Detecting Passive Content Leaks and Pollution in Android Applications.

摘要: In this paper, we systematically study two vulnerabilities and their presence in existing Android applications (or “apps”). These are rooted an unprotected component, i.e., content provider, inside vulnerable apps. Because of the lack necessary access control enforcement, affected apps can be exploited to either passively disclose various types private in-app data or inadvertently manipulate certain security-sensitive settings configurations that may subsequently cause serious system-wide side effects (e.g., blocking all incoming phone calls SMS messages). To assess prevalence these vulnerabilities, analyze 62, 519 collected February 2012 from markets. Our results show among apps, 1, 279 (2.0%) 871 (1.4%) them susceptible respectively. addition, find 435 (0.7%) 398 (0.6%) accessible official Google Play some extremely popular with more than 10, 000, 000 installs. The a large number markets as well variety for leaks manipulation reflect severity vulnerabilities. address them, also explore examine possible mitigation solutions.