On the Static Analysis of Hybrid Mobile Apps A Report on the State of Apache Cordova Nation Achim D. Brucker and Michael Herzberg {a.brucker,msherzberg1}@sheffield.ac.uk Department of Computer Science, The University of Sheffield, Sheffield, UK (Parts of this research were done while the authors were working at SAP SE in Germany.) International Symposium on Engineering Secure Software and Systems (ESSoS 2016) April 6 - 8, 2016, London, UK
44
Embed
On the Static Analysis of Hybrid Mobile Apps - A Report on ... · On the Static Analysis of Hybrid Mobile Apps ... Apache Cordova is a popular framework for developing multi-platform
This document is posted to help you gain knowledge. Please leave a comment to let me know what you think about it! Share it to your friends and learn new things together.
Transcript
On the Static Analysis of Hybrid Mobile AppsA Report on the State of Apache Cordova Nation
Achim D Brucker and Michael Herzbergabruckermsherzberg1sheffieldacuk
Department of Computer Science The University of Sheffield Sheffield UK(Parts of this research were done while the authors were working at SAP SE in Germany)
International Symposium on Engineering Secure Software and Systems (ESSoS 2016)April 6 - 8 2016 London UK
On the Static Analysis of Hybrid Mobile Apps A Report on the State of Apache Cordova Nation
Abstract
Developing mobile applications is a challenging business developers need to support multiple platforms andat the same time need to cope with limited resources as the revenue generated by an average app is rathersmall This results in an increasing use of cross-platform development frameworks that allow developing anapp once and offering it on multiple mobile platforms such as Android iOS or WindowsApache Cordova is a popular framework for developing multi-platform apps Cordova combines HTML5 andJavaScript with native application code Combining web and native technologies creates new securitychallenges as eg an XSS attacker becomes more powerfulIn this paper we present a novel approach for statically analysing the foreign language calls We evaluate ourapproach by analysing the top Cordova apps from Google Play Moreover we report on the current state of theoverall quality and security of Cordova appsKeywords static program analysis static application security testing Android Cordova hybrid mobile apps
Outline
1 Motivation Hybrid Mobile Apps and their Security Challenges
2 Real World Cordova Usage
3 Static Analysis for Hybrid Apps Building a Unified Call Graph
4 Quality of the Unified Call Graph
5 Conclusions
Motivation Hybrid Mobile Apps and their Security Challenges
What is a Hybrid AppNative HTML5 or hybrid
Native appsJava Swift C
Developed for a specificplatform
All features available
+
Hybrid appsHTML5 JS and native
Build once run everywhere
Access to device featuresthrough plugins
Web appsHTML5 and JS
Hosted on server allplatforms
No access to devicefeatures
Platform-specific Platform-independent
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 4
Motivation Hybrid Mobile Apps and their Security Challenges
What is a Hybrid AppNative HTML5 or hybrid
Native appsJava Swift C
Developed for a specificplatform
All features available
+
Hybrid appsHTML5 JS and native
Build once run everywhere
Access to device featuresthrough plugins
Web appsHTML5 and JS
Hosted on server allplatforms
No access to devicefeatures
Platform-specific Platform-independent
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 4
Motivation Hybrid Mobile Apps and their Security Challenges
Why Apache Cordova
httpscordovaapacheorg
Apache Cordova is most popular hybrid app framework
Open source
Many companies offer Apache Cordova plus commercial plugins (eg Adobe PhoneGap orSAP Kapsel)
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 5
Motivation Hybrid Mobile Apps and their Security Challenges
The Apache Cordova Framework for Android
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 6
Motivation Hybrid Mobile Apps and their Security Challenges
Example app
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 7
Motivation Hybrid Mobile Apps and their Security Challenges
Technical view
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 8
Motivation Hybrid Mobile Apps and their Security Challenges
Technical view
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 8
Motivation Hybrid Mobile Apps and their Security Challenges
Example Get Phone Number
function showPhoneNumber(name) var successCallback = function(contact)
if (findequals(action)) String name = argsget(0)namefind(name callbackContext)
else if (createequals(action)) void find(String name CallbackContext callbackContext)
