Year: 2017
Type: conference-paper
Abstract: Many Android apps (applications) employ databases for managing sensitive data, thus, security of their databases is a concern. In this paper, we systematically study attacks targeting databases in benign Android apps. In addition to studying database vulnerabilities accessed from content providers, we define and study a new class of database vulnerabilities. We propose an analysis framework to find such vulnerabilities with a proof-of-concept exploit. Our analysis combines static dataflow analysis, symbolic execution with models for handling complex objects such as URIs and dynamic testing. We evaluate our analysis on popular Android apps, successfully finding many database vulnerabilities. Surprisingly, our analyzer finds new ways to exploit previously reported and fixed vulnerabilities. Finally, we propose a fine-grained protection mechanism extending the manifest to protect against database attacks.
Authors: Behnaz Hassanshahi, Roland H.C. Yap
Institution: National University of Singapore
Language: English
Subfield: Software
Field: Computer Science
Domain: Physical Sciences
Open Access status: bronze
Funder: National Research Foundation
OpenAlex ID: W2600431008