290 likes | 626 Views
Tongbo Luo , Hao Hao , Wenliang Du , Yifei Wang, and Heng Yin Syracuse University ACSAC 2011. Attacks on WebView in the Android System. Agenda. Introduction WebView Threat Models Attacks from Web Pages Attack from Malicious Apps Case Studies Conclusion. Introduction.
E N D
TongboLuo, HaoHao, Wenliang Du, Yifei Wang, and HengYin Syracuse University ACSAC2011 Attacks on WebView in the Android System
Agenda • Introduction • WebView • Threat Models • Attacks from Web Pages • Attack from Malicious Apps • Case Studies • Conclusion
Introduction • WebView - enabling smartphone and tablet (both in Android & iOS)apps to embed a simple but powerful browser inside them • Two Web's security infrastructure are weakened • Trusted Computing Base (TCB) at the client side • Sandbox protection implemented by browsers
Introduction • Two objectives of Sandbox: • Same-Origin Policy(SOP) • Isolate web pages from the system and isolate the web pages of one origin from those of another
WebView(1/4) • WebView is a subclass of View, and it is used to display web pages • It enables apps to interact with the web content through its APIs • From apps to web pages • From web pages to apps • three types of interactions • Event monitoring • Invoke Java from JavaScript • Invoke JavaScript from Java
WebView(2/4) • Event monitoring
WebView(3/4) • Invoke Java from JavaScript
WebView(4/4) • Invoke JavaScript from Java
Threat Models • Attacks from Malicious Web Pages
Threat Models • Attacks from Malicious Apps
Attacks from Web Pages(1/3) • Through holes on the sandbox • all pages loaded in the WebView can call the same interface • DroidGap • Still need permission
Attacks from Web Pages(2/3) • Through Frame Confusion Public class CameraLauncher{ public void failPicture(String paramString){
Attacks from Web Pages(3/3) • Through Frame Confusion
Attack from Malicious Apps(1/3) • JavaScript Injection • Event Sniffing and Hijacking
Attack from Malicious Apps(2/3) • JavaScript Injection • Android app can inject arbitrary JavaScript code into the pages loaded by the WebView component. • Extracting Information From WebView
Attack from Malicious Apps(3/3) • Event Sniffing and Hijacking • WebViewexposes an umber of hooks to Android apps, allowing them to intercept events, and potentially change the consequences of events. • redirct URL
Case Studies • The goal is not to look for malicious or vulnerable apps, but instead to study how Android apps use WebView. • Usage of WebView • Usage of the WebView Hooks • Usage of addJavascriptInterface • Dex2jar
Conclusion • In our on-going work, we are developing solutions to secure WebView • The goal is to defend against the attacks on WebView by building desirable security features in WebView.