Contact contact = query(SELECT where name= + name)callbackContextsuccess(contact)
Problem
How to determine the targets of the callbackContext calls
Can we use the pattern of the action usage
Solution
Determine which callbackContext calls are reachableAD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 23
Static Analysis for Hybrid Apps Building a Unified Call Graph
FilterJavaCallSites details
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 24
Static Analysis for Hybrid Apps Building a Unified Call Graph
FilterJavaCallSites details
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 24
Static Analysis for Hybrid Apps Building a Unified Call Graph
FilterJavaCallSites details
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 24
Static Analysis for Hybrid Apps Building a Unified Call Graph
FilterJavaCallSites results
Developers all use action variable similarly
Therefore Many incorrect edges avoided
But A few calls from Java to JavaScript are missed now
Some store the callbackContext and call asynchronously
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 25
Outline
1 Motivation Hybrid Mobile Apps and their Security Challenges
2 Real World Cordova Usage
3 Static Analysis for Hybrid Apps Building a Unified Call Graph
4 Quality of the Unified Call Graph
5 Conclusions
Quality of the Unified Call Graph
What we have learned app size and cross-language calls
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 28
Outline
1 Motivation Hybrid Mobile Apps and their Security Challenges
2 Real World Cordova Usage
3 Static Analysis for Hybrid Apps Building a Unified Call Graph
4 Quality of the Unified Call Graph
5 Conclusions
Conclusions
Summary
Hybrid mobile apps are getting more popular
they are recommended at SAP
Hybrid mobile apps are juicy targets
Eg gain access to the app via the JS part and use the apprsquos permissions to steal data
Unified Call Graph is a first step in bringing the full power of SAST to hybrid apps
Quality largely depends on used call graph builders
Future work Data-flow analysis on top of Unified Call Graph
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 30
Thank you for your attentionAny questions or remarks
Conclusions
Bibliography
Achim D Brucker and Michael Herzberg
On the static analysis of hybrid mobile apps A report on the state of apache cordova nation
In Juan Caballero and Eric Bodden editors International Symposium on Engineering Secure Software and Systems(ESSoS) Lecture Notes in Computer Science Springer-Verlag 2016
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 32
Motivation Hybrid Mobile Apps and their Security Challenges
Real World Cordova Usage
Static Analysis for Hybrid Apps Building a Unified Call Graph
Quality of the Unified Call Graph
Conclusions
On the Static Analysis of Hybrid Mobile Apps A Report on the State of Apache Cordova Nation
Abstract
Developing mobile applications is a challenging business developers need to support multiple platforms andat the same time need to cope with limited resources as the revenue generated by an average app is rathersmall This results in an increasing use of cross-platform development frameworks that allow developing anapp once and offering it on multiple mobile platforms such as Android iOS or WindowsApache Cordova is a popular framework for developing multi-platform apps Cordova combines HTML5 andJavaScript with native application code Combining web and native technologies creates new securitychallenges as eg an XSS attacker becomes more powerfulIn this paper we present a novel approach for statically analysing the foreign language calls We evaluate ourapproach by analysing the top Cordova apps from Google Play Moreover we report on the current state of theoverall quality and security of Cordova appsKeywords static program analysis static application security testing Android Cordova hybrid mobile apps
Outline
1 Motivation Hybrid Mobile Apps and their Security Challenges
2 Real World Cordova Usage
3 Static Analysis for Hybrid Apps Building a Unified Call Graph
4 Quality of the Unified Call Graph
5 Conclusions
Motivation Hybrid Mobile Apps and their Security Challenges
What is a Hybrid AppNative HTML5 or hybrid
Native appsJava Swift C
Developed for a specificplatform
All features available
+
Hybrid appsHTML5 JS and native
Build once run everywhere
Access to device featuresthrough plugins
Web appsHTML5 and JS
Hosted on server allplatforms
No access to devicefeatures
Platform-specific Platform-independent
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 4
Motivation Hybrid Mobile Apps and their Security Challenges
