政大機構典藏-National Chengchi University Institutional Repository(NCCUR):Item 140.119/111455

政大機構典藏-National Chengchi University Institutional Repository(NCCUR):Item 140.119/111455

English | 正體中文 | 简体中文 | Post-Print筆數 : 27 | Items with full text/Total items : 113318/144297 (79%)
Visitors : 50993341 Online Users : 875

RC Version 6.0 © Powered By DSPACE, MIT. Enhanced by NTU Library IR team.

Scope

please add "double quotation mark" for query phrases to get precise results

please goto advance search for comprehansive author search

Adv. Search

Home ‧ Login ‧ Upload ‧ Help ‧ About ‧ Administer

Goto mobile version

政大典藏 > College of Commerce > Department of MIS > Theses > Item 140.119/111455

Please use this identifier to cite or link to this item: https://nccur.lib.nccu.edu.tw/handle/140.119/111455

Title:	使用字串分析揭露iOS執行檔之動態載入類別 Uncovering dynamically loaded classes of iOS executables with static string analysis
Authors:	林君翰 Lin, Jun Han
Contributors:	郁方林君翰 Lin, Jun Han
Keywords:	字串分析行動應用程式動態載入類別 String analysis Mobile App Dynamically loaded classes
Date:	2017
Issue Date:	2017-07-31 10:59:10 (UTC+8)
Abstract:	當今已有數以百萬計的行動應用程序在 Apple 的 App Store 中發布，並在iOS設備下載量超過150億次。為了保護iOS用戶免於惡意應用程式的傷害，Apple 對於上架之App 有相對嚴格的審查政策。通過審查的App才能在App Store中發布。在本文中，我們提出基於 iOS可執行檔的靜態字串分析技術用於檢驗App可能動態載入之類別。為了檢查動態載入之類別是否符合Apple之規範，必須要能確定動態加載函數之可能字串參數值。我們方法的第一步是使用現有工具擷取 iOS可執行檔的組合語言。然後自組合語言中建立整個程式的控制流程圖（CFGs）。接著，在控制流程圖上識別動態加載類別的函數，並且對於該函數的每個參數，我們構造一個字串相依圖，用以顯示流向字串參數值的所有構成成分以及構成方式。最後，我們對這些可能流向參數的字串進行字串分析，以確定這些參數值所有的可能值集合。透過把這些可能值與特徵值（從Apple 審查政策建構而來，例如私有/敏感性API），我們能夠檢測到App 潛在違背Apple政策之情形。我們分析了1300多種目前上架於App Store的App，並檢查他們是否違反蘋果關於使用私有API的政策以及廣告識別碼（IDFA）政策。我們的工具提取了超過37000 這些App的字符相依圖，分析結果顯示208個App透過字串操作構組合出對應的API名稱並且有潛在的IDFA違規濫用之可能。我們的分析還發現了372個可以使用字串構建私有類名稱的應用程序和236個可以使用路徑字符串加載私有框架的App，這些App可能違反Apple 禁止使用私有API使用政策。 Millions of mobile apps have been published in Apple`s AppStore with more than 15 billion downloads by iOS devices. In order to protect iOS users from malicious apps, Apple has strict policies which are used to eliminate apps before they can be published in the AppStore. In this paper we present a string analysis technique for iOS executables for statically checking policies that are related to dynamically loaded classes. In order to check that an app conforms to such a policy, it is necessary to determine the possible string values for the class name parameters of the functions that dynamically load classes. The first step of our approach is to construct the assembly for iOS executables using existing tools. We then extract flow information from the assembly code and construct control flow graphs (CFGs) of functions. We identify functions that dynamically load classes, and for each parameter that corresponds to a dynamically loaded class, we construct a dependency graph that shows the set of values that flow to that parameter. Finally, we conduct string analysis on these dependency graphs to determine all potential string values that these parameters can take, which identifies the set of dynamically loaded classes. Taking the intersection of these values with patterns that characterize Apple`s app policies (such as private/sensitive APIs), we are able to detect potential policy violations. We analyzed more than 1300 popular apps from Apple`s AppStore and checked them against Apple`s policy about the use of private APIs and the identifier for Advertising (IDFA). Our tool extracted more than 37000 string dependency graphs from these applications and our analysis reported 208 apps that compose the corresponding API with strings and have potential IDFA violations. Our analysis also found 372 apps that could have compose the private class name with string and 236 apps that could have load the private framework with path string; and could violate the private API usage policy.
Reference:	[1] “Number of apps available in leading app stores as of july 2015,” http://www.statista. com/statistics/276623/number-of-apps-available-in-leading-app-stores, (Visited on 01/04/2016). [2] “G data mobile malware report threat report: Q3/2015,” https:// public.gdatasoftware.com/Presse/Publikationen/Malware Reports/G DATA MobileMWR Q3 2015 EN.pdf, (Visited on 01/04/2016). [3] “Mcafee labs threats report november 2015,” http://www.mcafee.com/us/resources/ reports/rp-quarterly-threats-nov-2015.pdf, (Visited on 01/04/2016). [4] “Path,” https://itunes.apple.com/us/app/path/id403639508?mt=8, (Visited on 01/04/2016). [5] “Path app under fire for unauthorized address book upload,” http://appleinsider. com/articles/12/02/07/path app under fire for unauthorized address book upload. html, (Visited on 01/04/2016). [6] “Mobilead2013,” http://www.emarketer.com/Article/ Driven-by-Facebook-Google-Mobile-Ad-Market-Soars-10537-2013/1010690, (Vis- ited on 01/04/2016). [7] “Gartner says mobile advertising spending will reach $18 billion in 2014,” http:// www.gartner.com/newsroom/id/2653121, (Visited on 01/04/2016). [8] J. Gui, S. Mcilroy, M. Nagappan, and W. G. J. Halfond, “Truth in advertising: The hidden cost of mobile ads for software developers,” in 37th IEEE/ACM International Conference on Software Engineering, ICSE 2015, Florence, Italy, May 16-24, 2015, Volume 1, 2015, pp. 100–110. [9] Z. Deng, B. Saltaformaggio, X. Zhang, and D. Xu, “iris: Vetting private api abuse in ios applications,” in Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security. ACM, 2015, pp. 44–56. [10] F. Yu, Y.-C. Lee, S. Tai, and W.-S. Tang, “Appbeach: Characterizing app behaviors via static binary analysis,” in Proceedings of the 2013 IEEE Second International Conference on Mobile Services. IEEE Computer Society, 2013, p. 86. [11] Z. R. Fang, S. W. Huang, and F. Yu, “Appreco: Behavior-aware recommendation for ios mobile applications,” in 2016 IEEE International Conference on Web Services (ICWS), June 2016, pp. 492–499. [12] W. Enck, P. Gilbert, S. Han, V. Tendulkar, B.-G. Chun, L. P. Cox, J. Jung, P. Mc- Daniel, and A. N. Sheth, “Taintdroid: an information-flow tracking system for real- time privacy monitoring on smartphones,” ACM Transactions on Computer Systems (TOCS), vol. 32, no. 2, p. 5, 2014. [13] J. Huang, X. Zhang, L. Tan, P. Wang, and B. Liang, “Asdroid: detecting stealthy behaviors in android applications by user interface and program behavior contradic- tion,” in 36th International Conference on Software Engineering, Hyderabad, India - May 31 - June 07, 2014, 2014, pp. 1036–1046. [14] S. Arzt, S. Rasthofer, C. Fritz, E. Bodden, A. Bartel, J. Klein, Y. L. Traon, D. Octeau, and P. McDaniel, “Flowdroid: precise context, flow, field, object-sensitive and lifecycle-aware taint analysis for android apps,” in ACM SIGPLAN Conference on Programming Language Design and Implementation, PLDI ’14, Edinburgh, United Kingdom - June 09 - 11, 2014, 2014, p. 29. [15] L. Li, T. F. Bissyand ́e, D. Octeau, and J. Klein, “Droidra: taming reflection to support whole-program analysis of android apps,” in Proceedings of the 25th Inter- national Symposium on Software Testing and Analysis. ACM, 2016, pp. 318–329. [16] P. d. B. SILVA FILHO, “Static analysis of implicit control flow: resolving java re- flection and android intents,” 2016. [17] DroidBench, “Droidbench benchmarks,” https://github.com/ secure-software-engineering/DroidBench. [18] A. P. Felt, M. Finifter, E. Chin, S. Hanna, and D. Wagner, “A survey of mobile malware in the wild,” in Proceedings of the 1st ACM Workshop on Security and Privacy in Smartphones and Mobile Devices, ser. SPSM ’11, 2011, pp. 3–14. [19] C. Mann and A. Starostin, “A framework for static detection of privacy leaks in android applications,” in Proceedings of the 27th Annual ACM Symposium on Applied Computing. ACM, 2012, pp. 1457–1462. [20] Y. Zhou, Z. Wang, W. Zhou, and X. Jiang, “Hey, you, get off of my market: Detecting malicious apps in official and alternative Android markets,” in Proceedings of the 19th Annual Network & Distributed System Security Symposium, ser. NDSS’12, 2012. [21] D. Babi ́c, D. Reynaud, and D. Song, “Malware analysis with tree automata in- ference,” in Proceedings of the 23rd International Conference on Computer Aided Verification, ser. CAV’11, 2011, pp. 116–131. [22] M. Egele, C. Kruegel, E. Kirda, and G. Vigna, “Pios: Detecting privacy leaks in ios applications.” in NDSS, 2011, pp. 177–183. [23] N. Nethercote and J. Seward, “Valgrind: a framework for heavyweight dynamic binary instrumentation,” in ACM Sigplan notices, vol. 42, no. 6. ACM, 2007, pp. 89–100. [24] T. Bao, J. Burket, M. Woo, R. Turner, and D. Brumley, “Byteweight: Learning to recognize functions in binary code,” in Proceedings of the 23rd USENIX Conference on Security Symposium, ser. SEC’14. USENIX Association, 2014, pp. 845–860. [25] X. Meng and B. P. Miller, “Binary code is not easy,” in Proceedings of the 25th International Symposium on Software Testing and Analysis, ser. ISSTA 2016. ACM, 2016, pp. 24–35. [26] T. Reinbacher and J. Brauer, “Precise control flow reconstruction using boolean logic,” in Proceedings of the Ninth ACM International Conference on Embedded Soft- ware, ser. EMSOFT ’11. ACM, 2011, pp. 117–126. [27] D. Brumley, I. Jager, T. Avgerinos, and E. J. Schwartz, “BAP: A binary analysis platform,” in Computer Aided Verification - 23rd International Conference, CAV 2011, Snowbird, UT, USA, July 14-20, 2011. Proceedings, 2011, pp. 