Automatically exploiting potential component leaks in android applications

Li Li; Alexandre Bartel; Jacques Klein; Yves Le Traon

doi:10.1109/TrustCom.2014.50

Automatically exploiting potential component leaks in android applications

Li Li
, Alexandre Bartel
, Jacques Klein
, Yves Le Traon

University of Luxembourg

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › peer-review

47 Scopus citations

Abstract

We present PCLeaks, a tool based on inter-component communication (ICC) vulnerabilities to perform data-flow analysis on Android applications to find potential component leaks that could potentially be exploited by other components. To evaluate our approach, we run PCLeaks on 2000 apps randomly selected from the Google Play store. PCLeaks reports 986 potential component leaks in 185 apps. For each leak reported by PCLeaks, PCLeaksValidator automatically generates an Android app which tries to exploit the leak. By manually running a subset of the generated apps, we find that 75% of the reported leaks are exploitable leaks.

Original language	English
Title of host publication	Proceedings - 2014 IEEE 13th International Conference on Trust, Security and Privacy in Computing and Communications, TrustCom 2014
Publisher	Institute of Electrical and Electronics Engineers Inc.
Pages	388-397
Number of pages	10
ISBN (Electronic)	9781479965137
DOIs	https://doi.org/10.1109/TrustCom.2014.50
State	Published - 15 Jan 2015
Externally published	Yes
Event	13th IEEE International Conference on Trust, Security and Privacy in Computing and Communications, TrustCom 2014 - Beijing, China Duration: 24 Sep 2014 → 26 Sep 2014

Publication series

Name	Proceedings - 2014 IEEE 13th International Conference on Trust, Security and Privacy in Computing and Communications, TrustCom 2014

Conference

Conference	13th IEEE International Conference on Trust, Security and Privacy in Computing and Communications, TrustCom 2014
Country/Territory	China
City	Beijing
Period	24/09/14 → 26/09/14

Access to Document

10.1109/TrustCom.2014.50

Cite this

Li, L., Bartel, A., Klein, J., & Traon, Y. L. (2015). Automatically exploiting potential component leaks in android applications. In Proceedings - 2014 IEEE 13th International Conference on Trust, Security and Privacy in Computing and Communications, TrustCom 2014 (pp. 388-397). Article 7011274 (Proceedings - 2014 IEEE 13th International Conference on Trust, Security and Privacy in Computing and Communications, TrustCom 2014). Institute of Electrical and Electronics Engineers Inc.. https://doi.org/10.1109/TrustCom.2014.50

Li, Li ; Bartel, Alexandre ; Klein, Jacques et al. / Automatically exploiting potential component leaks in android applications. Proceedings - 2014 IEEE 13th International Conference on Trust, Security and Privacy in Computing and Communications, TrustCom 2014. Institute of Electrical and Electronics Engineers Inc., 2015. pp. 388-397 (Proceedings - 2014 IEEE 13th International Conference on Trust, Security and Privacy in Computing and Communications, TrustCom 2014).

@inproceedings{db08e510b1f246ac8cc86ba016b42805,

title = "Automatically exploiting potential component leaks in android applications",

abstract = "We present PCLeaks, a tool based on inter-component communication (ICC) vulnerabilities to perform data-flow analysis on Android applications to find potential component leaks that could potentially be exploited by other components. To evaluate our approach, we run PCLeaks on 2000 apps randomly selected from the Google Play store. PCLeaks reports 986 potential component leaks in 185 apps. For each leak reported by PCLeaks, PCLeaksValidator automatically generates an Android app which tries to exploit the leak. By manually running a subset of the generated apps, we find that 75\% of the reported leaks are exploitable leaks.",

author = "Li Li and Alexandre Bartel and Jacques Klein and Traon, \{Yves Le\}",

note = "Publisher Copyright: {\textcopyright} 2014 IEEE.; 13th IEEE International Conference on Trust, Security and Privacy in Computing and Communications, TrustCom 2014 ; Conference date: 24-09-2014 Through 26-09-2014",

year = "2015",

month = jan,

day = "15",

doi = "10.1109/TrustCom.2014.50",

language = "英语",

series = "Proceedings - 2014 IEEE 13th International Conference on Trust, Security and Privacy in Computing and Communications, TrustCom 2014",

