Abstract:Android has provided dynamic code loading (DCL) since API level one. DCL allows an app developer to load additional code at runtime. DCL raises numerous challenges with regards to security and accountability analysis of apps. While previous studies have investigated DCL on Android, in this paper we formulate and answer three critical questions that are missing from previous studies: (1) Where does the loaded code come from (remotely fetched or locally packaged), and who is the responsible entity to invoke its functionality? (2) In what ways is DCL utilized to harden mobile apps, specifically, application obfuscation? (3) What are the security risks and implications that can be found from DCL in off-the-shelf apps? We design and implement DyDroid, a system which uses both dynamic and static analysis to analyze dynamically loaded code. Dynamic analysis is used to automatically exercise apps, capture DCL behavior, and intercept the loaded code. Static analysis is used to investigate malicious behavior and privacy leakage in that dynamically loaded code. We have used DyDroid to analyze over 46K apps with little manual intervention, allowing us to conduct a large-scale measurement to investigate five aspects of DCL, such as source identification, malware detection, vulnerability analysis, obfuscation analysis, and privacy tracking analysis. We have several interesting findings. (1) 27 apps are found to violate the content policy of Google Play by executing code downloaded from remote servers. (2) We determine the distribution, pros/cons, and implications of several common obfuscation methods, including DEX encryption/loading. (3) DCL's stealthiness enables it to be a channel to deploy malware, and we find 87 apps loading malicious binaries which are not detected by existing antivirus tools. (4) We found 14 apps that are vulnerable to code injection attacks due to dynamically loading code which is writable by other apps. (5) DCL is mainly used by third-party SDKs, meaning that app developers may not know what sort of sensitive functionality is injected into their apps.

Identifying Vulnerabilities of SSL/TLS Certificate Verification in Android Apps with Static and Dynamic Analysis

RiskRanker: scalable and accurate zero-day android malware detection.

DroidAlarm: an all-sided static analysis tool for Android privilege-escalation malware.

When program analysis meets mobile security: an industrial study of misusing Android internet sockets

Demystifying security and compatibility issues in Android Apps

Component Security Ten Years Later: an Empirical Study of Cross-Layer Threats in Real-World Mobile Applications

SIMulation: Demystifying (insecure) Cellular Network Based One-Tap Authentication Services

Security Analysis for Android Applications Using Sensitive Path Identification

DyDroid: Measuring Dynamic Code Loading and Its Security Implications in Android Applications.

Dynamic Security Analysis on Android: A Systematic Literature Review

DroidMD: an Efficient and Scalable Android Malware Detection Approach at Source Code Level

Appcracker: Widespread vulnerabilities in user and session authentication in mobile apps

Electrical Engineering and Computer Science SSL INT : A Tool for Detecting TLS Certificate Validation Vulnerabilities April 2016

Characterizing Android App Signing Issues

Security Analysis of Mobile Device-to-Device Network Applications

DATDroid: Dynamic Analysis Technique in Android Malware Detection

DCDroid: An APK Static Identification Method Based on Naïve Bayes Classifier and Dual‐Centrality Analysis

CryptoEval: Evaluating the Risk of Cryptographic Misuses in Android Apps with Data-Flow Analysis

SAMLDroid: A Static Taint Analysis and Machine Learning Combined High-Accuracy Method for Identifying Android Apps with Location Privacy Leakage Risks

A Mitmproxy-based Dynamic Vulnerability Detection System for Android Applications

Hybrid Dynamic Analysis for Android Malware Protected by Anti-Analysis Techniques with DOOLDA