463–469. [28] Hex-Rays, “IDAPro,” https://www.hex-rays.com/products/ida. [29] Dynist, “Dynist: Tools for binary instrumentation, analysis, and modification,” https://github.com/dyninst. [30] D. Song, D. Brumley, H. Yin, J. Caballero, I. Jager, M. G. Kang, Z. Liang, J. New- some, P. Poosankam, and P. Saxena, “Bitblaze: A new approach to computer security via binary analysis,” in Proceedings of the 4th International Conference on Informa- tion Systems Security, ser. ICISS ’08, 2008, pp. 1–25. [31] A. S. Christensen, A. Møller, and M. I. Schwartzbach, “Precise analysis of string expressions,” in Proc. 10th International Static Analysis Symposium (SAS), ser. LNCS, vol. 2694. Springer-Verlag, June 2003, pp. 1–18, available from http://www.brics.dk/JSA/. [32] C. Gould, Z. Su, and P. Devanbu, “Static checking of dynamically generated queries in database applications,” in Software Engineering, 2004. ICSE 2004. Proceedings. 26th International Conference on. IEEE, 2004, pp. 645–654. [33] Y. Minamide, “Static approximation of dynamically generated web pages,” in Pro- ceedings of the 14th international conference on World Wide Web. ACM, 2005, pp. 432–441. [34] G. Wassermann and Z. Su, “Sound and precise analysis of web applications for in- jection vulnerabilities,” in ACM Sigplan Notices, vol. 42, no. 6. ACM, 2007, pp. 32–41. [35] ——, “Static detection of cross-site scripting vulnerabilities,” in Proceedings of the 30th International Conference on Software Engineering, ser. ICSE ’08. New York, NY, USA: ACM, 2008, pp. 171–180. [Online]. Available: http://doi.acm.org/10.1145/1368088.1368112 [36] P. A. Abdulla, M. F. Atig, Y.-F. Chen, L. Hol ́ık, A. Rezine, P. Ru ̈mmer, and J. Sten- man, “String constraints for verification,” in International Conference on Computer Aided Verification. Springer, 2014, pp. 150–166. [37] T. Liang, A. Reynolds, C. Tinelli, C. Barrett, and M. Deters, “A dpll (t) theory solver for a theory of strings and regular expressions,” in International Conference on Computer Aided Verification. Springer, 2014, pp. 646–662. [38] Y. Zheng, X. Zhang, and V. Ganesh, “Z3-str: A z3-based string solver for web application analysis,” in Proceedings of the 2013 9th Joint Meeting on Foundations of Software Engineering. ACM, 2013, pp. 114–124. [39] A. Kiezun, V. Ganesh, P. J. Guo, P. Hooimeijer, and M. D. Ernst, “Hampi: a solver for string constraints,” in Proceedings of the eighteenth international symposium on Software testing and analysis. ACM, 2009, pp. 105–116. [40] G. Li and I. Ghosh, “Pass: String solving with parameterized array and interval automaton,” in Haifa Verification Conference. Springer, 2013, pp. 15–31. [41] F. Yu, M. Alkhalaf, T. Bultan, and O. H. Ibarra, “Automata-based symbolic string analysis for vulnerability detection,” Formal Methods in System Design, vol. 44, no. 1, pp. 44–70, 2014. [42] F. Yu, T. Bultan, and O. H. Ibarra, “Relational string verification using multi- track automata,” in International Conference on Implementation and Application of Automata. Springer, 2010, pp. 290–299. [43] F. Yu, M. Alkhalaf, and T. Bultan, “Stranger: An automata-based string analysis tool for php,” in International Conference on Tools and Algorithms for the Construc- tion and Analysis of Systems. Springer, 2010, pp. 154–157. [44] H.-E. Wang, T.-L. Tsai, C.-H. Lin, F. Yu, and J.-H. R. Jiang, String Analysis via Automata Manipulation with Logic Circuit Representation. Cham: Springer International Publishing, 2016, pp. 241–260. [Online]. Available: http://dx.doi.org/10.1007/978-3-319-41528-4 13 [45] F. Yu, M. Alkhalaf, and T. Bultan, “Patching vulnerabilities with sanitization synthesis,” in Proceedings of the 33rd International Conference on Software Engineering, ser. ICSE ’11. New York, NY, USA: ACM, 2011, pp. 251–260. [Online]. Available: http://doi.acm.org/10.1145/1985793.1985828 [46] F. Yu, C.-Y. Shueh, C.-H. Lin, Y.-F. Chen, B.-Y. Wang, and T. Bultan, “Optimal sanitization synthesis for web application vulnerability repair,” in Proceedings of the 25th International Symposium on Software Testing and Analysis, ser. ISSTA 2016. New York, NY, USA: ACM, 2016, pp. 189–200. [Online]. Available: http://doi.acm.org/10.1145/2931037.2931050 [47] “Ida: About - hex-rays,” http://www.hex-rays.com/products/ida, (Visited on 01/04/2016). [48] F. Yu, C.-Y. Shueh, C.-H. Lin, Y.-F. Chen, B.-Y. Wang, and T. Bultan, “Optimal sanitization synthesis for web application vulnerability repair,” in Proceedings of the 25th International Symposium on Software Testing and Analysis. ACM, 2016, pp. 189–200.
Description:	碩士國立政治大學資訊管理學系 104356016
Source URI:	http://thesis.lib.nccu.edu.tw/record/#G0104356016
Data Type:	thesis
Appears in Collections:	[Department of MIS] Theses

