Android应用软件功能泄露漏洞挖掘工具的设计与实现

Android平台的功能泄露漏洞会导致权限提升和隐私泄露等严重危害,常被恶意软件用于绕过安全机制.针对这一问题,提出一个基于静态分析的功能泄露漏洞挖掘工具CLDroid.CLDroid使用逆向控制流的程序切片算法从源代码中提取程序逻辑,并利用可定制的安全规则库来检测违规行为.实验结果表明,CLDroid能有效挖掘Android源代码中的功能泄露漏洞,且具有较好的可扩展性.

Design and implementation of capability leak detection for Android applications

Capability leak vulnerability on Android platform may lead to permission elevation and privacy disclosure, and it is often exploited by malicious applications to bypass Android security mechanism. However, so far there is no approach aiming at Android capability leak detection on the source code level comprehensively. In this paper, we propose a novel approach named CLDroid, which uses backward program slicing to abstract application logic from the Java source code, detects pattern violations based on predefined security rules, and reports the violations as capability leak vulnerability. Results show that our approach is effective in detecting capability leak vulnerability and has better scalability.