Abstract:Android has provided dynamic code loading (DCL) since API level one. DCL allows an app developer to load additional code at runtime. DCL raises numerous challenges with regards to security and accountability analysis of apps. While previous studies have investigated DCL on Android, in this paper we formulate and answer three critical questions that are missing from previous studies: (1) Where does the loaded code come from (remotely fetched or locally packaged), and who is the responsible entity to invoke its functionality? (2) In what ways is DCL utilized to harden mobile apps, specifically, application obfuscation? (3) What are the security risks and implications that can be found from DCL in off-the-shelf apps? We design and implement DyDroid, a system which uses both dynamic and static analysis to analyze dynamically loaded code. Dynamic analysis is used to automatically exercise apps, capture DCL behavior, and intercept the loaded code. Static analysis is used to investigate malicious behavior and privacy leakage in that dynamically loaded code. We have used DyDroid to analyze over 46K apps with little manual intervention, allowing us to conduct a large-scale measurement to investigate five aspects of DCL, such as source identification, malware detection, vulnerability analysis, obfuscation analysis, and privacy tracking analysis. We have several interesting findings. (1) 27 apps are found to violate the content policy of Google Play by executing code downloaded from remote servers. (2) We determine the distribution, pros/cons, and implications of several common obfuscation methods, including DEX encryption/loading. (3) DCL's stealthiness enables it to be a channel to deploy malware, and we find 87 apps loading malicious binaries which are not detected by existing antivirus tools. (4) We found 14 apps that are vulnerable to code injection attacks due to dynamically loading code which is writable by other apps. (5) DCL is mainly used by third-party SDKs, meaning that app developers may not know what sort of sensitive functionality is injected into their apps.

A Plugin for Kotlin Based Android Apps to Detect Security Breaches Through Dataflow.

DroidPatrol: A Static Analysis Plugin for Secure Mobile Software Development

Emerging Trends in Code Quality: Introducing Kotlin-Specific Bad Smell Detection Tool for Android Apps

DroidDissector: A Static and Dynamic Analysis Tool for Android Malware Detection

To what extent can we analyze Kotlin programs using existing Java taint analysis tools? (Extended Version)

Safety Detection Method of Android App Based on Drozer

Taxonomy of security weaknesses in Java and Kotlin Android apps

AutoPatchDroid: A Framework for Patching Inter-App Vulnerabilities in Android Application

DynaLog: An automated dynamic analysis framework for characterizing Android applications

Toward an Android Static Analysis Approach for Data Protection

An empirical study on quality of Android applications written in Kotlin language

Dynamic Security Analysis on Android: A Systematic Literature Review

DroidAlarm: an all-sided static analysis tool for Android privilege-escalation malware.

Supporting secure programming in web applications through interactive static analysis.

Security Toolbox for Detecting Novel and Sophisticated Android Malware

Static Analysis for Android GDPR Compliance Assurance

ConsiDroid: A Concolic-based Tool for Detecting SQL Injection Vulnerability in Android Apps

DroidProtector: Preventing Capability Leak of Android Applications

DyDroid: Measuring Dynamic Code Loading and Its Security Implications in Android Applications.

Automated, Dynamic Android App Vulnerability and Privacy Leak Analysis: Design Considerations, Required Components and Available Tools

AndroShield: Automated Android Applications Vulnerability Detection, a Hybrid Static and Dynamic Analysis Approach