What is a Hybrid AppNative HTML5 or hybrid
Native appsJava Swift C
Developed for a specificplatform
All features available
+
Hybrid appsHTML5 JS and native
Build once run everywhere
Access to device featuresthrough plugins
Web appsHTML5 and JS
Hosted on server allplatforms
No access to devicefeatures
Platform-specific Platform-independent
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 4
Motivation Hybrid Mobile Apps and their Security Challenges
Why Apache Cordova
httpscordovaapacheorg
Apache Cordova is most popular hybrid app framework
Open source
Many companies offer Apache Cordova plus commercial plugins (eg Adobe PhoneGap orSAP Kapsel)
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 5
Motivation Hybrid Mobile Apps and their Security Challenges
The Apache Cordova Framework for Android
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 6
Motivation Hybrid Mobile Apps and their Security Challenges
Example app
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 7
Motivation Hybrid Mobile Apps and their Security Challenges
Technical view
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 8
Motivation Hybrid Mobile Apps and their Security Challenges
Technical view
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 8
Motivation Hybrid Mobile Apps and their Security Challenges
Example Get Phone Number
function showPhoneNumber(name) var successCallback = function(contact)
if (findequals(action)) String name = argsget(0)namefind(name callbackContext)
else if (createequals(action)) void find(String name CallbackContext callbackContext)
Contact contact = query(SELECT where name= + name)callbackContextsuccess(contact)
Problem
How to determine the targets of the callbackContext calls
Can we use the pattern of the action usage
Solution
Determine which callbackContext calls are reachableAD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 23
Static Analysis for Hybrid Apps Building a Unified Call Graph
FilterJavaCallSites details
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 24
Static Analysis for Hybrid Apps Building a Unified Call Graph
FilterJavaCallSites details
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 24
Static Analysis for Hybrid Apps Building a Unified Call Graph
FilterJavaCallSites details
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 24
Static Analysis for Hybrid Apps Building a Unified Call Graph
FilterJavaCallSites results
Developers all use action variable similarly
Therefore Many incorrect edges avoided
But A few calls from Java to JavaScript are missed now
Some store the callbackContext and call asynchronously
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 25
Outline
1 Motivation Hybrid Mobile Apps and their Security Challenges
2 Real World Cordova Usage
3 Static Analysis for Hybrid Apps Building a Unified Call Graph
4 Quality of the Unified Call Graph
5 Conclusions
Quality of the Unified Call Graph
What we have learned app size and cross-language calls
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 28
Outline
1 Motivation Hybrid Mobile Apps and their Security Challenges
2 Real World Cordova Usage
3 Static Analysis for Hybrid Apps Building a Unified Call Graph
4 Quality of the Unified Call Graph
5 Conclusions
Conclusions
Summary
Hybrid mobile apps are getting more popular
they are recommended at SAP
Hybrid mobile apps are juicy targets
Eg gain access to the app via the JS part and use the apprsquos permissions to steal data
Unified Call Graph is a first step in bringing the full power of SAST to hybrid apps
Quality largely depends on used call graph builders
Future work Data-flow analysis on top of Unified Call Graph
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 30
Thank you for your attentionAny questions or remarks
Conclusions
Bibliography
Achim D Brucker and Michael Herzberg
On the static analysis of hybrid mobile apps A report on the state of apache cordova nation
In Juan Caballero and Eric Bodden editors International Symposium on Engineering Secure Software and Systems(ESSoS) Lecture Notes in Computer Science Springer-Verlag 2016
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 32
Motivation Hybrid Mobile Apps and their Security Challenges
Real World Cordova Usage
Static Analysis for Hybrid Apps Building a Unified Call Graph
Quality of the Unified Call Graph
Conclusions
Outline
1 Motivation Hybrid Mobile Apps and their Security Challenges
2 Real World Cordova Usage
3 Static Analysis for Hybrid Apps Building a Unified Call Graph
4 Quality of the Unified Call Graph
5 Conclusions
Motivation Hybrid Mobile Apps and their Security Challenges
What is a Hybrid AppNative HTML5 or hybrid
