Abstract:On modern operating systems, applications under the same user are separated from each other, for the purpose of protecting them against malware and compromised programs. Given the complexity of today's OSes, less clear is whether such isolation is effective against different kind of cross-app resource access attacks (called XARA in our research). To better understand the problem, on the less-studied Apple platforms, we conducted a systematic security analysis on MAC OS~X and iOS. Our research leads to the discovery of a series of high-impact security weaknesses, which enable a sandboxed malicious app, approved by the Apple Stores, to gain unauthorized access to other apps' sensitive data. More specifically, we found that the inter-app interaction services, including the keychain, WebSocket and NSConnection on OS~X and URL Scheme on the MAC OS and iOS, can all be exploited by the malware to steal such confidential information as the passwords for iCloud, email and bank, and the secret token of Evernote. Further, the design of the app sandbox on OS~X was found to be vulnerable, exposing an app's private directory to the sandboxed malware that hijacks its Apple Bundle ID. As a result, sensitive user data, like the notes and user contacts under Evernote and photos under WeChat, have all been disclosed. Fundamentally, these problems are caused by the lack of app-to-app and app-to-OS authentications. To better understand their impacts, we developed a scanner that automatically analyzes the binaries of MAC OS and iOS apps to determine whether proper protection is missing in their code. Running it on hundreds of binaries, we confirmed the pervasiveness of the weaknesses among high-impact Apple apps. Since the issues may not be easily fixed, we built a simple program that detects exploit attempts on OS~X, helping protect vulnerable apps before the problems can be fully addressed.

All Your App Links Are Belong to Us: Understanding the Threats of Instant Apps Based Attacks

Detecting Passive Content Leaks and Pollution in Android Applications.

Unleashing the Walking Dead: Understanding Cross-App Remote Infections on Mobile WebViews.

RiskRanker: scalable and accurate zero-day android malware detection.

Hey, You, Get off of My Market: Detecting Malicious Apps in Official and Alternative Android Markets.

Fast, Scalable Detection of "piggybacked" Mobile Applications

DroidLink: Automated Generation of Deep Links for Android Apps.

Understanding In-App Ads and Detecting Hidden Attacks Through the Mobile App-Web Interface

Direct Resource Hijacking in Android

TrustedDomain Compromise Attack in App-in-app Ecosystems

Appcracker: Widespread vulnerabilities in user and session authentication in mobile apps

Component Security Ten Years Later: an Empirical Study of Cross-Layer Threats in Real-World Mobile Applications

Towards Discovering and Understanding Task Hijacking in Android

SIMulation: Demystifying (insecure) Cellular Network Based One-Tap Authentication Services

Android Inter-App Communication Threats, Solutions, and Challenges

Sidewinder: Targeted attack against Android in the golden age of ad libraries

Lie to Me: Abusing the Mobile Content Sharing Service for Fun and Profit

Unauthorized Cross-App Resource Access on MAC OS X and iOS

Activityhijacker: Hijacking The Android Activity Component For Sensitive Data

Identity Confusion in WebView-based Mobile App-in-app Ecosystems

Aladdin: Automating Release of Android Deep Links to In-App Content