On the Soundness of Android Static Analysis

On the Soundness of
Android Static Analysis
15th September
2023
Dr. Jordan Samhi
The 6th International Workshop on
Advances in Mobile App Analysis
Luxembourg
CISPA – Helmholtz Center for Information Security

Who Am I?
Dr. Jordan Samhi
Post-doc at CISPA – Helmholtz Center for Information
Security
Research group: Software Research
jordan.samhi@cispa.de
https://www.jordansamhi.com
15th September 2023 - Jordan Samhi
2

On the Soundness of Android Static Analysis
Solutions and open challenges
3

“
> 6 billion people own a
smartphone
> 71% are Android-based
> Sensitive data
4

High security risks
Bugs
Malicious
Code
Vulnera
bilities
5

6

7
FlowDroid1
1Arzt, Steven, et al. - Flowdroid: Precise context, flow, field, object-sensitive and lifecycle-aware taint analysis for android
- malware detection
- features extraction
- instrumentation
- incompatibility issues
- Type-state issues
- etc.

8
Can you trust this model?
ICC
Reflection
Callbacks

Real Behavior
m()
n()
Soundness of Program Analysis
9

Agenda
• Inter-component
communication
• Native Code
10

Inter-Component
Communication
11

Activity
Activity
Activity
Activity
Activity
Activity
Service
Service
Service
Activity
Broadcast
Receiver
Broadcast
Receiver
12

// Main Activity
protected void onCreate(Bundle b) {
Intent i = new Intent(this,TargetActivity.class);
i.putExtra("test", "value");
startActivity(i);
}
// Target Activity
Intent i = getIntent();
String msg = i.getStringExtra("test");
Log.i(“Test”, msg);
}
● sendBroadcast
● sendBroadcastAsUser
● sendOrderedBroadcast
● sendOrderedBroadcastAsUser
● sendStickyBroadcast
● sendStickyBroadcastAsUser
● sendStickyOrderedBroadcast
● sendStickyOrderedBroadcastAsUser
● startActivities
● startActivity
● startActivityForResult
● startActivityFromChild
● startActivityFromFragment
● startActivityIfNeeded
● startService
● bindService
13

// Main Activity
PendingIntent pi = PendingIntent.getActivity(this, 0, i, 0);
SmsManager sm = SmsManager.getDefault();
sm.sendTextMessage(“0”, null, “0”, pi, null);
} // Target Activity
Intent i = getIntent();
String msg = i.getStringExtra("test");
Log.i(“Test”, msg);
}
Atypical Inter-Component Communication (AICC)
14

What are the
problems?
• What are AICC methods?
• How to reveal AICC
methods to existing
analyzers?
15

● setRepeating
● requestLocationUpdates
● registerNetworkCallback
● setCancelButtonIntent
● sendMultimediaMessage
● setOnClickPendingIntent
● onSuccess
● installExistingPackage
● startDownloadServiceIfRequired
● sendTextMessage
● addAction
● setExact
● setFullScreenIntent
● setDeleteIntent
● setPendingIntentTemplate
● setLatestEventInfo
● setInexactRepeating
● etc.
Systematic study of the Android
Framework
16

Revealing Atypical Inter-Component Communication
STEP 1
STEP 2
STEP 3
STEP 4
RAICC leverages the IFDS framework to propagate Intents to
PendingIntent objects
RAICC leverages the IFDS framework to propagate target
component type to PendingIntent objects
App instrumentation to add typical ICC method depending on
Intent targets
App is repackaged
Main idea: add typical ICC calls for existing analyzers
17

STEP 1
What Intents are “linked” to this PendingIntent?
PendingIntentx {Intenta, …, Intentn}
↦
18

STEP 2
What is the type of the target component that the
PendingIntent refers to?
PendingIntentx {“activity”, “service”}
↦
19

STEP 3
// Main Activity
pi
i
↦ { }
pi
↦ { }
Activity
} startActivity(i);
20

STEP 4
21
// Main Activity
startActivity(i);
}

Evaluation
Real-world apps
Benchmark
20 hand-crafted apps
5 000 goodware / 5 000 malware
22

Main Results
Number of ICC links found by IC3
5 000 goodware 5 000 malware
Before RAICC 20 300 16 222
After RAICC 25 708 26 223
Improvement
+ 5408
(+26.2%)
+10 001
(+61.6%)
23

Reflection
Callback
ICC
?
?
?
24

Reflection
Callback
ICC
?
?
J. Samhi et al., “RAICC: Revealing
Atypical Inter-Component Communication
in Android apps”, ICSE 2021.
● RAICC improves ICC modeling
● It is is already used by
collaborators
● It is maintained
● Improvable on-demand
● RAICC and artifacts are available
at:
https://github.com/JordanSamhi/RAICC
25

