一句话：定义移动应用的「过度可访问」问题，并提出自动检测与动态验证框架 OverSight。
移动应用应通过 Accessibility API 与辅助技术（AT）为残障用户提供平等访问，但已有研究多关注「可访问性不足」。本文研究其对偶问题——「过度可访问」，即 AT 能够访问到在常规交互下不可达的功能，例如用 VoiceOver 在锁屏手机上读取备忘录，这既造成严重的安全与隐私风险，也会把本不应出现在屏幕上的信息暴露给残障用户，干扰其导航。作者首先对 Android 应用中的过度可访问元素进行实证研究，归纳出一组可导致该问题的条件；随后实现自动化框架 OverSight，利用这些条件检测过度可访问元素，并借助真实 AT 对其可访问性进行动态验证。在真实应用上的评估表明，OverSight 能有效发现此前未知的安全威胁、工作流违规以及可访问性缺陷。
Mobile apps, an essential technology in today’s world, should provide equal access to all, including 15% of the world population with disabilities. Assistive Technologies (AT), with the help of Accessibility APIs, provide alternative ways of interaction with apps for disabled users who cannot see or touch the screen. Prior studies have shown that mobile apps are prone to the under-access problem, i.e., a condition in which functionalities in an app are not accessible to disabled users, even with the use of ATs. We study the dual of this problem, called the over-access problem, and defined as a condition in which an AT can be used to gain access to functionalities in an app that are inaccessible otherwise. Over-access has severe security and privacy implications, allowing one to bypass protected functionalities using ATs, e.g., using VoiceOver to read notes on a locked phone. Over-access also degrades the accessibility of apps by presenting to disabled users information that is actually not intended to be available on a screen, thereby confusing and hindering their ability to effectively navigate. In this work, we first empirically study overly accessible elements in Android apps and define a set of conditions that can result in over-access problem. We then present OverSight, an automated framework that leverages these conditions to detect overly accessible elements and verifies their accessibility dynamically using an AT. Our empirical evaluation of OverSight on real-world apps demonstrates OverSight’s effectiveness in detecting previously unknown security threats, workflow violations, and accessibility issues.
@inproceedings{paperbot7332,
title = {Too Much Accessibility is Harmful! Automated Detection and Analysis of Overly Accessible Elements in Mobile Apps},
author = {Forough Mehralian and Navid Salehnamadi and Syed Fatiul Huq and Sam Malek},
booktitle = {ASE},
year = {2022},
doi = {10.1145/3551349.3560424}
}