Visible to the public Analysis of Android Inter-App Security Vulnerabilities Using COVERTConflict Detection Enabled

TitleAnalysis of Android Inter-App Security Vulnerabilities Using COVERT
Publication TypeConference Proceedings
Year of Publication2015
AuthorsAlireza Sadeghi, Hamid Bagheri, Sam Malek
Conference NameICSE '15 Proceedings of the 37th International Conference on Software Engineering
Series TitleTool Demo Track
Date Published05-16/2015
PublisherIEEE Press Piscataway, NJ, USA ©2015
Conference LocationFlorence, Italy
KeywordsApr'15, CMU

The state-of-the-art in securing mobile software systems are substantially intended to detect and mitigate vulnerabilities in a single app, but fail to identify vulnerabilities that arise due to the interaction of multiple apps, such as collusion attacks and privilege escalation chaining, shown to be quite common in the apps on the market. This paper demonstrates COVERT, a novel approach and accompanying tool-suite that relies on a hybrid static analysis and lightweight formal analysis technique to enable compositional security assessment of complex software. Through static analysis of Android application packages, it extracts relevant security specifications in an analyzable formal specification language, and checks them as a whole for inter-app vulnerabilities. To our knowledge, COVERT is the first formally-precise analysis tool for automated compositional analysis of Android apps. Our study of hundreds of Android apps revealed dozens of inter-app vulnerabilities, many of which were previously unknown. A video highlighting the main features of the tool can be found at:

Citation Keynode-25001