A static analysis method for detecting security vulnerabilities in Android hybrid apps

Abstract

The invention discloses a static analysis method for detecting security vulnerabilities of Android hybrid apps, which relates to the field of information security detection and includes the following steps: disassembling apk; performing configuration detection on the obtained jimple code; performing semantic analysis on js bridge and extracting jsbridge methods; analyzing dangerous calls on the js side, replacing the webview module, overwriting the method of loading h5url, injecting jsbridge methods and sink methods therein, and inputting the repackaged app into flowdroid for analysis; pulling the h5 page to generate an abstract language tree, locating the jsbridge method on the js side in the js code; using selenium to perform fuzzy testing on the jsbridge method in the h5 page; and summarizing the analysis results. The method can accurately detect security vulnerabilities.

Description

Technical Field

[0001] The present invention relates to the field of information security detection, and in particular to a static analysis method for detecting security vulnerabilities of Android hybrid apps. Background Art

[0002] With the development of mobile Internet, the demand for Android Apps is becoming stronger and stronger. Android developers have distributed a large number of Android applications on Google Play and Huawei App Market for users to use and complete different operating functions. At present, Android applications are mainly divided into three categories: native app, web app and hybrid app. Native app is an application developed based on the Android operating system and using native language. It can directly access resources such as camera, address book and other data with the help of the operating system, and runs smoothly, but it has higher requirements for developers and requires users to download and install it in the application market. Web app is an application developed using web development languages ​​such as HTML, css and javascript. Developers do not need to have professional mobile development experience, but only need to understand network programming to develop web app. This type of app is easier to build and distribute, and does not need to be uploaded to a dedicated Android application market. The disadvantage is that it cannot directly access user device resources, and the user experience is poor.

[0003] Nowadays, more and more Android app developers tend to use hybrid development mode. Hybrid development is a development mode that takes advantage of each other's strengths and makes up for each other's weaknesses. That is, the native code part uses WebView controls or other frameworks to provide containers for H5. The framework of the application is developed using native code, while pages that often change and are related to business are displayed using h5. There are already many popular hybrid apps, such as Douyin, Taobao, and Toutiao. Because WebView is easy to use in the hybrid development mode, it is deeply loved by mobile developers. Research shows that about 80% of Android applications use WebView.

[0004] Android hybrid app mainly contains one or more WebViews, which are one of the key components of hybrid applications. WebView provides a space for the application to display web pages. It is also an interface between the native layer and the web layer, and can bind objects in the native layer to the web for JavaScript to call local Java methods. Developers can develop functional modules of the native layer and the web layer separately, which greatly improves development efficiency.

[0005] However, the interaction mechanism between Native and WebView is very complex, which can easily lead to various security issues in Android applications, such as leakage of user sensitive information, phishing attacks, malicious advertisement loading, etc. Therefore, how to effectively detect security issues of hybrid apps is a topic worthy of in-depth research.

[0006] Therefore, technicians in this field are committed to developing a static analysis method for detecting security vulnerabilities in Android hybrid apps to accurately detect security vulnerabilities. Summary of the invention

[0007] In view of the above-mentioned defects of the prior art, the technical problem to be solved by the present invention is how to detect security vulnerabilities of Android hybrid apps.

[0008] To achieve the above object, the present invention provides a static analysis method for detecting security vulnerabilities of Android hybrid apps, comprising the following steps:

[0009] Step 1, disassemble the apk to get the jimple code;

[0010] Step 2: Perform configuration detection on the jimple code;

[0011] Step 3: Extract js bridge according to the previously summarized communication methods between js and native, and detect all js bridge methods based on the soot tool; wherein the communication methods include intercepting URl requests, intercepting prompt and alert functions, and injecting js context;

[0012] Step 4: Analyze the dangerous calls on the js side, replace the webview module, overwrite the method of loading h5url, inject the js bridge method and sink stub method into the method of loading h5url, and input the repackaged app into flowdroid for analysis;

[0013] Step 5: Pull the h5 page to generate an abstract language tree, and locate the jsbridge method on the js side in the js code;

[0014] Step 6: Use selenium to perform fuzzy testing on the jsbridge method in the h5 page;

[0015] Step 7: Summarize the analysis results.

