Automatically exploiting potential component leaks in android applications

Li Li; Alexandre Bartel; Jacques Klein; Yves Le Traon

doi:10.1109/TrustCom.2014.50

Automatically exploiting potential component leaks in android applications

Li Li
, Alexandre Bartel
, Jacques Klein
, Yves Le Traon

University of Luxembourg

科研成果: 书/报告/会议事项章节 › 会议稿件 › 同行评审

47 引用（Scopus）

摘要

We present PCLeaks, a tool based on inter-component communication (ICC) vulnerabilities to perform data-flow analysis on Android applications to find potential component leaks that could potentially be exploited by other components. To evaluate our approach, we run PCLeaks on 2000 apps randomly selected from the Google Play store. PCLeaks reports 986 potential component leaks in 185 apps. For each leak reported by PCLeaks, PCLeaksValidator automatically generates an Android app which tries to exploit the leak. By manually running a subset of the generated apps, we find that 75% of the reported leaks are exploitable leaks.

源语言	英语
主期刊名	Proceedings - 2014 IEEE 13th International Conference on Trust, Security and Privacy in Computing and Communications, TrustCom 2014
出版商	Institute of Electrical and Electronics Engineers Inc.
页	388-397
页数	10
ISBN（电子版）	9781479965137
DOI	https://doi.org/10.1109/TrustCom.2014.50
出版状态	已出版 - 15 1月 2015
已对外发布	是
活动	13th IEEE International Conference on Trust, Security and Privacy in Computing and Communications, TrustCom 2014 - Beijing, 中国期限: 24 9月 2014 → 26 9月 2014

丛书

姓名	Proceedings - 2014 IEEE 13th International Conference on Trust, Security and Privacy in Computing and Communications, TrustCom 2014

会议

会议	13th IEEE International Conference on Trust, Security and Privacy in Computing and Communications, TrustCom 2014
国家/地区	中国
市	Beijing
时期	24/09/14 → 26/09/14

访问文件

10.1109/TrustCom.2014.50

其它文件与链接

链接到 Scopus 的出版物

引用此

Li, L., Bartel, A., Klein, J., & Traon, Y. L. (2015). Automatically exploiting potential component leaks in android applications. 在 Proceedings - 2014 IEEE 13th International Conference on Trust, Security and Privacy in Computing and Communications, TrustCom 2014 (页码 388-397). 期刊论文 7011274 (Proceedings - 2014 IEEE 13th International Conference on Trust, Security and Privacy in Computing and Communications, TrustCom 2014). Institute of Electrical and Electronics Engineers Inc.. https://doi.org/10.1109/TrustCom.2014.50

Li, Li ; Bartel, Alexandre ; Klein, Jacques 等. / Automatically exploiting potential component leaks in android applications. Proceedings - 2014 IEEE 13th International Conference on Trust, Security and Privacy in Computing and Communications, TrustCom 2014. Institute of Electrical and Electronics Engineers Inc., 2015. 页码 388-397 (Proceedings - 2014 IEEE 13th International Conference on Trust, Security and Privacy in Computing and Communications, TrustCom 2014).

@inproceedings{db08e510b1f246ac8cc86ba016b42805,

title = "Automatically exploiting potential component leaks in android applications",

abstract = "We present PCLeaks, a tool based on inter-component communication (ICC) vulnerabilities to perform data-flow analysis on Android applications to find potential component leaks that could potentially be exploited by other components. To evaluate our approach, we run PCLeaks on 2000 apps randomly selected from the Google Play store. PCLeaks reports 986 potential component leaks in 185 apps. For each leak reported by PCLeaks, PCLeaksValidator automatically generates an Android app which tries to exploit the leak. By manually running a subset of the generated apps, we find that 75\% of the reported leaks are exploitable leaks.",

author = "Li Li and Alexandre Bartel and Jacques Klein and Traon, \{Yves Le\}",

note = "Publisher Copyright: {\textcopyright} 2014 IEEE.; 13th IEEE International Conference on Trust, Security and Privacy in Computing and Communications, TrustCom 2014 ; Conference date: 24-09-2014 Through 26-09-2014",

year = "2015",

month = jan,

day = "15",

doi = "10.1109/TrustCom.2014.50",

language = "英语",

series = "Proceedings - 2014 IEEE 13th International Conference on Trust, Security and Privacy in Computing and Communications, TrustCom 2014",

