1. Analyzing WebView Vulnerabilities in Android Applications
Erika Chin, Stephanie Rogers, and David Wagner
WebView-Based Attacks
Figure 1: WebView-based attack1
Example:
Mobile application code:
myWebView.addJavascriptInterface(
new MobileClass(), “Mc”);
Web application code:
<script>
Mc.mobileFunction(x,y,z)
</script>
Approach
Part I: Android Application-centric analysis
(Completed)
Build a flow-sensitive static analysis tool to identify, for each WebView instance:
Whether it can execute JavaScript
Whether it allows JavaScript to invoke application code
Challenge: Determine code reachability
Challenge: Determine access to permissions
Whether it allows users to navigate to other pages
What URL it loads
Introduction
We will perform a large scale measurement study to determine how many Android applications may be vulnerable to malicious websites that a user may access while browsing.
Android Overview
WebView – Allows developers to display webpages directly in the application
Pros:
Allows the developer to customize the display and implement special features
Cons:
Could allow JavaScript to invoke application code1
Could grant websites access to system resources and data1
Approach (con’t)
Part II: Website-centric analysis (In progress)
Can a malicious website be displayed in the WebView?
Assumption: 1st WebView is trusted unless it contains an advertisement
Build a tool to determine whether a user can navigate away from a designated webpage and land on a potentially malicious third-party site:
Crawl the page (mobile version) and its links
Look for:
Ads
Links to different domains
Challenges:
Identifying ads
Determining if a site is not of the same origin
Evaluation
We propose to:
Run our tool on 1000 applications
Manually review apps to determine:
The type and severity of apps leaking data
Whether devs are excessively exposing code
The false positive rate of the tool
The failure rate of the tool (where it cannot resolve the URL, limitations in reachability analysis, etc.)
Conclusion
Android developers need to be aware of these attacks when using WebViews
We are working towards measuring the prevalence of these WebView-based vulnerabilities
1 Source: ”Attacks on WebView in the Android System,” T. Luo, et al., ACSAC 2011.