27
27

What are the
problems?
• How to account for
native code?
• How to model native
code?
28

Native code
29
Results are bridged

A unified model
30

31
JuCify Overview

32
First part: NativeDiscloser
Extracting native methods information

Method call in the bytecode – native function
Static registration:
nativeGetImei – Java_com_example_app_MainActivity_nativeGetImei
Dynamic registration:
nativeGetImei – some_native_function
33

34

Second part: Call Graph Generation
Native CG Bytecode CG
35

Second part: Call Graph Generation
Native CG Bytecode CG
36

Third part: Call Graph Unification
Unified
Call Graph
Representatio
n
37

38
Let’s see an example

Without JuCify
39

40
With JuCify

 Call-Graph is not enough
 Our ambition is to unify both representations
41

Main results
42

Main results
Number of nodes and edges computed by Soot with
and without JuCify
43

Reflection
Callback
ICC
?
?
44

Reflection
Callback
ICC
?
J. Samhi et al., “JuCify: A Step Towards
Android Code Unification for Enhanced
Static Analysis”, ICSE 2022.
https://github.com/JordanSamhi/JuCify
● We proposed a new approach to
unify the bytecode and native code
representations
● We demonstrated how JuCify is a
step toward code unification
● JuCify and artifacts are available at:
45

Logic Bomb detection
If (…)
[ ]
[ ]
Normal
Abnormal
Check out: J. Samhi, et al. "Difuzer: Uncovering suspicious hidden
sensitive operations in android apps." ICSE 2022.
46

Reflection
Callback
ICC
J. Samhi et al., ”Implicit calls triggered
under certain circumstances”
47
J. Samhi et al., “JuCify: A Step Towards
Android Code Unification for Enhanced
Static Analysis”, ICSE 2022.

OK!
Enough of the
past!
What are next
challenges?
48

The static analysis paradox
Promise
Sound Analysis
49

Reflection
Callback
ICC
Native Code
Conditional implicit calls
AICC
?
?
?
?
?
?
?
?
Analyzing the
Unanalyzable
50

Security is Adversarial
Attackers will try to find
ways to bypass static
analysis
Libraries
51

The Dream in Program Analysis
Find the Ultimate
Abstractions
52

COBOL
ABAP
53

Some Ideas for
Open Challenges
54

What is currently covered by static
analyzers?
How can frameworks be effectively
represented through static modeling?
How can multi-language software be
effectively represented through static
modeling?
55

Control Flow
Graph
Call
Graph
Static
Analysis
Dynamic
Analysis
What is currently covered
by static analyzers?
56

Methods statically
reachable
Methods dynamically
called
?
?
?
What is currently covered
by static analyzers?
57

58
IMPLICIT CALLS

represented through static
modeling?
Software are systems, they interact with
components
59

modeling?
60

1 – Identify development frameworks
modeling?
61
2 – Statically find entry and exit points to and from
frameworks
3 – Propose a static model that connects the dots

modeling?
62

WebView wv = new WebView(context);
setContentView(wv);
webView.loadUrl("www.example.com");
WebSettings settings = wv.getSettings();
settings.setJavaScriptEnabled(true);
modeling?
63

1 – Study the static analysis ecosystem of different languages
2 –To what extent existing tools can be bridged with existing
frameworks
3 – Investigate how to provide unified static model
modeling?
64

Implications for Security
Better Static Code Modeling
=
Better Code Coverage
65
Data leak detection
Aggressive Ads
Trojan horses
Logic vulnerabilities
SQL injection detection
Sensitive operations
detection
Bug detection
Type state misuse detection
Crypto API misuse
Type confusion detection
Hijacking
Spyware
Vulnerability detection
Privacy policy compliance
Logic bombs
GDPR compliance

66
Real Behavior
m()
n()
Soundness of Program Analysis
9
Reflection
Callback
ICC
Native Code
Conditional implicit calls
AICC
?
?
?
?
?
?
?
?
Analyzing the Unanalyzable
My Dream in Program Analysis
Find the Ultimate
Abstractions
What is currently covered by static analyzers?
How can frameworks be effectively represented
through static modeling?
How can multi-language software be effectively
represented through static modeling?
7th February 2023 - Jordan Samhi

On the Soundness of Android Static Analysis

Recommended

Recommended

More Related Content

Similar to On the Soundness of Android Static Analysis

Similar to On the Soundness of Android Static Analysis (20)

Recently uploaded

Recently uploaded (20)

On the Soundness of Android Static Analysis