[0016] Furthermore, the step 2 comprises:

[0017] Step 2.1: For the password plaintext storage vulnerability, perform code scanning on the intermediate code decompiled by soot, scan the jimple code, and determine whether webSettings.setSavePassword(false) is called in the jimple code. If not, add an alarm.

[0018] Furthermore, the step 2 further comprises:

[0019] Step 2.2: To address the vulnerability of lax domain control, check the APIs involved in cross-domain access in webview.

[0020] Furthermore, the API checked in step 2.2 includes:

[0021] setAllowFileAccessFromFileURLs, used to set whether to allow JavaScript loaded through file url to access other file domain local files;

[0022] setAllowUniversalAccessFromFileURLs, used to set whether JavaScript loaded through file URL is allowed to access other domains;

[0023] setAllowFileAccess, used to set whether to use the file protocol;

[0024] setJavaScriptEnabled is used to set whether to use JavaScript.

[0025] Furthermore, the step 2 also includes:

[0026] Step 2.3, scan the reversed AndroidManifest.xml file to find out whether there is an activity whose android:exported is true. If it is set to export, further detect whether the activity uses webview and whether the loaded URL is the file protocol. If the file protocol is used, further check whether any one of the setAllowFileAccessFromFileURLs, the setAllowUniversalAccessFromFileURLs, and the setJavaScriptEnabled is set to true. If any one of the setAllowFileAccessFromFileURLs, the setAllowUniversalAccessFromFileURLs, and the setJavaScriptEnabled is set to true, there is a domain control lax vulnerability.

[0027] Furthermore, the step 3 includes: with respect to the method of injecting the JS context, searching for the annotation @JavascriptInterface in the deassembled jimple code, and the method marked by the annotation unlocking is the jsbridge method.

[0028] Furthermore, step 3 also includes: for Java reflection calls of two communication modes, namely, intercepting prompt / alert and intercepting URL requests, symbol collection and forward search are performed on the disassembled jimple code to locate the specific class of the reflection call, and all public methods of the specific class are regarded as js bridge methods.

[0029] Furthermore, step 4 includes: after obtaining all the js bridge methods, creating a new class, the new class is used to replace the original webview class, calling the jsbridge method in the method of loading h5url of the new class, and adding a sink function, inputting the call result as a parameter into the sink function; and repackaging the app with the injected code and outputting it into an apk file, and inputting it into flowdroid for data flow analysis.

[0030] Furthermore, the step 5 includes: after obtaining the h5 page, using babel to perform semantic analysis on the js code to generate an abstract syntax tree; wherein the babel is a javascript syntax compiler.

[0031] Furthermore, step 5 also includes: using a depth-first search algorithm to perform a name search for the js bridge method in the abstract syntax tree. If it is found that the name or parameters of the detected function match the collected jsbridge method, the function name of the detected function is recorded, and then the detected function is fuzzy tested.

[0032] Compared with the prior art solutions, the beneficial technical effects of the present invention are as follows:

[0033] First, the sensitive data flow in the technical solution of the present invention is more complete. As it is combined with the advanced tool of Java-side data flow analysis, the source code is modified and expanded on its basis, which makes the taint analysis in the technical solution of the present invention more accurate.

[0034] Secondly, the semantic analysis of the present invention is more comprehensive. In order to enhance the risk detection capability, a comprehensive analysis of possible js-java communication situations is performed, including not only direct calls to js bridge methods, but also the use of schema protocols, automatic triggering of event handlers, and processing of reflection situations.

[0035] The concept, specific structure and technical effects of the present invention will be further described below in conjunction with the accompanying drawings to fully understand the purpose, characteristics and effects of the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] Figure 1 is a method flow chart of a preferred embodiment of the present invention;

[0037] Figure 2 is a configuration detection flow chart of a preferred embodiment of the present invention;

[0038] Figure 3 This is a schematic diagram of triggering an XSS attack according to a preferred embodiment of the present invention;

[0039] Figure 4 It is a fuzzy test flow chart of a preferred embodiment of the present invention. DETAILED DESCRIPTION

[0040] The following describes several preferred embodiments of the present invention with reference to the drawings in the specification, so that the technical content is clearer and easier to understand. The present invention can be embodied in many different forms of embodiments, and the protection scope of the present invention is not limited to the embodiments mentioned in the text.

