are that the EA mechanism is widely adopted in development and the activities are liable to be misexposed due to the developers' misunderstanding or carelessness. Further study on subsets of apps selected according to different criteria indicates that the misexposed EAs have specific characteristics, which are manually summarized into six typical misuse patterns. As a consequence, ten heuristics are designed to decide whether an activity should be exposed or not and are implemented into an automatic tool called Mist. Experiments on the collected apps show that around one fifth EAs are unnecessarily exposed and there are more than one third EAs whose exposure may not be suggested.
DOI 原文 ·
@inproceedings{paperbot4760,
title = {Characterizing and identifying misexposed activities in Android applications},
author = {Jiwei Yan and Xi Deng and Ping Wang and Tianyong Wu and Jun Yan and Jian Zhang},
booktitle = {ASE},
year = {2018},
doi = {10.1145/3238147.3238164}
}