Premium
All about activity injection: Threats, semantics, detection, and defense
Author(s) -
Hwang Sungjae,
Lee Sungho,
Ryu Sukyoung
Publication year - 2020
Publication title -
software: practice and experience
Language(s) - English
Resource type - Journals
SCImago Journal Rank - 0.437
H-Index - 70
eISSN - 1097-024X
pISSN - 0038-0644
DOI - 10.1002/spe.2792
Subject(s) - android (operating system) , computer science , android malware , malware , human multitasking , computer security , operating system , psychology , cognitive psychology
Summary Android supports seamless user experience by maintaining activities from different applications (apps) in the same activity stack. Although such close inter‐app communication is essential in the Android framework, the powerful inter‐app communication contains vulnerabilities that can inject malicious activities into a victim app's activity stack to hijack user interaction flows. In this article, we demonstrate activity injection attacks with a simple malware, and formally specify the activity activation mechanism using operational semantics. Based on the operational semantics, we develop a static analysis tool, which analyzes Android apps to detect activity injection attacks. Our tool is fast enough to analyze real‐world Android apps in 6 seconds on average, and our experiments found that 1761 apps out of 129,756 real‐world Android apps inject their activities into other apps' tasks. Moreover, we propose a defense mechanism, dubbed signature‐based activity access control (SAAC), which completely prohibits activity injection attacks. The defense mechanism is general enough to keep the current Android multitasking features intact, and it is simple enough to be independent of the complex activity activation semantics, which does not increase activity activation time noticeably. With the extension of the formal semantics for SAAC, we prove that SAAC correctly mitigates activity injection attacks without any false alarms.