publisher = "Institute of Electrical and Electronics Engineers Inc.",

pages = "388--397",

booktitle = "Proceedings - 2014 IEEE 13th International Conference on Trust, Security and Privacy in Computing and Communications, TrustCom 2014",

address = "美国",

}

Li, L, Bartel, A, Klein, J & Traon, YL 2015, Automatically exploiting potential component leaks in android applications. 在 Proceedings - 2014 IEEE 13th International Conference on Trust, Security and Privacy in Computing and Communications, TrustCom 2014., 7011274, Proceedings - 2014 IEEE 13th International Conference on Trust, Security and Privacy in Computing and Communications, TrustCom 2014, Institute of Electrical and Electronics Engineers Inc., 页码 388-397, 13th IEEE International Conference on Trust, Security and Privacy in Computing and Communications, TrustCom 2014, Beijing, 中国, 24/09/14. https://doi.org/10.1109/TrustCom.2014.50

Automatically exploiting potential component leaks in android applications. / Li, Li; Bartel, Alexandre; Klein, Jacques 等.
Proceedings - 2014 IEEE 13th International Conference on Trust, Security and Privacy in Computing and Communications, TrustCom 2014. Institute of Electrical and Electronics Engineers Inc., 2015. 页码 388-397 7011274 (Proceedings - 2014 IEEE 13th International Conference on Trust, Security and Privacy in Computing and Communications, TrustCom 2014).

科研成果: 书/报告/会议事项章节 › 会议稿件 › 同行评审

TY - GEN

T1 - Automatically exploiting potential component leaks in android applications

AU - Li, Li

AU - Bartel, Alexandre

AU - Klein, Jacques

AU - Traon, Yves Le

PY - 2015/1/15

Y1 - 2015/1/15

N2 - We present PCLeaks, a tool based on inter-component communication (ICC) vulnerabilities to perform data-flow analysis on Android applications to find potential component leaks that could potentially be exploited by other components. To evaluate our approach, we run PCLeaks on 2000 apps randomly selected from the Google Play store. PCLeaks reports 986 potential component leaks in 185 apps. For each leak reported by PCLeaks, PCLeaksValidator automatically generates an Android app which tries to exploit the leak. By manually running a subset of the generated apps, we find that 75% of the reported leaks are exploitable leaks.

AB - We present PCLeaks, a tool based on inter-component communication (ICC) vulnerabilities to perform data-flow analysis on Android applications to find potential component leaks that could potentially be exploited by other components. To evaluate our approach, we run PCLeaks on 2000 apps randomly selected from the Google Play store. PCLeaks reports 986 potential component leaks in 185 apps. For each leak reported by PCLeaks, PCLeaksValidator automatically generates an Android app which tries to exploit the leak. By manually running a subset of the generated apps, we find that 75% of the reported leaks are exploitable leaks.

UR - https://www.scopus.com/pages/publications/84923025805

U2 - 10.1109/TrustCom.2014.50

DO - 10.1109/TrustCom.2014.50

M3 - 会议稿件

AN - SCOPUS:84923025805

T3 - Proceedings - 2014 IEEE 13th International Conference on Trust, Security and Privacy in Computing and Communications, TrustCom 2014

SP - 388

EP - 397

BT - Proceedings - 2014 IEEE 13th International Conference on Trust, Security and Privacy in Computing and Communications, TrustCom 2014

PB - Institute of Electrical and Electronics Engineers Inc.

T2 - 13th IEEE International Conference on Trust, Security and Privacy in Computing and Communications, TrustCom 2014

Y2 - 24 September 2014 through 26 September 2014

ER -

Li L, Bartel A, Klein J, Traon YL. Automatically exploiting potential component leaks in android applications. 在 Proceedings - 2014 IEEE 13th International Conference on Trust, Security and Privacy in Computing and Communications, TrustCom 2014. Institute of Electrical and Electronics Engineers Inc. 2015. 页码 388-397. 7011274. (Proceedings - 2014 IEEE 13th International Conference on Trust, Security and Privacy in Computing and Communications, TrustCom 2014). doi: 10.1109/TrustCom.2014.50

Automatically exploiting potential component leaks in android applications

摘要

丛书

会议

访问文件

其它文件与链接

学术指纹

引用此