An implementation method and system of Android IAST

Abstract

The present invention relates to a method and system for implementing Android IAST in the field of vulnerability detection technology, including the following steps: obtaining system management permissions and installing the xposed framework on the Android system; hijacking the Zygote process and the Dalvik virtual machine based on the xposed framework; adding a proxy instrumentation module within the xposed framework, wherein the agent code logic is woven into the proxy instrumentation module, solving the technical bottleneck that the Android system cannot perform interactive application security testing.

Description

Technical Field

[0001] The present invention relates to the technical field of vulnerability detection, and particularly relates to a method and system for implementing Android IAST. Background Art

[0002] IAST (Interactive Application Security Testing) is a new type of application security testing technology that has been widely accepted in recent years. Compared with DAST (Dynamic Application Security Testing, black box) and SAST (Static Application Security Testing, white box), it has the advantages of low false positives and low false negatives. Currently, the IAST implementation solutions are basically based on bytecode instrumentation, and this technology is only applicable to JAVA. For the Android platform, this technology cannot be implemented because Android platform bytecode instrumentation depends on the gradle plugin, requires modifying the source code to introduce the plugin, and cannot effectively and quickly weave in the agent logic. Therefore, there is currently no IAST implementation solution for the Android platform in the industry. Summary of the Invention

[0003] Aiming at the deficiencies in the prior art, the present invention provides a method and system for implementing Android IAST, which solves the technical bottleneck that the Android system cannot perform interactive application security testing.

[0004] To solve the above technical problems, the present invention is solved by the following technical solutions:

[0005] A method for implementing Android IAST includes the following steps:

[0006] Obtain system management permissions and install the xposed framework on the Android system;

[0007] Based on the xposed framework, hijack the Zygote process and the Dalvik virtual machine;

[0008] Add a proxy instrumentation module within the xposed framework, wherein the agent code logic is woven into the proxy instrumentation module.

[0009] Optionally, obtaining system management permissions includes the following steps:

[0010] Perform a root operation on the Android system to obtain system management permissions.

[0011] Optionally, the agent code logic includes agent vulnerability detection logic and agent information collection logic.

[0012] An Android IAST implementation system, the system executes the Android IAST implementation method as described in any one of the above, and includes a framework installation unit, a hijacking unit, and a proxy instrumentation unit;

[0013] The framework installation unit is used to obtain system management permissions and install the Xposed framework on the Android system;

[0014] The hijacking unit is used to hijack the Zygote process and the Dalvik virtual machine based on the Xposed framework;

[0015] The proxy instrumentation unit is used to add a proxy instrumentation module within the Xposed framework, wherein the agent code logic is woven into the proxy instrumentation module.

[0016] Optionally, the framework installation unit includes a permission acquisition unit;

[0017] The permission acquisition unit is used to perform a root operation on the Android system to obtain system management permissions.

[0018] Optionally, the agent code logic woven into the proxy instrumentation unit includes agent vulnerability detection logic and agent information collection logic.

[0019] Optionally, it further includes a processor and a storage medium, and the storage medium stores an implementation method of an Android IAST as described in any one of the above.

[0020] A computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, it executes the implementation method of the Android IAST as described in any one of the above.

[0021] Adopting the technical solution provided by the present invention, compared with the prior art, it has the following beneficial effects:

[0022] By hijacking the Zygote process and the Dalvik virtual machine through the Xposed framework, the method definition on the Dalvik virtual machine is modified before the Android application starts, so that when the Android application starts, the woven agent logic runs, and then the IAST function is realized through the agent logic. Description of the Drawings

[0023] In order to more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the following will briefly introduce the drawings required for the description of the embodiments or the prior art. Obviously, the following drawings are only some embodiments of the present invention. For those of ordinary skill in the art, other drawings can be obtained based on these drawings without creative efforts.

[0024] Figure 1 It is a flowchart of an implementation method of an Android IAST proposed in Embodiment 1. Detailed implementation mode

[0025] The following further elaborates on the present invention in conjunction with embodiments. The following embodiments are explanations of the present invention, and the present invention is not limited to the following embodiments.

[0026] Embodiment 1

[0027] As Figure 1 shown, a method for implementing Android IAST includes the following steps: obtaining system management permissions and installing the Xposed framework on the Android system; wherein, obtaining system management permissions includes the following steps: performing a root operation on the Android system to obtain system management permissions, and then hijacking the Zygote process and the Dalvik virtual machine based on the Xposed framework.

[0028] Specifically, before installing the Xposed framework, an Android root environment is first required to obtain the permission to install the framework, and this environment can be achieved by performing a root operation on the Android system. After completing the installation of the Xposed framework, when the Android environment starts, the Xposed framework replaces the init process with the / system / bin / app_process program to complete the hijacking of the Zygote process and the Dalvik virtual machine it creates.

