Testing method and system for Android application permission leakage vulnerabilities

Abstract

The invention provides a testing method for Android application permission leakage vulnerabilities. The method includes the steps that step1, all Service and Broadcast Receiver components public externally are extracted from a Manifest file in an Android application package; step2, for Service and Broadcast Receiver inter-module communication component interfaces in Android application, Action, Data and Extras information is extracted to construct an Intent object serving as fuzz test input; step3, through an ICC mechanism, agent application is used for sending the constructed Intent object to the communication interfaces of application target components; step4, through modifying a permission checking function in an Android system, conditions of a permission checking log are monitored, and whether permission leakage happens or not is judged based on the log. The invention further provides a testing system for the Android application permission leakage vulnerabilities. Powerful supports are provided for automatically finding out permission leakage security vulnerabilities in the Android application in a large-scale mode, and the testing method and system have the advantages of having no false positives and few false negatives.

Description

technical field [0001] The invention relates to the technical field of computer program testing, in particular to a method and system for testing Android (Android system) application authority leakage vulnerabilities. Background technique [0002] Android smart phones have become more and more popular, and the Android application market has also grown rapidly. While bringing convenience to users, users' sensitive data is also facing the threat of malicious theft. Google introduces a permission model to protect various sensitive data in users' mobile phones. However, some malicious applications can access sensitive data by calling public interfaces of vulnerable applications without applying for any permissions. This phenomenon is called It is permission leakage, also known as permission re-delegation. In order to reduce the threat to the user's personal sensitive data, Google designed a permission-based model. By default, Android applications are prohibited from obtaining a...

AI Technical Summary

Problems solved by technology

The disassembly technology used has certain obstacles in terms of correctness, and it is currently impossible to completely and correctly decompile Android applications into Java code

Although the program control flow graph technology is a relatively mature technology, the Java inheritance mechanism and asynchronous callback characteristics of Android applications make the construction of Android control flow graphs difficult.

In addition, the feature definition of permission leakage vulnerability based on static analysis technology is vague, and there is no strict and standardized feature definition mode, which leads to false positives and false negatives in vulnerability detection to a certain extent.

Images