Android 漏洞分析的回顾与思考.pdfVIP

Android漏洞分析的回顾与思考 罗夏朴 香港理工大学 计算机系 1 2 Application Framework Libraries and DalvikVirtual Machine Modified Linux Kernel 3 不正确的访问授权  public abstract FileOutputStream openFileOutput (String name, int mode)  3: MODE_WORLD_READABLE (allow all other applications to have read access to the created file) and MODE_WORLD_WRITEABLE (allow all other applications to have write access to the created file);  0: MODE_PRIVATE (the default mode, where the created file can only be accessed by the calling application (or all applications sharing the same user ID)). 4 输入验证问题 发送一个错误格式的Intent到 com.avast.android.mobilesecurity.app.scanner.DeleteFileActivity 5 缺乏访问控制的组件  Content provider  4.2以前缺省是公开的  Query, insert, delete, update URIs • content://com.qihoo360.mobilesafeguard/backlist • content://com.qihoo360.mobilesafeguard/call_history • content://com.qihoo360.mobilesafeguard/whitelist • content://com.qihoo360.mobilesafeguard/privatecontacts 6 缺乏访问控制的组件  Broadcast receiver http://sh4ka.fr/android/galaxys3/from_0perm_to_INSTALL_PACKAGES_on_galaxy_S3.html 7 缺乏访问控制的组件  Services  com.android.mms app (SmsReceiverService)  4.2 中被修复 /faculty/jiang/smishing.html /thomascannon/android-sms-spoof 8 没有加密的网络通信 9 不恰当地验证SSL/TLS证书 Source: Fahl et al. 10 WebView  一个简化的浏览器  Apps 可注册接口让页面进行访问  该接口被恶意网页所使用  通过Java 反射执行更多的操作  4.2 之后加入限制  没有限制file:/// 引致XSS 攻击 /~wedu/Research/paper/webview_acsac2011.pdf 6/blog/?p=314 /webzine_0x06/PSTZine_0x06_0x05.txt 11 例子  某浏览器注册了接口但没有保护 Discovered by Chenxiong Qian 12 其他可能的漏洞 