Analysis of Android Inter-App Security Vulnerabilities Using COVERT
Title | Analysis of Android Inter-App Security Vulnerabilities Using COVERT |
Publication Type | Conference Proceedings |
Year of Publication | 2015 |
Authors | Alireza Sadeghi, Hamid Bagheri, Sam Malek |
Conference Name | ICSE '15 Proceedings of the 37th International Conference on Software Engineering |
Series Title | Tool Demo Track |
Volume | 2 |
Date Published | 05-16/2015 |
Publisher | IEEE Press Piscataway, NJ, USA ©2015 |
Conference Location | Florence, Italy |
Keywords | Apr'15, CMU |
Abstract | The state-of-the-art in securing mobile software systems are substantially intended to detect and mitigate vulnerabilities in a single app, but fail to identify vulnerabilities that arise due to the interaction of multiple apps, such as collusion attacks and privilege escalation chaining, shown to be quite common in the apps on the market. This paper demonstrates COVERT, a novel approach and accompanying tool-suite that relies on a hybrid static analysis and lightweight formal analysis technique to enable compositional security assessment of complex software. Through static analysis of Android application packages, it extracts relevant security specifications in an analyzable formal specification language, and checks them as a whole for inter-app vulnerabilities. To our knowledge, COVERT is the first formally-precise analysis tool for automated compositional analysis of Android apps. Our study of hundreds of Android apps revealed dozens of inter-app vulnerabilities, many of which were previously unknown. A video highlighting the main features of the tool can be found at: http://youtu.be/bMKk7OW7dGg. |
Citation Key | node-25001 |