[0041] In the drawings, components with the same structure are indicated by the same numerical reference numerals, and components with similar structures or functions are indicated by similar numerical reference numerals. The size and thickness of each component shown in the drawings are arbitrarily shown, and the present invention does not limit the size and thickness of each component. In order to make the illustration clearer, the thickness of the components is appropriately exaggerated in some places in the drawings.

[0042] Figure 1 is a method flow chart of a preferred embodiment of the present invention. In one embodiment of the present invention, an alarm is given for possible configuration problems of the hybrid app. The specific configuration detection process is as follows: Figure 2 shown.

[0043] First, for the password plaintext storage vulnerability, the intermediate code disassembled by soot was scanned. The reason for the password plaintext storage vulnerability is that the password saving function is enabled by default in WebView. When the user enters the password, a prompt box will pop up: asking the user whether to save the password; if "Yes" is selected, the password will be saved in plaintext to / data / data / com.package.name / databases / webview.db, so there is a risk of password theft.

[0044] Therefore, it is necessary to ensure that the code explicitly disables the password saving reminder function to prevent the plain text password from being stolen locally. Here, the jimple code is scanned to determine whether webSettings.setSavePassword(false) is called in the code. If not, an alarm will be added.

[0045] In response to the vulnerability of lax domain control, several APIs related to cross-domain access in webview were checked. The first is setAllowFileAccessFromFileURLs, which is used to set whether JavaScript loaded through file url is allowed to access local files in other file domains; the second is setAllowUniversalAccessFromFileURLs, which is used to set whether JavaScript loaded through file URL is allowed to access other domains; the third is setAllowFileAccess, which is used to set whether to use the file protocol; the fourth is setJavaScriptEnabled, which is used to set whether to use JavaScript.

[0046] In order to detect whether it is possible to trigger, first scan the reversed AndroidManifest.xml file to find out whether there is an activity whose android:exported is true. If it is set to export, further check whether the activity uses webview and the loaded URL is the file protocol. If the file protocol is used, further check whether the above setAllowFileAccessFromFileURLs, setAllowUniversalAccessFromFileURLs, and setJavaScriptEnabled are set to true. If they are true, there is a domain control lax vulnerability.

[0047] In the second embodiment of the present invention, the Java-side sensitive API that may be called by the H5 page in the hybrid app is detected. Before the detection, the JS bridge is extracted according to the pre-summarized way of communication between JS and native, and then the webview class is rewritten to inject the JSbridge running result into the defined sink stub function, and then flowdroid is used to perform privacy leakage analysis. The specific process is as follows: Figure 2 shown.

[0048] The present invention summarizes the communication methods between js and native, including intercepting URl request, intercepting prompt, alert function and injecting js context.

[0049] (1) Intercepting URl requests. In this mode, the h5 end triggers a url access, for example, by setting href to jump directly:

[0050] window.location.href=url;

[0051] Or by creating a new iframe:

[0052] const iframe=document.createElement('iframe');

[0053] iframe.src = url;

[0054] iframe.style.width=0;

[0055] iframe.style.height=0;

[0056] document.body.appendChild(iframe);

[0057] In this way, native can call the jsbridge method in the url jump processor.

[0058]

[0059] Finally, h5 and native agree on a communication protocol, so that when the jump is triggered on the h5 side, the native side can parse the URL and extract the class and method to be called from the URL.

[0060] (2) Intercept prompt, alert, and confirm. In this mode, h5 initiates alert, confirm, and prompt requests. Native will intercept the prompt sent by h5, as shown below:

[0061]

[0062] Native captures the protocol from h5 in onJsPrompt, and the parsing process is the same as method 1.

[0063] (3) Communication is completed by injecting JS context. This method is the simplest. It only requires adding a @JavascriptInterface annotation to the corresponding Java method, and then the method can be called by the h5 side. However, this method of communication has security vulnerabilities in low versions, and the present invention also makes corresponding warnings.

