一句话：Dual-Force 同时对 WebView 应用的 Java 与 JavaScript 代码进行强制执行，无需环境搭建即可暴露跨语言恶意载荷。
现代 Android 恶意软件常采用多阶段、条件守卫、环境相关的载荷来掩盖恶意行为，其中越来越多地利用 WebView 中 Java 与 JavaScript 的双向通信来逃避现有检测与分析技术。本文提出 Dual-Force，一种跨语言强制执行（forced execution）技术：它同时对 WebView 应用的 Java 与 JavaScript 代码沿不同路径进行强制执行，无需手工提供输入，也不要求搭建特定运行环境，从而强制暴露被隐藏的恶意载荷。该技术的关键在于一个新颖的执行模型，使强制执行过程能够抑制异常并继续沿其他路径执行，从而克服跨语言与异常带来的中断问题。作者在 150 个 WebView 恶意软件样本上进行评估，Dual-Force 精确暴露了其中 119 个样本的恶意载荷，相比当前最先进的技术多发现 23% 的恶意行为，表明其能有效揭示跨语言环境下的隐蔽恶意逻辑。
Modern Android malwares tend to use advanced techniques to cover their malicious behaviors. They usually feature multi-staged, condition-guarded and environment-specific payloads. An increasing number of them utilize WebView, particularly the two-way communications between Java and JavaScript, to evade detection and analysis of existing techniques. We propose Dual-Force, a forced execution technique which simultaneously forces both Java and JavaScript code of WebView applications to execute along various paths without requiring any environment setup or providing any inputs manually. As such, the hidden payloads of WebView malwares are forcefully exposed. The technique features a novel execution model that allows forced execution to suppress exceptions and continue execution. Experimental results show that Dual-Force precisely exposes malicious payload in 119 out of 150 WebView malwares. Compared to the state-of-the-art, Dual-Force can expose 23% more malicious behaviors.
DOI 原文 ·
@inproceedings{paperbot4800,
title = {Dual-force: understanding WebView malware via cross-language forced execution},
author = {Zhenhao Tang and Juan Zhai and Minxue Pan and Yousra Aafer and Shiqing Ma and Xiangyu Zhang and Jianhua Zhao},
booktitle = {ASE},
year = {2018},
doi = {10.1145/3238147.3238221}
}