English (United Kingdom)

https://curated-unify.zendy.io/wp-json/zendy-region/v1/featured_content/oa?rat=en

https://curated-unify.zendy.io/wp-json/zendy-region/v1/highlighted_journal/

Global: Zendy Plus annual

Presents the access of premium content as premium feature

Premium Content

Presents the keyphrase highlighting as premium feature

Keyphrase Highlighting

Presents the summarisation as premium feature

Summarisation

Insights

Presents the pdf analysis as premium feature

PDF Analysis

Presents the zaia usage as premium feature

ZAIA

Global: Zendy Plus monthly

Global: Zendy Tools annual

Global: Zendy Tools monthly

Global: Zendy Free Plan

Limited by the small keyboard, most mobile apps support the automatic loginfeature for better user experience. Therefore, users avoid the inconvenience ofretyping their ID and password when an app runs in the foreground again.However, this auto-login function can be exploited to launch the so-called"data-clone attack": once the locally-stored, auto-login depended data arecloned by attackers and placed into their own smartphones, attackers can breakthrough the login-device number limit and log in to the victim's accountstealthily. A natural countermeasure is to check the consistency ofdevicespecific attributes. As long as the new device shows different devicefingerprints with the previous one, the app will disable the auto-loginfunction and thus prevent data-clone attacks. In this paper, we developVPDroid, a transparent Android OS-level virtualization platform tailored forsecurity testing. With VPDroid, security analysts can customize differentdevice artifacts, such as CPU model, Android ID, and phone number, in a virtualphone without user-level API hooking. VPDroid's isolation mechanism ensuresthat user-mode apps in the virtual phone cannot detect device-specificdiscrepancies. To assess Android apps' susceptibility to the data-clone attack,we use VPDroid to simulate data-clone attacks with 234 most-downloaded apps.Our experiments on five different virtual phone environments show thatVPDroid's device attribute customization can deceive all tested apps thatperform device-consistency checks, such as Twitter, WeChat, and PayPal. 19vendors have confirmed our report as a zero-day vulnerability. Our findingspaint a cautionary tale: only enforcing a device-consistency check at clientside is still vulnerable to an advanced data-clone attack.

App's Auto-Login Function Security Testing via Android OS-Level Virtualization