publisher = "Institute of Electrical and Electronics Engineers Inc.",

pages = "388--397",

booktitle = "Proceedings - 2014 IEEE 13th International Conference on Trust, Security and Privacy in Computing and Communications, TrustCom 2014",

address = "美国",

}

Li, L, Bartel, A, Klein, J & Traon, YL 2015, Automatically exploiting potential component leaks in android applications. in Proceedings - 2014 IEEE 13th International Conference on Trust, Security and Privacy in Computing and Communications, TrustCom 2014., 7011274, Proceedings - 2014 IEEE 13th International Conference on Trust, Security and Privacy in Computing and Communications, TrustCom 2014, Institute of Electrical and Electronics Engineers Inc., pp. 388-397, 13th IEEE International Conference on Trust, Security and Privacy in Computing and Communications, TrustCom 2014, Beijing, China, 24/09/14. https://doi.org/10.1109/TrustCom.2014.50

Automatically exploiting potential component leaks in android applications. / Li, Li; Bartel, Alexandre; Klein, Jacques et al.
Proceedings - 2014 IEEE 13th International Conference on Trust, Security and Privacy in Computing and Communications, TrustCom 2014. Institute of Electrical and Electronics Engineers Inc., 2015. p. 388-397 7011274 (Proceedings - 2014 IEEE 13th International Conference on Trust, Security and Privacy in Computing and Communications, TrustCom 2014).

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › peer-review

TY - GEN

T1 - Automatically exploiting potential component leaks in android applications

AU - Li, Li

AU - Bartel, Alexandre

AU - Klein, Jacques

AU - Traon, Yves Le

PY - 2015/1/15

Y1 - 2015/1/15

N2 - We present PCLeaks, a tool based on inter-component communication (ICC) vulnerabilities to perform data-flow analysis on Android applications to find potential component leaks that could potentially be exploited by other components. To evaluate our approach, we run PCLeaks on 2000 apps randomly selected from the Google Play store. PCLeaks reports 986 potential component leaks in 185 apps. For each leak reported by PCLeaks, PCLeaksValidator automatically generates an Android app which tries to exploit the leak. By manually running a subset of the generated apps, we find that 75% of the reported leaks are exploitable leaks.

AB - We present PCLeaks, a tool based on inter-component communication (ICC) vulnerabilities to perform data-flow analysis on Android applications to find potential component leaks that could potentially be exploited by other components. To evaluate our approach, we run PCLeaks on 2000 apps randomly selected from the Google Play store. PCLeaks reports 986 potential component leaks in 185 apps. For each leak reported by PCLeaks, PCLeaksValidator automatically generates an Android app which tries to exploit the leak. By manually running a subset of the generated apps, we find that 75% of the reported leaks are exploitable leaks.

UR - https://www.scopus.com/pages/publications/84923025805

U2 - 10.1109/TrustCom.2014.50

DO - 10.1109/TrustCom.2014.50

M3 - 会议稿件

AN - SCOPUS:84923025805

T3 - Proceedings - 2014 IEEE 13th International Conference on Trust, Security and Privacy in Computing and Communications, TrustCom 2014

SP - 388

EP - 397

BT - Proceedings - 2014 IEEE 13th International Conference on Trust, Security and Privacy in Computing and Communications, TrustCom 2014

PB - Institute of Electrical and Electronics Engineers Inc.

T2 - 13th IEEE International Conference on Trust, Security and Privacy in Computing and Communications, TrustCom 2014

Y2 - 24 September 2014 through 26 September 2014

ER -

Li L, Bartel A, Klein J, Traon YL. Automatically exploiting potential component leaks in android applications. In Proceedings - 2014 IEEE 13th International Conference on Trust, Security and Privacy in Computing and Communications, TrustCom 2014. Institute of Electrical and Electronics Engineers Inc. 2015. p. 388-397. 7011274. (Proceedings - 2014 IEEE 13th International Conference on Trust, Security and Privacy in Computing and Communications, TrustCom 2014). doi: 10.1109/TrustCom.2014.50

Automatically exploiting potential component leaks in android applications

Abstract

Publication series

Conference

Access to Document

Other files and links

Fingerprint

Cite this