SecComp: Towards Practically Defending Against Component Hijacking in Android Applications

摘要: Cross-app collaboration via inter-component communication is a fundamental mechanism on Android. Although it brings the benefits such as functionality reuse and data sharing, threat called component hijacking also introduced. By vulnerable in victim apps, an attack app can escalate its privilege for originally prohibited operations. Many prior studies have been performed to understand mitigate this issue, but remains serious open problem Android ecosystem due no effective defense deployed wild. In paper, we present our vision practically defending against apps. First, argue that fundamentally prevent hijacking, need switch from previous mindset (i.e., performing system-level control or repackaging apps after they are already released) more proactive version aims help security-inexperienced developers make secure components first place. To end, propose embed into library (SecComp), which performs in-app mandatory access behalf of components. An important factor SecComp be find possible devise set practical policies stop hijacking. Furthermore, allow design custom policies, beyond by-default generic support fine-grained control. We overcome challenges implement preliminary prototype, stops with very low performance overhead. hope future research fully implements eventually real-world get rid