Motivation S MART G EN Design Applications Evaluation Related Work Conclusion References S MART G EN : Exposing Server URLs of Mobile Apps with Selective Symbolic Execution Chaoshun Zuo Zhiqiang Lin Department of Computer Science University of Texas at Dallas April 6th, 2017
Motivation S MART G EN Design Applications Evaluation Related Work Conclusion References Server URLs https://www.google.com/search?q=www+2017
Motivation S MART G EN Design Applications Evaluation Related Work Conclusion References Server URLs https://www.google.com/search?q=www+2017 A URL includes Domain name 1 Resource path 2 Query parameters 3 ... 4
Motivation S MART G EN Design Applications Evaluation Related Work Conclusion References Server URLs https://www.google.com/search?q=www+2017 A URL includes Security Applications Domain name Hidden service identification 1 1 Resource path Malicious website detection 2 2 Query parameters Server vulnerability fuzzing 3 3 ... ... 4 4
Motivation S MART G EN Design Applications Evaluation Related Work Conclusion References Browsers’ URLs vs. Mobile Apps’ URLs
Motivation S MART G EN Design Applications Evaluation Related Work Conclusion References Browsers’ URLs vs. Mobile Apps’ URLs Source: cloudxtension.com
Motivation S MART G EN Design Applications Evaluation Related Work Conclusion References Security Implications of the URLs in Mobile Apps Hiding the URLs may allow the 1 servers to collect some private sensitive information Mobile apps may talk to some 2 unwanted services (e.g., malicious ads sites) False illusions (security 3 through obscurity) to the app developers that their services are secure (server URLs are hidden, none knows and none Source: cloudxtension.com will attack (or fuzz) them).
Motivation S MART G EN Design Applications Evaluation Related Work Conclusion References Security Implications of the URLs in Mobile Apps Hiding the URLs may allow the 1 servers to collect some private sensitive information Mobile apps may talk to some 2 unwanted services (e.g., malicious ads sites) False illusions (security 3 through obscurity) to the app developers that their services are secure (server URLs are hidden, none knows and none Source: cloudxtension.com will attack (or fuzz) them). It is imperative to expose the server URLs from mobile apps
Motivation S MART G EN Design Applications Evaluation Related Work Conclusion References A Movitating Example: ShopClues Figure: The password reset activity of ShopClues (between 10 million and 50 million installs).
Motivation S MART G EN Design Applications Evaluation Related Work Conclusion References A Movitating Example: ShopClues PUT /api/v9/forgotpassword?key=d12121c70dda5edfgd1df6633fdb36c0 HTTP/1.1 Content-Type: application/json Connection: close User-Agent: Dalvik/1.6.0 (Linux; Android 4.2) Host: sm.shopclues.com Accept-Encoding: gzip Content-Length: 73 {"user_email":”testmobileserver@gmail.com","key":"d12121c70dda5e dfgd1df6633fdb36c0"} There was an SQL injection vulnerability at this password reset interface
Motivation S MART G EN Design Applications Evaluation Related Work Conclusion References Which Analysis We Should Use? Static Analysis vs. Dynamic Analysis vs. Symbolic Execution PUT /api/v9/forgotpassword?key=d12121c70dda5edfgd1df6633fdb36c0 HTTP/1.1 Content-Type: application/json Connection: close User-Agent: Dalvik/1.6.0 (Linux; Android 4.2) Host: sm.shopclues.com Accept-Encoding: gzip Content-Length: 73 {"user_email":”testmobileserver@gmail.com","key":"d12121c70dda5e dfgd1df6633fdb36c0"}
Motivation S MART G EN Design Applications Evaluation Related Work Conclusion References Which Analysis We Should Use? Static Analysis vs. Dynamic Analysis vs. Symbolic Execution PUT /api/v9/forgotpassword?key=d12121c70dda5edfgd1df6633fdb36c0 HTTP/1.1 Content-Type: application/json Connection: close User-Agent: Dalvik/1.6.0 (Linux; Android 4.2) Host: sm.shopclues.com Accept-Encoding: gzip Content-Length: 73 {"user_email":”testmobileserver@gmail.com","key":"d12121c70dda5e dfgd1df6633fdb36c0"} Static Analysis String cantenation Crypto keys
Motivation S MART G EN Design Applications Evaluation Related Work Conclusion References Which Analysis We Should Use? Static Analysis vs. Dynamic Analysis vs. Symbolic Execution PUT /api/v9/forgotpassword?key=d12121c70dda5edfgd1df6633fdb36c0 HTTP/1.1 Content-Type: application/json Connection: close User-Agent: Dalvik/1.6.0 (Linux; Android 4.2) Host: sm.shopclues.com Accept-Encoding: gzip Content-Length: 73 {"user_email":”testmobileserver@gmail.com","key":"d12121c70dda5e dfgd1df6633fdb36c0"} Static Analysis Dynamic Analysis Random inputs String cantenation Incompleteness Crypto keys ...
