Android-Web混合的大规模分析
A Large Scale Analysis of Android-Web Hybridization
摘要：
许多Android应用程序通过WebView组件嵌入网页，并在Android中执行JavaScript代码。混合应用程序利用专用API加载资源并在WebView中呈现。此外，Android对象可以与JavaScript世界共享。然而，桥接Android和JavaScript世界的接口也可能招致严重的安全威胁：潜在不受信任的网页及其JavaScript可能会干扰Android环境及其对本地功能的访问。目前还没有一般性的分析来评估这种连接两个世界的混合应用程序的影响。为了理解混合应用程序的语义和效果，我们对混合API的使用进行了大规模的研究。我们分析并分类了7,500个随机选择的混合API的参数和196个来自Google Play商店的最流行的应用程序以及1000个恶意软件样本。我们的研究结果促进了对混合应用程序的普遍理解，以及对潜在程序分析和当前安全状况的影响：我们发现了数千个从Android到JavaScript的敏感数据流，其中绝大多数可能流向潜在的不可信代码。我们的分析确定了许多网页嵌入漏洞，我们示范性地利用了这些漏洞。此外，我们发现了大量的应用程序，其中潜在的不受信任的JavaScript代码可能会干扰（受信任的）Android对象，无论是在良性还是恶性应用程序中。
英文摘要：
Many Android applications embed webpages via WebView components and execute JavaScript code within Android. Hybrid applications leverage dedicated APIs to load a resource and render it in a WebView. Furthermore, Android objects can be shared with the JavaScript world. However, bridging the interfaces of the Android and JavaScript world might also incur severe security threats: Potentially untrusted webpages and their JavaScript might interfere with the Android environment and its access to native features. No general analysis is currently available to assess the implications of such hybrid apps bridging the two worlds. To understand the semantics and effects of hybrid apps, we perform a large-scale study on the usage of the hybridization APIs in the wild. We analyze and categorize the parameters to hybridization APIs for 7,500 randomly selected and the 196 most popular applications from the Google Playstore as well as 1000 malware samples. Our results advance the general understanding of hybrid applications, as well as implications for potential program analyses, and the current security situation: We discovered thousands of flows of sensitive data from Android to JavaScript, the vast majority of which could flow to potentially untrustworthy code. Our analysis identified numerous web pages embedding vulnerabilities, which we exemplarily exploited. Additionally, we discovered a multitude of applications in which potentially untrusted JavaScript code may interfere with (trusted) Android objects, both in benign and malign applications.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
