论文标题
通过安全镜头中的Android中的Web API
Web APIs in Android through the Lens of Security
论文作者
论文摘要
Web通信已成为移动应用程序必不可少的特征。但是，尚不清楚应用程序传输的数据，这些数据传输以及这些传输的后果。我们从安全性的角度分析了移动应用程序中发现的Web通信。我们首先手动研究了160个Android应用程序，以识别常用的通信库，并了解它们在这些应用中的使用方式。然后，我们开发了一个工具来统计应用程序中使用的Web API URL，并还原JSON数据模式，包括每个参数的类型和值。我们提取了9,714个不同的Web API URL，这些URL已在3,376个应用中使用。我们发现，开发人员经常使用Java.net软件包进行网络通信，但是，许多应用程序也使用了像Okhttp这样的第三方库。我们发现，不安全的HTTP连接在封闭源中的普遍性是开源应用程序的七倍，并且嵌入式SQL和JavaScript代码在500多个不同的应用程序中使用的Web通信中使用。这一发现是毁灭性的。它使数十亿个用户和API服务提供商容易受到攻击。
Web communication has become an indispensable characteristic of mobile apps. However, it is not clear what data the apps transmit, to whom, and what consequences such transmissions have. We analyzed the web communications found in mobile apps from the perspective of security. We first manually studied 160 Android apps to identify the commonly-used communication libraries, and to understand how they are used in these apps. We then developed a tool to statically identify web API URLs used in the apps, and restore the JSON data schemas including the type and value of each parameter. We extracted 9,714 distinct web API URLs that were used in 3,376 apps. We found that developers often use the java.net package for network communication, however, third-party libraries like OkHttp are also used in many apps. We discovered that insecure HTTP connections are seven times more prevalent in closed-source than in open-source apps, and that embedded SQL and JavaScript code is used in web communication in more than 500 different apps. This finding is devastating; it leaves billions of users and API service providers vulnerable to attack.
