Abstract:Filesystem vulnerabilities persist as a significant threat to Android systems, despite various proposed defenses and testing techniques. The complexity of program behaviors and access control mechanisms in Android systems makes it challenging to effectively identify these vulnerabilities. In this paper, we present PathSentinel, which overcomes the limitations of previous techniques by combining static program analysis and access control policy analysis to detect three types of filesystem vulnerabilities: path traversals, hijacking vulnerabilities, and luring vulnerabilities. By unifying program and access control policy analysis, PathSentinel identifies attack surfaces accurately and prunes many impractical attacks to generate input payloads for vulnerability testing. To streamline vulnerability validation, PathSentinel leverages large language models (LLMs) to generate targeted exploit code based on the identified vulnerabilities and generated input payloads. The LLMs serve as a tool to reduce the engineering effort required for writing test applications, demonstrating the potential of combining static analysis with LLMs to enhance the efficiency of exploit generation and vulnerability validation. Evaluation on Android 12 and 14 systems from Samsung and OnePlus demonstrates PathSentinel's effectiveness, uncovering 51 previously unknown vulnerabilities among 217 apps with only 2 false positives. These results underscore the importance of combining program and access control policy analysis for accurate vulnerability detection and highlight the promising direction of integrating LLMs for automated exploit generation, providing a comprehensive approach to enhancing the security of Android systems against filesystem vulnerabilities.

A Mitmproxy-based Dynamic Vulnerability Detection System for Android Applications

Detecting Passive Content Leaks and Pollution in Android Applications.

AutoPatchDroid: A Framework for Patching Inter-App Vulnerabilities in Android Application

RiskRanker: scalable and accurate zero-day android malware detection.

Fast, Scalable Detection of "piggybacked" Mobile Applications

AndroShield: Automated Android Applications Vulnerability Detection, a Hybrid Static and Dynamic Analysis Approach

Reviving Android Malware with DroidRide: and How Not To.

When program analysis meets mobile security: an industrial study of misusing Android internet sockets

Mitigating Access Control Vulnerabilities through Interactive Static Analysis.

DroidHook: a novel API-hook based Android malware dynamic analysis sandbox

DroidMD: an Efficient and Scalable Android Malware Detection Approach at Source Code Level

Study on the Application of Dalvik Injection Technique for the Detection of Malicious Programs in Android

NIVAnalyzer: A Tool for Automatically Detecting and Verifying Next-Intent Vulnerabilities in Android Apps

A Hybrid Dynamic Testing technology source code XSS vulnerability detection method

Security Analysis for Android Applications Using Sensitive Path Identification

Android HIV: A Study of Repackaging Malware for Evading Machine-Learning Detection

A DETECTION FRAMEWORK OF CODE-HIDING EVASION TECHNIQUE BASED ON ANDROID SYSTEM

Morpheus: automatically generating heuristics to detect Android emulators.

$μ$Dep: Mutation-based Dependency Generation for Precise Taint Analysis on Android Native Code

An APP Sensitive Behaviors Detection Method Based on Android Kernel and Its Implementation

Static Detection of Filesystem Vulnerabilities in Android Systems