[0064] The three methods are compared as follows:

[0065]

[0066]

[0067] In order to improve the accuracy as much as possible, the present invention takes the above three communication situations into consideration, detects all js bridge methods based on soot, a java code optimization tool, and then replaces the webview in the Android code with a rewritten new class. This class inherits the webview parent class and covers the methods of loading URLs such as LoadUrl, loadData, loadDataWithBaseUrl, and postUrl. In these methods, the sink stub function is added and the running results of the corresponding jsbridge method are called. The details are as follows:

[0068] (1) For the case where the communication is completed by injecting the JS context method, to find the js bridge method, just look for the @JavascriptInterface annotation in the disassembled jimple code. The method annotated with the annotation is the jsbridge method.

[0069] (2) The methods of using URL request and intercepting prompt methods can be classified into the same category, both of which trigger the method on the native side and then parse the corresponding protocol. In this case, the problem of Java reflection needs to be solved.

[0070] Specifically, the present invention summarizes the common reflection APIs of Java as follows:

[0071]

[0072] According to the above table, the present invention collects symbols for the reflection API in the event processing function. In the event processing function, if the function is dynamically called through reflection, the invoke API must be used. Therefore, the present invention uses forward search to search for method symbols obtained through class methods, and finally finds the method for obtaining class variables.

[0073] For the class finally found by symbol search, all methods of the class are considered to be possible to be called by h5 code, that is, all methods of the class are considered to be possible js bridge methods.

[0074] (3) After getting all the js bridge methods, since the data flow analysis of the present invention is based on flowdroid, flowdroid cannot analyze the h5 code, the present invention needs to create a new class, which is used to replace the original webview class, and call the js bridge method obtained by the above analysis in the loadUrl and other methods of loading h5url in this class, and add a sink function, and input the call result as a parameter into the sink function. Finally, the present invention repackages the app with the injected code and outputs it into an apk file, which is input into flowdroid for data flow analysis.

[0075] In the third embodiment of the present invention, injection attacks that may occur in the h5 code are detected.

[0076] Specifically, when the information displayed in h5 is obtained from the native side, the attacker can inject dangerous strings into the h5 page to trigger an XSS attack, such as Figure 3 As shown, the app obtains the WiFi name and displays it on the page. When the WiFi name contains malicious strings, H5 will trigger an XSS attack, and in serious cases, sensitive information such as cookies will be stolen.

[0077] In order to detect this kind of XSS attack, it is necessary to extract the JS bridge method based on the second part. After obtaining the name of the JS bridge method, perform a fuzzy test on the XSS attack. The specific steps are as follows:

[0078] (1) First, the present invention needs to pull the h5 page. Since the h5 page has two forms, one is the file protocol and the other is the http protocol. For the file protocol, it is directly read from the local, and for the http protocol, it is necessary to first send a request to crawl the web page.

[0079] (2) After obtaining the page, the present invention performs semantic analysis on the js code. Here, the present invention uses babel, which is a javascript syntax compiler, and can also perform semantic analysis on the js code to generate an abstract syntax tree.

[0080] Furthermore, the present invention will perform a name search for the js bridge method in the abstract syntax tree, specifically using a depth-first search algorithm. If it is found that the name or parameter of a function matches the collected js bridge method, the function name will be recorded and then a fuzzy test will be performed on the function.

[0081] (3) The present invention uses the selenium tool as a container for fuzzy testing. Selenium is an automated testing tool that can be used as a headless browser to load h5 pages.

[0082] The fuzz testing process is as follows Figure 4 As shown, the payload is constructed first, including some dangerous strings and generated random characters, then the function is called through selenium, and finally it is checked whether the string is echoed in the page.

[0083] Dozens of XSS attack modes are comprehensively considered during the fuzzy testing process. The following table lists several XSS attack modes used in the present invention.

[0084]

[0085]

[0086] After testing, the present invention can accurately detect the injection vulnerability existing in h5 on the basis of detecting the js bridge method.

[0087] The preferred specific embodiments of the present invention are described in detail above. It should be understood that ordinary technicians in the field can make many modifications and changes based on the concept of the present invention without creative work. Therefore, all technical solutions that can be obtained by technicians in the technical field based on the concept of the present invention through logical analysis, reasoning or limited experiments on the basis of the prior art should be within the scope of protection determined by the claims.

