arXivDaily arXiv每日学术速递 周一至周五更新
arXiv 2406.02011cs.CR
收藏

Android应用程序中原生代码漏洞的风险评估研究

A Risk Estimation Study of Native Code Vulnerabilities in Android Applications

Silvia Lucia Sanna, Diego Soi, Davide Maiorca, Giorgio Fumera, Giorgio Giacinto

阅读 PDF
arXiv 页面 ↗HTML 原文 ↗

AI总结：

针对Android原生C/C++库漏洞，本文提出基于正则表达式识别库版本和脆弱函数、结合漏洞数据库评分评估应用风险的快速方法，并在逾10万个应用上验证其有效性。

摘要：

Android是全球移动设备上使用最广泛的操作系统，每天都有数十万款应用被下载。尽管这些应用主要使用Java和Kotlin编写，但图形或密码学等高级功能是通过原生C/C++库提供的。这些库可能受到C/C++代码中常见漏洞的影响（例如缓冲区溢出等内存错误），攻击者可借此读取或修改数据，或执行任意代码。此前的研究直到最近才开始探索Android原生代码中漏洞的检测与评估。本文提出一种快速的基于风险的方法，可给出与Android应用程序原生部分相关的风险评分。这样，开发者在应用发布之前，就可以检查应用的原生代码中是否可能包含漏洞；如果存在漏洞，则进行修补，以发布更安全的应用。为此，我们首先使用快速正则表达式检测库版本以及可能存在漏洞的函数。随后，我们将从漏洞数据库中提取的评分应用于被分析的应用程序，从而获得能够代表整个应用的风险评分。我们通过对超过100,000个应用程序（但其中只有40%包含原生代码）以及15个携带已知漏洞的流行库进行大规模分析，证明了该方法的有效性。所得结果表明，许多应用程序包含不法分子可能利用的知名漏洞，这给整个Android应用生态的安全性带来了严重担忧。

英文摘要：

Android is the most used Operating System worldwide for mobile devices, with hundreds of thousands of apps downloaded daily. Although these apps are primarily written in Java and Kotlin, advanced functionalities such as graphics or cryptography are provided through native C/C++ libraries. These libraries can be affected by common vulnerabilities in C/C++ code (e.g., memory errors such as buffer overflow), through which attackers can read/modify data or execute arbitrary code. The detection and assessment of vulnerabilities in Android native code have only been recently explored by previous research work. In this paper, we propose a fast risk-based approach that provides a risk score related to the native part of an Android application. In this way, before an app is released, the developer can check if the app may contain vulnerabilities in the Native Code and, if present, patch them to publish a more secure application. To this end, we first use fast regular expressions to detect library versions and possible vulnerable functions. Then, we apply scores extracted from a vulnerability database to the analyzed application, thus obtaining a risk score representative of the whole app. We demonstrate the validity of our approach by performing a large-scale analysis on more than $100,000$ applications (but only $40\%$ contained native code) and $15$ popular libraries carrying known vulnerabilities. The attained results show that many applications contain well-known vulnerabilities that miscreants can potentially exploit, posing serious concerns about the security of the whole Android applications landscape.

机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。

↑