Automatically Exploiting Potential Component Leaks in Android Applications

Li Li (1) , Alexandre Bartel (1) , Jacques Klein (1) , Yves Le Traon (1)

1 SnT - Interdisciplinary Centre for Security, Reliability and Trust [Luxembourg]

We present PCLeaks, a tool based on inter- component communication (ICC) vulnerabilities to perform data- flow analysis on Android applications to find potential component leaks that could potentially be exploited by other components. To evaluate our approach, we run PCLeaks on 2000 apps randomly selected from the Google Play store. PCLeaks reports 986 potential component leaks in 185 apps. For each leak reported by PCLeaks, PCLeaksValidator automatically generates an Android app which tries to exploit the leak. By manually running a subset of the generated apps, we find that 75% of the reported leaks are exploitable leaks.

Mots clés: Android; Potential Component Leaks

Domaines: Informatique

Li Li, Alexandre Bartel, Jacques Klein, Yves Le Traon. Automatically Exploiting Potential Component Leaks in Android Applications. the 13th International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom 2014), Sep 2014, China. pp.10. ⟨hal-01055793⟩