Native appsJava Swift C
Developed for a specificplatform
All features available
+
Hybrid appsHTML5 JS and native
Build once run everywhere
Access to device featuresthrough plugins
Web appsHTML5 and JS
Hosted on server allplatforms
No access to devicefeatures
Platform-specific Platform-independent
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 4
Motivation Hybrid Mobile Apps and their Security Challenges
What is a Hybrid AppNative HTML5 or hybrid
Native appsJava Swift C
Developed for a specificplatform
All features available
+
Hybrid appsHTML5 JS and native
Build once run everywhere
Access to device featuresthrough plugins
Web appsHTML5 and JS
Hosted on server allplatforms
No access to devicefeatures
Platform-specific Platform-independent
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 4
Motivation Hybrid Mobile Apps and their Security Challenges
Why Apache Cordova
httpscordovaapacheorg
Apache Cordova is most popular hybrid app framework
Open source
Many companies offer Apache Cordova plus commercial plugins (eg Adobe PhoneGap orSAP Kapsel)
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 5
Motivation Hybrid Mobile Apps and their Security Challenges
The Apache Cordova Framework for Android
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 6
Motivation Hybrid Mobile Apps and their Security Challenges
Example app
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 7
Motivation Hybrid Mobile Apps and their Security Challenges
Technical view
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 8
Motivation Hybrid Mobile Apps and their Security Challenges
Technical view
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 8
Motivation Hybrid Mobile Apps and their Security Challenges
Example Get Phone Number
function showPhoneNumber(name) var successCallback = function(contact)
if (findequals(action)) String name = argsget(0)namefind(name callbackContext)
else if (createequals(action)) void find(String name CallbackContext callbackContext)
Contact contact = query(SELECT where name= + name)callbackContextsuccess(contact)
Problem
How to determine the targets of the callbackContext calls
Can we use the pattern of the action usage
Solution
Determine which callbackContext calls are reachableAD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 23
Static Analysis for Hybrid Apps Building a Unified Call Graph
FilterJavaCallSites details
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 24
Static Analysis for Hybrid Apps Building a Unified Call Graph
FilterJavaCallSites details
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 24
Static Analysis for Hybrid Apps Building a Unified Call Graph
FilterJavaCallSites details
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 24
Static Analysis for Hybrid Apps Building a Unified Call Graph
FilterJavaCallSites results
Developers all use action variable similarly
Therefore Many incorrect edges avoided
But A few calls from Java to JavaScript are missed now
Some store the callbackContext and call asynchronously
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 25
Outline
1 Motivation Hybrid Mobile Apps and their Security Challenges
2 Real World Cordova Usage
3 Static Analysis for Hybrid Apps Building a Unified Call Graph
4 Quality of the Unified Call Graph
5 Conclusions
Quality of the Unified Call Graph
What we have learned app size and cross-language calls
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 28
Outline
1 Motivation Hybrid Mobile Apps and their Security Challenges
2 Real World Cordova Usage
3 Static Analysis for Hybrid Apps Building a Unified Call Graph
4 Quality of the Unified Call Graph
5 Conclusions
Conclusions
Summary
Hybrid mobile apps are getting more popular
they are recommended at SAP
Hybrid mobile apps are juicy targets
Eg gain access to the app via the JS part and use the apprsquos permissions to steal data
Unified Call Graph is a first step in bringing the full power of SAST to hybrid apps
Quality largely depends on used call graph builders
Future work Data-flow analysis on top of Unified Call Graph
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 30
Thank you for your attentionAny questions or remarks
Conclusions
Bibliography
Achim D Brucker and Michael Herzberg
On the static analysis of hybrid mobile apps A report on the state of apache cordova nation
In Juan Caballero and Eric Bodden editors International Symposium on Engineering Secure Software and Systems(ESSoS) Lecture Notes in Computer Science Springer-Verlag 2016
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 32
Motivation Hybrid Mobile Apps and their Security Challenges
Real World Cordova Usage
