iRiS: Vetting Private API Abuse in iOS Applications

摘要: With the booming sale of iOS devices, number applications has increased significantly in recent years. To protect security users, Apple requires every application to go through a vetting process called App Review detect uses private APIs that provide access sensitive user information. However, attacks have shown feasibility using without being detected during Review. counter such attacks, we propose new system, iRiS, this paper. iRiS first applies fast static analysis resolve API calls. For those cannot be statically resolved, novel iterative dynamic approach, which is slower but more powerful compared analysis. We ported Valgrind and implemented prototype on top it. evaluated with 2019 from official Store. From these, identified 146 (7%) use total 150 different APIs, including 25 security-critical information, as device serial number. By analyzing also suspicious advertisement service provider collects privacy information its serving library. Our results show that, contrary popular belief, nontrivial violate Apple's terms exist effective detecting abuse missed by