Motivation S MART G EN Design Applications Evaluation Related Work Conclusion References Which Analysis We Should Use? Static Analysis vs. Dynamic Analysis vs. Symbolic Execution PUT /api/v9/forgotpassword?key=d12121c70dda5edfgd1df6633fdb36c0 HTTP/1.1 Content-Type: application/json Connection: close User-Agent: Dalvik/1.6.0 (Linux; Android 4.2) Host: sm.shopclues.com Accept-Encoding: gzip Content-Length: 73 {"user_email":”testmobileserver@gmail.com","key":"d12121c70dda5e dfgd1df6633fdb36c0"} Static Analysis Dynamic Analysis Symbolic Execution Random inputs Systematic String cantenation Incompleteness Automated Crypto keys ... ...
Motivation S MART G EN Design Applications Evaluation Related Work Conclusion References Symbolic Execution Generating Inputs Based on Program Code 1 package com.shopclues; 2 3 class y implements View$OnClickListener { 4 EditText b; 5 ... 6 public void onClick(View arg5) { 7 String v0 = this.b.getText().toString().trim(); 8 if(v0.equalsIgnoreCase("")) { 9 Toast.makeText(this.a, "Email Id should not be empty", 1).show(); 10 } 11 else if(!al.a(v0)) { 12 Toast.makeText(this.a, "The email entered is not a valid email", 1).show(); 13 } 14 else if(al.b(this.a)) { 15 this.a.c = new ac(this.a, v0); 16 this.a.c.execute(new Void[0]); 17 } 18 else { 19 Toast.makeText(this.a, "Please check your internet connection", 1).show(); 20 } 21 } 22 }
Motivation S MART G EN Design Applications Evaluation Related Work Conclusion References Various Constraints in Mobile Apps Various Constraints Two text-box’s inputs need to be equivalent 1 The “age” needs to be greater than 18 2 A “zip code” needs to be a five digit sequence 3 A “phone number” needs to be a phone number 4 A file name extension needs to be some type (e.g., jpg ) 5 ... 6
Motivation S MART G EN Design Applications Evaluation Related Work Conclusion References Introducing S MART G EN Dynamic Analysis Request Extracting Path Request Building ECG Message APK APK Constraints Messages Generation Solving the Runtime Instrumentation Constraints Static Analysis Selective Symbolic Execution Real Phone Automated Systematic Scalable
Motivation S MART G EN Design Applications Evaluation Related Work Conclusion References Introducing S MART G EN Dynamic Analysis Request Extracting Path Request Building ECG Message APK APK Constraints Messages Generation Solving the Runtime Instrumentation Constraints Static Analysis Selective Symbolic Execution Real Phone Static analysis Selective symbolic execution Dynamic analysis
Motivation S MART G EN Design Applications Evaluation Related Work Conclusion References Static Analysis Dynamic Analysis Request Extracting Path Request Building ECG Message APK APK Constraints Messages Generation Solving the Runtime Constraints Instrumentation Static Analysis Selective Symbolic Execution Real Phone Using soot [soo] framework Building extended call graph (ECG) EdgeMiner [CFB + 15] for callbacks
Motivation S MART G EN Design Applications Evaluation Related Work Conclusion References Selective Symbolic Execution Dynamic Analysis Request Extracting Path Request Building ECG Message APK APK Constraints Messages Generation Solving the Runtime Instrumentation Constraints Static Analysis Selective Symbolic Execution Real Phone Data flow analysis (w/ FlowDroid [ARF + 14]) Extract the path constraints Solve them w/ Z3-str [ZZG13]
Motivation S MART G EN Design Applications Evaluation Related Work Conclusion References Selective Symbolic Execution Dynamic Analysis Request Extracting Path Request Building ECG Message APK APK Constraints Messages Generation Solving the Runtime Instrumentation Constraints Static Analysis Selective Symbolic Execution Real Phone Data flow analysis (w/ Why Selective : only on the FlowDroid [ARF + 14]) execution path of network Extract the path constraints sending APIs (to trigger the request messages) Solve them w/ Z3-str [ZZG13]
Recommend
More recommend