Static Analysis for Hybrid Apps Building a Unified Call Graph
Quality of the Unified Call Graph
Conclusions
Motivation Hybrid Mobile Apps and their Security Challenges
What is a Hybrid AppNative HTML5 or hybrid
Native appsJava Swift C
Developed for a specificplatform
All features available
+
Hybrid appsHTML5 JS and native
Build once run everywhere
Access to device featuresthrough plugins
Web appsHTML5 and JS
Hosted on server allplatforms
No access to devicefeatures
Platform-specific Platform-independent
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 4
Motivation Hybrid Mobile Apps and their Security Challenges
What is a Hybrid AppNative HTML5 or hybrid
Native appsJava Swift C
Developed for a specificplatform
All features available
+
Hybrid appsHTML5 JS and native
Build once run everywhere
Access to device featuresthrough plugins
Web appsHTML5 and JS
Hosted on server allplatforms
No access to devicefeatures
Platform-specific Platform-independent
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 4
Motivation Hybrid Mobile Apps and their Security Challenges
Why Apache Cordova
httpscordovaapacheorg
Apache Cordova is most popular hybrid app framework
Open source
Many companies offer Apache Cordova plus commercial plugins (eg Adobe PhoneGap orSAP Kapsel)
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 5
Motivation Hybrid Mobile Apps and their Security Challenges
The Apache Cordova Framework for Android
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 6
Motivation Hybrid Mobile Apps and their Security Challenges
Example app
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 7
Motivation Hybrid Mobile Apps and their Security Challenges
Technical view
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 8
Motivation Hybrid Mobile Apps and their Security Challenges
Technical view
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 8
Motivation Hybrid Mobile Apps and their Security Challenges
Example Get Phone Number
function showPhoneNumber(name) var successCallback = function(contact)
if (findequals(action)) String name = argsget(0)namefind(name callbackContext)
else if (createequals(action)) void find(String name CallbackContext callbackContext)
Contact contact = query(SELECT where name= + name)callbackContextsuccess(contact)
Problem
How to determine the targets of the callbackContext calls
Can we use the pattern of the action usage
Solution
Determine which callbackContext calls are reachableAD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 23
Static Analysis for Hybrid Apps Building a Unified Call Graph
FilterJavaCallSites details
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 24
Static Analysis for Hybrid Apps Building a Unified Call Graph
FilterJavaCallSites details
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 24
Static Analysis for Hybrid Apps Building a Unified Call Graph
FilterJavaCallSites details
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 24
Static Analysis for Hybrid Apps Building a Unified Call Graph
FilterJavaCallSites results
Developers all use action variable similarly
Therefore Many incorrect edges avoided
But A few calls from Java to JavaScript are missed now
Some store the callbackContext and call asynchronously
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 25
Outline
1 Motivation Hybrid Mobile Apps and their Security Challenges
2 Real World Cordova Usage
3 Static Analysis for Hybrid Apps Building a Unified Call Graph
4 Quality of the Unified Call Graph
5 Conclusions
Quality of the Unified Call Graph
What we have learned app size and cross-language calls
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 28
Outline
1 Motivation Hybrid Mobile Apps and their Security Challenges
2 Real World Cordova Usage
3 Static Analysis for Hybrid Apps Building a Unified Call Graph
4 Quality of the Unified Call Graph
5 Conclusions
Conclusions
Summary
Hybrid mobile apps are getting more popular
they are recommended at SAP
Hybrid mobile apps are juicy targets
Eg gain access to the app via the JS part and use the apprsquos permissions to steal data
Unified Call Graph is a first step in bringing the full power of SAST to hybrid apps
Quality largely depends on used call graph builders
Future work Data-flow analysis on top of Unified Call Graph
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 30
Thank you for your attentionAny questions or remarks
Conclusions
Bibliography
Achim D Brucker and Michael Herzberg
On the static analysis of hybrid mobile apps A report on the state of apache cordova nation
In Juan Caballero and Eric Bodden editors International Symposium on Engineering Secure Software and Systems(ESSoS) Lecture Notes in Computer Science Springer-Verlag 2016
