Abstract
We examine the lifetime of API vulnerabilities on Android and propose an exponential decay model of the uptake of updates after the release of a fix. We apply our model to a case study of the JavaScript-to-Java interface vulnerability. This vulnerability allows untrusted JavaScript in a WebView to break out of the JavaScript sandbox allowing remote code execution on Android phones; this can often then be further exploited to gain root access. While this vulnerability was first publicly disclosed in December 2012, we predict that the fix will not have been deployed to 95% of devices until December 2017, 5.17 years after the release of the fix. We show how this vulnerability is exploitable in many apps and the role that ad-libraries have in making this flaw so widespread.
This is a preview of subscription content, log in via an institution to check access.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
Similar content being viewed by others
Notes
- 1.
We have made these available [13].
- 2.
https://codereview.chromium.org/213693005/patch/20001/30001 committed as 261801 or afae5d83d66c1d041a1fa433fbb087c5cc604b67 or e55966f4c3773a24fe46f9bab60ab3a3fc19abaf.
References
Bergman, N.:. Abusing WebView JavaScript bridges (2012). http://d3adend.org/blog/?p=314. Accessed 09 January 2015
Clark, J., van Oorschot, P.C.: SoK: SSL and HTTPS: revisiting past challenges and evaluating certificate trust model enhancements. In: IEEE Symposium on Security and Privacy, pp. 511–525 (2013). doi:10.1109/SP.2013.41
Fahl, S., Harbach, M., Muders, T., Smith, M., Baumgärtner, L., Freisleben, B.: Why Eve and Mallory love Android: an analysis of android SSL (in)security. In: CCS, pp. 50–61. ACM (2012). doi:10.1145/2382196.2382205, ISBN: 9781450316514
Georgiev, M., Jana, S., Shmatikov, V.: Breaking and fixing origin-based access control in hybrid web/mobile application frameworks. In: Network and Distributed System Security Symposium (NDSS) (2014). doi:10.14722/ndss.2014.23323
Grace, M.C., Zhou, W., Jiang, X., Sadeghi, A.-R.: Unsafe exposure analysis of mobile in-app advertisements. In: Proceedings of the Fifth ACM Conference on Security and Privacy in Wireless and Mobile Networks (WiSec), pp. 101–112 (2012). doi:10.1145/2185448.2185464
MWR labs. WebView addJavascriptInterface Remote Code Execution (2013). https://labs.mwrinfosecurity.com/blog/2013/09/24/webview-addjavascriptinterface-remote-code-execution/. Accessed 19 December 2014
Luo, T., Hao, H., Du, W., Wang, Y., Yin, H.: Attacks on WebView in the Android system. In: Proceedings of the 27th Annual Computer Security Applications Conference (ACSAC), Orlando, pp. 343–352. ACM (2011). doi:10.1145/2076732.2076781, ISBN: 9781450306720
Mettler, A., Wagner, D., Close, T.: Joe-E: a security-oriented subset of Java. In: Network and Distributed System Security Symposium (NDSS) (2010)
Nappa, A., Johnson, R., Bilge, L., Caballero, J., Dumitras, T.: The attack of the clones: a study of the impact of shared code on vulnerability patching. In: IEEE Symposium on Security and Privacy, pp. 692–708 (2015). doi:10.1109/SP.2015.48.138
Pearce, P., Felt, A.P., Wagner, D.: AdDroid: privilege separation for applications and advertisers in Android. In: ACM Symposium on Information, Computer and Communication Security (ASIACCS) (2012). doi:10.1145/2414456.2414498
Shekhar, S., Dietz, M., Wallach, D.S.: AdSplit: separating smartphone advertising from applications. In: Proceedings of the 21st USENIX Conference on Security Symposium, p. 28 (2012). arXiv: 1202.4030
Stevens, R., Gibler, C., Crussell, J., Erickson, J., Chen, H.: Investigating user privacy in Android ad libraries. In: IEEE Mobile Security Technologies (MoST) (2012)
Thomas, D.R.: Historic Google Play dashboard (2015). http://androidvulnerabilities.org/play/historicplaydashboard
Thomas, D.R., Beresford, A.R., Rice, A.: Security metrics for the android ecosystem. In: ACM CCS Workshop on Security and Privacy in Smartphones and Mobile Devices (SPSM), Denver. ACM (2015). doi:10.1145/2808117.2808118, ISBN: 978-1-4503-3819-6
Thomas, D.R., Coudray, T., Sutcliffe, T.: Supporting data for: “The lifetime of Android API vulnerabilities: case study on the JavaScript-to-Java interface" (2015). https://www.repository.cam.ac.uk/handle/1810/247976. Accessed 26 May 2015
Viennot, N., Garcia, E., Nieh, J.: A measurement study of Google Play. In: SIGMETRICS (2014). doi:10.1145/2591971.2592003
Wagner, D.T., Rice, A., Beresford, A.R.: Device Analyzer: large-scale mobile data collection. In: Sigmetrics, Big Data Workshop, Pittsburgh. ACM (2013). doi:10.1145/2627534.2627553
Wagner, D., Tribble, D.: A security analysis of the Combex DarpaBrowser architecture (2002). http://combexin.temp.veriohosting.com/papers/darpa-review/security-review.pdf. Accessed 08 March 2012
Wognsen, E.R., Karlsen, H.S.: Static analysis of Dalvik bytecode and reflection in Android. In: Master’s thesis, Department of Computer Science, Aalborg University, Aalborg, Denmark (2012)
Acknowledgements
This work was supported by a Google focussed research award; and the EPSRC [grant number EP/P505445/1]. Some of the raw data and source code is available [15]; the analysed APKs are not included as we do not have distribution rights for them. Thanks to Robert N.M. Watson for his insight and useful feedback.
Author information
Authors and Affiliations
Corresponding author
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2015 Springer International Publishing Switzerland
About this paper
Cite this paper
Thomas, D.R., Beresford, A.R., Coudray, T., Sutcliffe, T., Taylor, A. (2015). The Lifetime of Android API Vulnerabilities: Case Study on the JavaScript-to-Java Interface. In: Christianson, B., Švenda, P., Matyáš, V., Malcolm, J., Stajano, F., Anderson, J. (eds) Security Protocols XXIII. Security Protocols 2015. Lecture Notes in Computer Science(), vol 9379. Springer, Cham. https://doi.org/10.1007/978-3-319-26096-9_13
Download citation
DOI: https://doi.org/10.1007/978-3-319-26096-9_13
Published:
Publisher Name: Springer, Cham
Print ISBN: 978-3-319-26095-2
Online ISBN: 978-3-319-26096-9
eBook Packages: Computer ScienceComputer Science (R0)