一句话：提出跨语言静态分析系统 NatiDroid，构建包含 native 库的完整 Android API 权限映射，减少过度授权误报。
Android 通过权限强制执行控制敏感 API 访问，但官方缺少完整的 API-权限映射文档。现有工作多静态分析 Java API 框架，忽略处理相机、传感器等硬件的 native 库（C/C++），导致映射不完整并引发权限过度授予检测误报。本文提出构建 Android 框架 native 库中的权限保护映射，以获得完整准确的规范，并实现跨语言静态分析原型系统 NatiDroid。作者在 11,000 多个 Android 应用上评估，涵盖定制 ROM 系统应用与 Google Play 第三方应用，并与 Axplorer 和 Arcade 对比。NatiDroid 最多发现 464 个新 API-权限映射；在两者最差结果下约 71% 应用至少有一个权限过度授予误报。所有潜在漏洞已披露给相关方。
The Android system manages access to sensitive APIs by permission enforcement. An application (app) must declare proper permissions before invoking specific Android APIs. However, there is no official documentation providing the complete list of permission-protected APIs and the corresponding permissions to date. Researchers have spent significant efforts extracting such API protection mapping from the Android API framework, which leverages static code analysis to determine if specific permissions are required before accessing an API. Nevertheless, none of them has attempted to analyze the protection mapping in the native library (i.e., code written in C and C++), an essential component of the Android framework that handles communication with the lower-level hardware, such as cameras and sensors. While the protection mapping can be utilized to detect various security vulnerabilities in Android apps, such as permission over-privilege, imprecise mapping will lead to false results in detecting such security vulnerabilities. To fill this gap, we thereby propose to construct the protection mapping involved in the native libraries of the Android framework to present a complete and accurate specification of Android API protection. We develop a prototype system, named NatiDroid, to facilitate the cross-language static analysis and compare its performance with two state-of-the-practice tools, termed Axplorer and Arcade. We evaluate NatiDroid on more than 11,000 Android apps, including system apps from custom Android ROMs and third-party apps from the Google Play. Our NatiDroid can identify up to 464 new API-permission mappings, in contrast to the worst-case results derived from both Axplorer and Arcade, where approximately 71% apps have at least one false positive in permission over-privilege. We have disclosed all the potential vulnerabilities detected to the stakeholders.
DOI 原文 ·
@inproceedings{paperbot7115,
title = {Cross-language Android permission specification},
author = {Chaoran Li and Xiao Chen and Ruoxi Sun and Minhui Xue and Sheng Wen and Muhammad Ejaz Ahmed and Seyit Camtepe and Yang Xiang},
booktitle = {FSE},
year = {2022},
doi = {10.1145/3540250.3549142}
}