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 32
Motivation Hybrid Mobile Apps and their Security Challenges
Real World Cordova Usage
Static Analysis for Hybrid Apps Building a Unified Call Graph
Quality of the Unified Call Graph
Conclusions
Motivation Hybrid Mobile Apps and their Security Challenges
What is a Hybrid AppNative HTML5 or hybrid
Native appsJava Swift C
Developed for a specificplatform
All features available
+
Hybrid appsHTML5 JS and native
Build once run everywhere
Access to device featuresthrough plugins
Web appsHTML5 and JS
Hosted on server allplatforms
No access to devicefeatures
Platform-specific Platform-independent
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 4
Motivation Hybrid Mobile Apps and their Security Challenges
Why Apache Cordova
httpscordovaapacheorg
Apache Cordova is most popular hybrid app framework
Open source
Many companies offer Apache Cordova plus commercial plugins (eg Adobe PhoneGap orSAP Kapsel)
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 5
Motivation Hybrid Mobile Apps and their Security Challenges
The Apache Cordova Framework for Android
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 6
Motivation Hybrid Mobile Apps and their Security Challenges
Example app
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 7
Motivation Hybrid Mobile Apps and their Security Challenges
Technical view
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 8
Motivation Hybrid Mobile Apps and their Security Challenges
Technical view
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 8
Motivation Hybrid Mobile Apps and their Security Challenges
Example Get Phone Number
function showPhoneNumber(name) var successCallback = function(contact)
if (findequals(action)) String name = argsget(0)namefind(name callbackContext)
else if (createequals(action)) void find(String name CallbackContext callbackContext)
Contact contact = query(SELECT where name= + name)callbackContextsuccess(contact)
Problem
How to determine the targets of the callbackContext calls
Can we use the pattern of the action usage
Solution
Determine which callbackContext calls are reachableAD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 23
Static Analysis for Hybrid Apps Building a Unified Call Graph
FilterJavaCallSites details
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 24
Static Analysis for Hybrid Apps Building a Unified Call Graph
FilterJavaCallSites details
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 24
Static Analysis for Hybrid Apps Building a Unified Call Graph
FilterJavaCallSites details
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 24
Static Analysis for Hybrid Apps Building a Unified Call Graph
FilterJavaCallSites results
Developers all use action variable similarly
Therefore Many incorrect edges avoided
But A few calls from Java to JavaScript are missed now
Some store the callbackContext and call asynchronously
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 25
Outline
1 Motivation Hybrid Mobile Apps and their Security Challenges
2 Real World Cordova Usage
3 Static Analysis for Hybrid Apps Building a Unified Call Graph
4 Quality of the Unified Call Graph
5 Conclusions
Quality of the Unified Call Graph
What we have learned app size and cross-language calls
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 28
Outline
1 Motivation Hybrid Mobile Apps and their Security Challenges
2 Real World Cordova Usage
3 Static Analysis for Hybrid Apps Building a Unified Call Graph
4 Quality of the Unified Call Graph
5 Conclusions
Conclusions
Summary
Hybrid mobile apps are getting more popular
they are recommended at SAP
Hybrid mobile apps are juicy targets
Eg gain access to the app via the JS part and use the apprsquos permissions to steal data
Unified Call Graph is a first step in bringing the full power of SAST to hybrid apps
Quality largely depends on used call graph builders
Future work Data-flow analysis on top of Unified Call Graph
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 30
Thank you for your attentionAny questions or remarks
Conclusions
Bibliography
Achim D Brucker and Michael Herzberg
On the static analysis of hybrid mobile apps A report on the state of apache cordova nation
In Juan Caballero and Eric Bodden editors International Symposium on Engineering Secure Software and Systems(ESSoS) Lecture Notes in Computer Science Springer-Verlag 2016
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 32
Motivation Hybrid Mobile Apps and their Security Challenges
Real World Cordova Usage
