SCLib: A Practical and Lightweight Defense against Component Hijacking in Android Applications

摘要: Cross-app collaboration via inter-component communication is a fundamental mechanism on Android. Although it brings the benefits such as functionality reuse and data sharing, threat called component hijacking also introduced. By vulnerable in victim apps, an attack app can escalate its privilege for operations originally prohibited. Many prior studies have been performed to understand mitigate this issue, but no defense being deployed wild, largely due deployment difficulties performance concerns. In paper we present SCLib, secure library that performs in-app mandatory access control behalf of components. It does not require firmware modification or repackaging previous works. The library-based nature makes SCLib more accessible developers, enables them produce components first place over fragmented Android devices. As proof concept, design six policies overcome unique implementation challenges attacks originated from both system weaknesses common developer mistakes. Our evaluation using ten high-profile open source apps shows protect their 35 risky with negligible code footprint (less than 0.3% stub code) nearly slowdown normal intra-app communications. worst-case overhead stop about 5%.