Files in This Item:

File	Size	Format
601601.pdf	1673Kb	Adobe PDF2	46	View/Open

All items in 政大典藏 are protected by copyright, with all rights reserved.

社群 sharing

著作權政策宣告 Copyright Announcement

1.本網站之數位內容為國立政治大學所收錄之機構典藏，無償提供學術研究與公眾教育等公益性使用，惟仍請適度，合理使用本網站之內容，以尊重著作權人之權益。商業上之利用，則請先取得著作權人之授權。
The digital content of this website is part of National Chengchi University Institutional Repository. It provides free access to academic research and public education for non-commercial use. Please utilize it in a proper and reasonable manner and respect the rights of copyright owners. For commercial use, please obtain authorization from the copyright owner in advance.

2.本網站之製作，已盡力防止侵害著作權人之權益，如仍發現本網站之數位內容有侵害著作權人權益情事者，請權利人通知本網站維護人員(nccur@nccu.edu.tw)，維護人員將立即採取移除該數位著作等補救措施。
NCCU Institutional Repository is made to protect the interests of copyright owners. If you believe that any material on the website infringes copyright, please contact our staff(nccur@nccu.edu.tw). We will remove the work from the repository and investigate your claim.

DSpace Software Copyright © 2002-2004 MIT & Hewlett-Packard / Enhanced by NTU Library IR team Copyright © - Feedback