English (United Kingdom)

https://curated-unify.zendy.io/wp-json/zendy-region/v1/featured_content/oa?rat=en

https://curated-unify.zendy.io/wp-json/zendy-region/v1/highlighted_journal/

Global: Zendy Plus annual

Presents the access of premium content as premium feature

Premium Content

Presents the keyphrase highlighting as premium feature

Keyphrase Highlighting

Presents the summarisation as premium feature

Summarisation

Insights

Presents the pdf analysis as premium feature

PDF Analysis

Presents the zaia usage as premium feature

ZAIA

Global: Zendy Plus monthly

Global: Zendy Tools annual

Global: Zendy Tools monthly

Global: Zendy Free Plan

Android apps could expose their components for cooperating with other apps.This convenience, however, makes apps susceptible to the exposed componentvulnerability (ECV), in which a dangerous API (commonly known as sink) insideits component can be triggered by other (malicious) apps. In the prior works,detecting these ECVs use a set of sinks pertaining to the ECVs under detection.In this paper, we argue that a more comprehensive and effective approach shouldstart by a systematic selection and classification of vulnerability-specificsinks (VSinks). The set of VSinks is much larger than those used in theprevious works. Based on these VSinks, our sink-driven approach can detectdifferent kinds of ECVs in an app in two steps. First, VSinks and theircategories are identified through a typical forward reachability analysis.Second, based on each VSink's category, a corresponding detection method isused to identify the ECV via a customized backward dataflow analysis. We alsodesign a semi-auto guided analysis and validation capability for system-onlybroadcast checking to remove some false positives. We implement our sink-drivenapproach in a tool called ECVDetector and evaluate it with the top 1K Androidapps. Using ECVDetector we successfully identify a total of 49 vulnerable appsacross all four ECV categories we have defined. To our knowledge, most of themare previously undisclosed, such as the very popular Go SMS Pro and CleanMaster. Moreover, the performance of ECVDetector is high, requiring only 9.257seconds on average to process each component.

A Sink-driven Approach to Detecting Exposed Component Vulnerabilities in Android Apps