[0029] Furthermore, the replacement of the init process is because the Android system is based on Linux, and its first started process is the init process. After the init process starts, it will start the parent process of the Android process, that is, the Zygote process; and the hijacking of the Zygote process is because all application process, including the SystemServer process for running system key core services, are forked from the Zygote process, and the startup configuration of the Zygote process is in the / init.rc script, and the execution file corresponding to the Zygote process is / system / bin / app_process. Therefore, the hijacking is achieved by replacing the init process with the / system / bin / app_process program.

[0030] Furthermore, a proxy instrumentation module is added within the Xposed framework, wherein the agent code logic is woven into the proxy instrumentation module, and the agent code logic includes agent vulnerability detection logic and agent information collection logic.

[0031] Specifically, add the written agent instrumentation module to the Xposed framework. The agent instrumentation module will hook the Android APP methods before the Android application runs, and then weave the agent code logic at the specified code location. The specified code location mentioned in this embodiment refers to dangerous functions, such as Runtime.exec, ProcessImpl.start, etc.; when the Android application is executed, the Android application will run on the hijacked Dalvik virtual machine. After the application starts, the agent will collect the application's environment information and the third-party libraries used by the application and report them to the IAST server.

[0032] When performing functional testing on the application, the vulnerability detection logic code of the agent in the application will perform vulnerability detection. If a vulnerable agent is found, it will report the vulnerability data stream, requests, code location information, vulnerability parameters, etc. to the IAST server, and the IAST server will display the vulnerability detection results.

[0033] Embodiment 2

[0034] An implementation system of Android IAST. The system executes the implementation method of Android IAST described in any one of Embodiment 1, including a framework installation unit, a hijacking unit, and a proxy instrumentation unit; the framework installation unit is used to obtain system management permissions and install the Xposed framework on the Android system; among them, the framework installation unit includes a permission acquisition unit; the permission acquisition unit is used to perform a root operation on the Android system to obtain system management permissions, and then the hijacking unit is used to hijack the Zygote process and the Dalvik virtual machine based on the Xposed framework.

[0035] Specifically, before installing the Xposed framework, an Android root environment is required first to obtain the permission to install the framework, and this environment can be achieved by performing a root operation on the Android system. After the Xposed framework is installed, when the Android environment starts, the Xposed framework will replace the init process with the / system / bin / app_process program to complete the hijacking of the Zygote process and the Dalvik virtual machine it creates.

[0036] Furthermore, the replacement through the init process is because the Android system is based on Linux, and its first started process is the init process. After the init process starts, it will start the parent process of the Android process, that is, the Zygote process; while hijacking the Zygote process is because all application processes, including the SystemServer process used to run the system's key core services, are forked from the Zygote process. The startup configuration of the Zygote process is in the / init.rc script, and the execution file corresponding to the Zygote process is / system / bin / app_process. Therefore, the hijacking is achieved by replacing the init process with the / system / bin / app_process program.

[0037] Furthermore, the proxy instrumentation unit is used to add a proxy instrumentation module within the Xposed framework. Among them, the agent code logic is woven into the proxy instrumentation module, and the agent code logic woven by the proxy instrumentation unit includes agent vulnerability detection logic and agent information collection logic.

[0038] Specifically, a written agent instrumentation module is added in the Xposed framework. The agent instrumentation module will hook the Android APP methods before the Android application runs, and then weave the agent code logic at the specified code location. The specified code location mentioned in this embodiment refers to dangerous functions, such as Runtime.exec, ProcessImpl.start, etc.; when the Android application is executed, the Android application will run on the hijacked Dalvik virtual machine. After the application starts, the agent will collect the application's environment information and the third-party libraries used by the application, and report them to the IAST server.

[0039] When performing functional testing on the application, the vulnerability detection logic code of the agent in the application will perform vulnerability detection. If a vulnerable agent is found, it will report the vulnerability data stream, request, code location information, vulnerability parameters, etc. to the IAST server, and the IAST server will display the vulnerability detection results.

[0040] On the other hand, the implementation system of Android IAST also includes a processor and a storage medium. The storage medium stores the implementation method of an Android IAST described in any item of Embodiment 1.

[0041] A computer-readable storage medium stores a computer program. When the computer program is executed by a processor, it executes the implementation method of the Android IAST described in any item of Embodiment 1.