Claims

1. A static analysis method for detecting security vulnerabilities of Android hybrid apps, characterized in that: The following steps are involved: Step 1, disassemble the apk to get the jimple code; Step 2: Perform configuration detection on the jimple code; Step 3: Extract js bridge according to the previously summarized communication methods between js and native, and detect all js bridge methods based on the soot tool; wherein the communication methods include intercepting URl requests, intercepting prompt and alert functions, and injecting js context; Step 4: Analyze the dangerous calls on the js side, replace the webview module, overwrite the method of loading the h5 url, inject the js bridge method and sink stub method into the method of loading the h5 url, and input the repackaged app into flowdroid for analysis; Step 5: Pull the h5 page to generate an abstract language tree, and locate the jsbridge method on the js side in the js code; Step 6: Use selenium to perform fuzzy testing on the jsbridge method in the h5 page; Step 7: Summarize the analysis results.

2. The static analysis method for detecting security vulnerabilities of Android hybrid apps as claimed in claim 1, characterized in that: The step 2 comprises: Step 2.1: For the password plaintext storage vulnerability, perform code scanning on the intermediate code decompiled by soot, scan the jimple code, and determine whether webSettings.setSavePassword(false) is called in the jimple code. If not, add an alarm.

3. The static analysis method for detecting security vulnerabilities of Android hybrid apps as claimed in claim 2, characterized in that: The step 2 also includes: Step 2.2: To address the vulnerability of lax domain control, check the APIs involved in cross-domain access in webview.

4. The static analysis method for detecting security vulnerabilities of Android hybrid apps as claimed in claim 3, characterized in that: The APIs checked in step 2.2 include: setAllowFileAccessFromFileURLs, used to set whether to allow JavaScript loaded through file url to access other file domain local files; setAllowUniversalAccessFromFileURLs, used to set whether JavaScript loaded through file URL is allowed to access other domains; setAllowFileAccess, used to set whether to use the file protocol; setJavaScriptEnabled is used to set whether to use JavaScript.

5. The static analysis method for detecting security vulnerabilities of Android hybrid apps as claimed in claim 4, characterized in that: The step 2 also includes: Step 2.3, scan the reversed AndroidManifest.xml file to find out whether there is an activity whose android:exported is true. If it is set to export, further detect whether the activity uses webview and whether the loaded URL is the file protocol. If the file protocol is used, further check whether any one of the setAllowFileAccessFromFileURLs, the setAllowUniversalAccessFromFileURLs, and the setJavaScriptEnabled is set to true. If any one of the setAllowFileAccessFromFileURLs, the setAllowUniversalAccessFromFileURLs, and the setJavaScriptEnabled is set to true, there is a domain control lax vulnerability.

6. The static analysis method for detecting security vulnerabilities of Android hybrid apps as claimed in claim 5, characterized in that: The step 3 comprises: with respect to the method of injecting the JS context, searching for the annotation @JavascriptInterface in the deassembled jimple code, and the method marked by the annotation unlocking is the js bridge method.

7. The static analysis method for detecting security vulnerabilities of Android hybrid apps as claimed in claim 6, characterized in that: The step 3 also includes: for the Java reflection calls of the two communication modes of intercepting prompt / alert and intercepting URL requests, symbol collection and forward search are performed on the disassembled jimple code, the specific class of the reflection call is located, and all public methods of the specific class are regarded as js bridge methods.

8. The static analysis method for detecting security vulnerabilities of Android hybrid apps as claimed in claim 7, characterized in that: The step 4 includes: after obtaining all the js bridge methods, creating a new class, the new class is used to replace the original webview class, calling the js bridge method in the method of loading the h5 url of the new class, and adding a sink function, inputting the call result as a parameter into the sink function; and repackaging the app with the injected code and outputting it into an apk file, and inputting it into flowdroid for data flow analysis.

9. The static analysis method for detecting security vulnerabilities of Android hybrid apps as claimed in claim 8, characterized in that: The step 5 comprises: after obtaining the h5 page, using babel to perform semantic analysis on the js code to generate an abstract syntax tree; wherein the babel is a javascript syntax compiler.

10. The static analysis method for detecting security vulnerabilities of Android hybrid apps as claimed in claim 9, characterized in that: The step 5 also includes: using a depth-first search algorithm to perform a name search on the js bridge method in the abstract syntax tree. If it is found that the name or parameters of the detected function match the collected js bridge method, the function name of the detected function is recorded, and then a fuzzy test is performed on the detected function.

Images