Document Type : Research Article

Authors

1 Department of Information Technology, University of Isfahan,Isfahan,Iran.

2 Department of Software Engineering, University of Isfahan,Isfahan,Iran.

Abstract

Most of the current research on static analysis of Android applications for security vetting either work on Java source code or the Dalvik bytecode. Nevertheless, Android allows developers to use C or C++ code in their programs that is compiled into various binary architectures. Moreover, Java and the native code components (C or C++) can collaborate with each other using Java Native Interface. Recent research shows that native codes are frequently used in both benign and malicious Android applications. Most of the present Android static analysis tools avert considering native codes in their analysis and applied trivial models for their data-flow analysis. As we know only the open source JN-SAF tool has tried to solve this issue statically. However, there are still challenges like libC functions and multi-threading in native codes that we want to address in this work. We presented SANT as an extension of JN-SAF for supporting Static Analysis of Native Threads. We considered modeling libC functions in our data-flow analysis to have a more precise analysis when dealing with security vetting of native codes. We also used control flow and data dependence graphs in SANT to handle multiple concurrent threads and find implicit data-flow between them. Our experiments show that the conducted improvements outperforms JN-SAF in real-world benchmark applications.

Keywords

[1] Mobile Operating System Market Share Worldwide. Accessed 9 Feb 2020. http://gs.statcounter.com/os-marketshare/mobile/worldwide
[2] Arzt, Steven, et al. ”Flowdroid: Precise context, flow, field, object-sensitive and lifecycle-aware taint analysis for android apps.” Acm Sigplan Notices 49.6 (2014): 259-269.
[3] Wei, Fengguo, Sankardas Roy, and Xinming Ou. ”Amandroid: A precise and general intercomponent data flow analysis framework for security vetting of android apps.” ACM Transactions on Privacy and Security (TOPS) 21.3 (2018): 1-32.
[4] Li, Li, et al. ”Iccta: Detecting inter-component privacy leaks in android apps.” In 2015 IEEE/ACM 37th IEEE International Conference on Software Engineering. Vol. 1. IEEE, 2015.
[5] Avdiienko, Vitalii, et al. ”Mining apps for abnormal usage of sensitive data.” In 2015 IEEE/ACM 37th IEEE International Conference on Software Engineering. Vol. 1. IEEE, 2015.
[6] Andarzian, Seyed Behnam, and Behrouz Tork Ladani. ”Compositional Taint Analysis of Native Codes for Security Vetting of Android Applications.” In 2020 10th International Conference on Computer and Knowledge Engineering (ICCKE). IEEE, 2020.
[7] Afonso, Vitor, et al. ”Going native: Using a largescale analysis of android apps to create a practical native-code sandboxing policy.” In The Network and Distributed System Security Symposium. 2016.
[8] Wei, Fengguo, et al. ”Jn-saf: Precise and efficient ndk/jni-aware inter-language static analysis framework for security vetting of android applications with native code.” In Proceedings of the 2018 ACM SIGSAC Conference on Computer and
Communications Security. 2018.
[9] Feipeng Liu.:Android Native Development Kit Cookbook. PACKT publishing. (2013)
[10] Android NDK. Accessed 15 Feb 2020. https://developer.android.com/ndk/.
[11] Java Native Interface. Accessed 5 March 2020. https://docs.oracle.com/javase/8/docs/technotes-/guides/jni/
[12] Sagiv, Mooly, Thomas Reps, and Susan Horwitz.”Precise interprocedural dataflow analysis with applications to constant propagation.” Theoretical Computer Science 167.1-2 (1996): 131-170.
[13] Octeau, Damien, et al. ”Composite constant propagation: Application to android intercomponent communication analysis.” In 2015 IEEE/ACM 37th IEEE International Conference on Software Engineering. Vol. 1. IEEE, 2015.
[14] Wang, Xiaolei, et al. ”Leakdoctor: Toward automatically diagnosing privacy leaks in mobile applications.” In Proceedings of the ACM on Interactive, Mobile, Wearable and Ubiquitous Technologies 3.1 (2019): 1-25.
[15] Xu, Guangquan, et al. ”SoProtector: safeguard privacy for native SO files in evolving mobile IoT applications.” In IEEE Internet of Things Journal 7.4 (2019): 2539-2552.
[16] Sun, Mingshen, Tao Wei, and John CS Lui.”Taintart: A practical multi-level information-flow tracking system for android runtime.” In Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security. 2016.
[17] Xue, Lei, et al. ”NDroid: Toward tracking information flows across multiple Android contexts.” In IEEE Transactions on Information Forensics and Security 14.3 (2018): 814-828.
[18] Shoshitaishvili, Yan, et al. ”Sok:(state of) the art of war: Offensive techniques in binary analysis.” In 2016 IEEE Symposium on Security and Privacy(SP). IEEE, 2016.
[19] jpy a Python Java Bridge. Accessed 14 May 2020 https://github.com/bcdev/jpy
[20] Shoshitaishvili, Yan, et al. ”Firmalice-Automatic Detection of Authentication Bypass Vulnerabilities in Binary Firmware.” NDSS. Vol. 1. 2015.
[21] Wei, Fengguo, et al. ”Deep ground truth analysis of current android malware. ” In International Conference on Detection of Intrusions and Malware, and Vulnerability Assessment. Springer, Cham, 2017.
[22] Christensen, Aske Simon, Anders Møller, and Michael I. Schwartzbach. ”Precise analysis of string expressions.” In International Static Analysis Symposium. Springer, Berlin, Heidelberg, 2003.
[23] Li, Ding, et al. ”String analysis for Java and Android applications.” In Proceedings of the 2015 10th Joint Meeting on Foundations of Software Engineering. 2015.
[24] Shannon, Daryl, et al. ”Abstracting symbolic execution with string analysis. ” In Testing: Academic and Industrial Conference Practice and Research Techniques-MUTATION (TAICPARTMUTATION 2007). IEEE, 2007.
[25] Zhang, Yifei, et al. ”Ripple: Reflection analysis for Android apps in incomplete information environments.” Software: Practice and Experience 48.8 (2018): 1419-1437.
[26] Li, Li, et al. ”Droidra: Taming reflection to support whole-program analysis of android apps.” In Proceedings of the 25th International Symposium on Software Testing and Analysis. 2016.
[27] Baldoni, Roberto, et al. ”A survey of symbolic execution techniques.” In ACM Computing Surveys (CSUR) 51.3 (2018): 1-39.
[28] Trabish, David, et al. ”Chopped symbolic execution.” In Proceedings of the 40th International Conference on Software Engineering. 2018.