论文标题
对Android非SDK（隐藏）服务API安全的系统研究
A Systematic Study of Android Non-SDK (Hidden) Service API Security
论文作者
论文摘要
Android允许应用程序通过系统服务助手与其系统服务进行通信，以便这些应用程序可以使用系统服务提供的各种功能。同时，系统服务依靠其服务帮助者来执行安全检查以进行保护。不幸的是，可以通过直接利用非SDK（隐藏的）API来绕过服务帮助者的安全检查，从而降低稳定性并构成严重的安全威胁，例如特权升级，没有用户交互，崩溃和DOS攻击的自动函数执行。 Google提出了各种方法来解决此问题，例如，逐案案例修复错误，甚至提出黑名单以阻止所有非SDK API。但是，开发人员仍然可以找出利用这些隐藏的API来逃避非SDK限制的新方法。 在本文中，我们系统地研究了由于隐藏的API开发而导致的漏洞，并分析了Google对策的有效性。我们的目的是回答是否仍然有脆弱的隐藏API，可以在最新的Android 12中利用。我们开发了一种称为ServiceAudit的静态分析工具，可以自动挖掘服务助手类和隐藏服务API之间的不一致的安全执行。我们对Android 6〜12应用服务。我们的工具在Android 6中发现了112个漏洞，其精度高于现有方法。此外，在Android 11和12中，我们确定了25个以上的隐藏API，具有不一致的保护；但是，只有一个脆弱的API可以在Android 11中导致严重的安全问题，并且它们都无法在Android 12上工作。
Android allows apps to communicate with its system services via system service helpers so that these apps can use various functions provided by the system services. Meanwhile, the system services rely on their service helpers to enforce security checks for protection. Unfortunately, the security checks in the service helpers may be bypassed via directly exploiting the non-SDK (hidden) APIs, degrading the stability and posing severe security threats such as privilege escalation, automatic function execution without users' interactions, crashes, and DoS attacks. Google has proposed various approaches to address this problem, e.g., case-by-case fixing the bugs or even proposing a blacklist to block all the non-SDK APIs. However, the developers can still figure out new ways of exploiting these hidden APIs to evade the non-SDKs restrictions. In this paper, we systematically study the vulnerabilities due to the hidden API exploitation and analyze the effectiveness of Google's countermeasures. We aim to answer if there are still vulnerable hidden APIs that can be exploited in the newest Android 12. We develop a static analysis tool called ServiceAudit to automatically mine the inconsistent security enforcement between service helper classes and the hidden service APIs. We apply ServiceAudit to Android 6~12. Our tool discovers 112 vulnerabilities in Android 6 with higher precision than existing approaches. Moreover, in Android 11 and 12, we identify more than 25 hidden APIs with inconsistent protections; however, only one of the vulnerable APIs can lead to severe security problems in Android 11, and none of them work on Android 12.