[0042] More specific examples of computer-readable storage media may include, but are not limited to: electrical connections with one or more wire segments, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0043] In this application, a computer-readable storage medium may be any tangible medium that contains or stores a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. In this application, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, which carries computer-readable program code. Such a propagated data signal may take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the foregoing. A computer-readable signal medium may also be any computer-readable medium other than a computer-readable storage medium, which can send, propagate, or transmit a program for use by or in conjunction with an instruction execution system, apparatus, or device. The program code contained on a computer-readable medium may be transmitted using any appropriate medium, including but not limited to: wireless segments, wire segments, optical fibers, RF, etc., or any suitable combination of the foregoing.

[0044] In several embodiments provided in this application, it should be understood that the disclosed devices and methods may be implemented in other ways. For example, the device embodiments described above are merely illustrative. For example, the division of the modules, units, or components is only a logical functional division, and there may be other division methods in actual implementation. For example, multiple units, modules, or components may be combined or integrated into another device, or some features may be ignored or not executed.

[0045] The units may or may not be physically separated, and the components shown as units may be one physical unit or multiple physical units, that is, they may be located in one place, or may be distributed to multiple different places. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0046] In addition, each functional unit in various embodiments of the present invention may be integrated in a processing unit, or each unit may exist physically alone, or two or more units may be integrated in one unit. The above-mentioned integrated units may be implemented in the form of hardware or in the form of software functional units.

[0047] In particular, according to the embodiments disclosed in the present invention, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments of the present disclosure include a computer program product that includes a computer program carried on a computer-readable medium, and the computer program includes program code for performing the methods shown in the flowcharts. In such an embodiment, the computer program can be downloaded and installed from a network through a communication section and / or installed from a removable medium. When the computer program is executed by a central processing unit (CPU), the above-mentioned functions defined in the methods of the present application are performed. It should be noted that the above-mentioned computer-readable medium in the present application can be a computer-readable signal medium, a computer-readable storage medium, or any combination of the two. The computer-readable storage medium can be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination of the above.

[0048] The flowcharts and block diagrams in the accompanying drawings illustrate the possible architectures, functions, and operations of systems, methods, and computer program products according to various embodiments of the present invention. In this regard, each block in the flowchart or block diagram may represent a module, a program segment, or a part of code that contains one or more executable instructions for implementing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the blocks may occur in a different order than marked in the accompanying drawings. For example, two consecutive blocks shown may actually be executed substantially in parallel, and they may sometimes be executed in the reverse order, depending on the functions involved. It should also be noted that each block in the block diagram and / or flowchart, and the combination of blocks in the block diagram and / or flowchart, can be implemented by a dedicated hardware-based system for performing the specified functions or operations, or can be implemented by a combination of dedicated hardware and computer instructions.

[0049] As described above, the above are only specific embodiments of the present invention, but the protection scope of the present invention is not limited thereto. Any changes or substitutions within the technical scope disclosed by the present invention should be covered by the protection scope of the present invention. Therefore, the protection scope of the present invention should be subject to the protection scope of the claims.

Claims

1. A method for implementing Android IAST, characterized in that, It includes the following steps: Obtain system management permissions and install the Xposed framework on the Android system; Based on the Xposed framework, hijack the Zygote process and the Dalvik virtual machine; Add a proxy instrumentation module within the Xposed framework, where the agent code logic is woven into the proxy instrumentation module.

2. The implementation method of an Android IAST according to claim 1, wherein Obtaining system management permissions includes the following steps: Perform a root operation on the Android system to obtain system management permissions.

3. The implementation method of an Android IAST according to claim 1, wherein The agent code logic includes agent vulnerability detection logic and agent information collection logic.

4. An implementation system for Android IAST, characterized in that, The system executes the implementation method of Android IAST according to any one of claims 1-3, including a framework installation unit, a hijacking unit, and a proxy instrumentation unit; The framework installation unit is used to obtain system management permissions and install the Xposed framework on the Android system; The hijacking unit is used to hijack the Zygote process and the Dalvik virtual machine based on the Xposed framework; The proxy instrumentation unit is used to add a proxy instrumentation module within the Xposed framework, where the agent code logic is woven into the proxy instrumentation module.

5. The implementation system of an Android IAST according to claim 4, characterized in that The framework installation unit includes a permission acquisition unit; The permission acquisition unit is used to perform a root operation on the Android system to obtain system management permissions.

6. The implementation system of an Android IAST according to claim 4, characterized in that, The agent code logic woven into the proxy instrumentation unit includes agent vulnerability detection logic and agent information collection logic.

7. The implementation system of an Android IAST according to claim 4, characterized in that It further includes a processor and a storage medium, characterized in that the storage medium stores the implementation method of an Android IAST according to any one of claims 1-3.

8. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is executed by the processor, it executes the implementation method of Android IAST according to any one of claims 1-3.

Images