Security vetting Android native libraries
Event details
| Date | 19.06.2023 |
| Hour | 16:00 › 18:00 |
| Speaker | Philipp Yuxiang Mao |
| Location | |
| Category | Conferences - Seminars |
EDIC candidacy exam
Exam president: Prof. Carmela Troncoso
Thesis advisor: Prof. Mathias Payer
Co-examiner: Prof. Bryan Ford
Abstract
Smartphones are ubiquitous in our daily lives and we rely on their functionality
and the apps they offer.
Android apps, generally implemented in Java, often incorporate native libraries written
in a low-level language such as C/C++.
These native libraries are prone to memory corruption vulnerabilities.
When apps use native libraries to process untrusted data, these vulnerabilities are
exposed to attackers, creating an attack surface that may be exploited to gain access
to a victim's phone.
This attack surface has so far not been thoroughly studied and warrants in-depth investigation.
To understand how common vulnerabilities in
native libraries are, we propose to use fuzzing to automatically
discover vulnerabilities. Fuzzing is an automated software
testing technique that involves injecting invalid, unexpected, or
random data inputs into a program to discover vulnerabilities.
To fuzz native libraries we propose Androlib a system that
automatically synthesizes fuzz drivers by statically analyzing apps to extract how the libraries are used.
To understand the impact of discovered vulnerabilities, we plan
to study how the multi-language setting (interpreted Java
and native C/C++) of an Android app may be leveraged by
an attacker to circumvent mitigations or create new attack
primitives.
Background papers
Exam president: Prof. Carmela Troncoso
Thesis advisor: Prof. Mathias Payer
Co-examiner: Prof. Bryan Ford
Abstract
Smartphones are ubiquitous in our daily lives and we rely on their functionality
and the apps they offer.
Android apps, generally implemented in Java, often incorporate native libraries written
in a low-level language such as C/C++.
These native libraries are prone to memory corruption vulnerabilities.
When apps use native libraries to process untrusted data, these vulnerabilities are
exposed to attackers, creating an attack surface that may be exploited to gain access
to a victim's phone.
This attack surface has so far not been thoroughly studied and warrants in-depth investigation.
To understand how common vulnerabilities in
native libraries are, we propose to use fuzzing to automatically
discover vulnerabilities. Fuzzing is an automated software
testing technique that involves injecting invalid, unexpected, or
random data inputs into a program to discover vulnerabilities.
To fuzz native libraries we propose Androlib a system that
automatically synthesizes fuzz drivers by statically analyzing apps to extract how the libraries are used.
To understand the impact of discovered vulnerabilities, we plan
to study how the multi-language setting (interpreted Java
and native C/C++) of an Android app may be leveraged by
an attacker to circumvent mitigations or create new attack
primitives.
Background papers
Practical information
- General public
- Free