Understanding JavaScript Vulnerabilities in Large Real-World Android Applications

作者：Song, Wei^*; Huang, Qingqing; Huang, Jeff

来源：IEEE Transactions on Dependable and Secure Computing, 2020, 17(5): 1063-1078.

DOI：10.1109/TDSC.2018.2845851

• Android apps
• JavaScript
• WebView
• security vulnerabilities
• empirical study

JavaScript-related vulnerabilities are becoming a major security threat to hybrid mobile applications. In this article, we present a systematic study to understand how JavaScript is used in real-world Android apps and how it may lead to security vulnerabilities. We begin by conducting an empirical study on the top-100 most popular Android apps to investigate JavaScript usage and its related security vulnerabilities. Our study identifies four categories of JavaScript usage and finds that three of these categories, if inappropriately used, can respectively lead to three types of vulnerabilities. We also design and implement an automatic tool named JSDroid to detect JavaScript-related vulnerabilities. We have applied JSDroid to 1,000 large real-world Android apps and found that over 70 percent of these apps have potential JavaScript-related vulnerabilities and 20 percent of them can be successfully exploited. Moreover, based on the vulnerabilities identified by JSDroid, we have successfully launched real attacks on 30 real- world apps.

• 出版日期2020-9
• 单位南京理工大学