Static Analysis for Hybrid Apps Building a Unified Call Graph
Quality of the Unified Call Graph
Conclusions
Motivation Hybrid Mobile Apps and their Security Challenges
Why Apache Cordova
httpscordovaapacheorg
Apache Cordova is most popular hybrid app framework
Open source
Many companies offer Apache Cordova plus commercial plugins (eg Adobe PhoneGap orSAP Kapsel)
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 5
Motivation Hybrid Mobile Apps and their Security Challenges
The Apache Cordova Framework for Android
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 6
Motivation Hybrid Mobile Apps and their Security Challenges
Example app
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 7
Motivation Hybrid Mobile Apps and their Security Challenges
Technical view
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 8
Motivation Hybrid Mobile Apps and their Security Challenges
Technical view
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 8
Motivation Hybrid Mobile Apps and their Security Challenges
Example Get Phone Number
function showPhoneNumber(name) var successCallback = function(contact)
if (findequals(action)) String name = argsget(0)namefind(name callbackContext)
else if (createequals(action)) void find(String name CallbackContext callbackContext)
Contact contact = query(SELECT where name= + name)callbackContextsuccess(contact)
Problem
How to determine the targets of the callbackContext calls
Can we use the pattern of the action usage
Solution
Determine which callbackContext calls are reachableAD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 23
Static Analysis for Hybrid Apps Building a Unified Call Graph
FilterJavaCallSites details
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 24
Static Analysis for Hybrid Apps Building a Unified Call Graph
FilterJavaCallSites details
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 24
Static Analysis for Hybrid Apps Building a Unified Call Graph
FilterJavaCallSites details
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 24
Static Analysis for Hybrid Apps Building a Unified Call Graph
FilterJavaCallSites results
Developers all use action variable similarly
Therefore Many incorrect edges avoided
But A few calls from Java to JavaScript are missed now
Some store the callbackContext and call asynchronously
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 25
Outline
1 Motivation Hybrid Mobile Apps and their Security Challenges
2 Real World Cordova Usage
3 Static Analysis for Hybrid Apps Building a Unified Call Graph
4 Quality of the Unified Call Graph
5 Conclusions
Quality of the Unified Call Graph
What we have learned app size and cross-language calls
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 28
Outline
1 Motivation Hybrid Mobile Apps and their Security Challenges
2 Real World Cordova Usage
3 Static Analysis for Hybrid Apps Building a Unified Call Graph
4 Quality of the Unified Call Graph
5 Conclusions
Conclusions
Summary
Hybrid mobile apps are getting more popular
they are recommended at SAP
Hybrid mobile apps are juicy targets
Eg gain access to the app via the JS part and use the apprsquos permissions to steal data
Unified Call Graph is a first step in bringing the full power of SAST to hybrid apps
Quality largely depends on used call graph builders
Future work Data-flow analysis on top of Unified Call Graph
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 30
Thank you for your attentionAny questions or remarks
Conclusions
Bibliography
Achim D Brucker and Michael Herzberg
On the static analysis of hybrid mobile apps A report on the state of apache cordova nation
In Juan Caballero and Eric Bodden editors International Symposium on Engineering Secure Software and Systems(ESSoS) Lecture Notes in Computer Science Springer-Verlag 2016
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 32
Motivation Hybrid Mobile Apps and their Security Challenges
Real World Cordova Usage
Static Analysis for Hybrid Apps Building a Unified Call Graph
Quality of the Unified Call Graph
Conclusions
Motivation Hybrid Mobile Apps and their Security Challenges
The Apache Cordova Framework for Android
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 6
Motivation Hybrid Mobile Apps and their Security Challenges
Example app
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 7
Motivation Hybrid Mobile Apps and their Security Challenges
Technical view
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 8
Motivation Hybrid Mobile Apps and their Security Challenges
Technical view
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 8
Motivation Hybrid Mobile Apps and their Security Challenges
Example Get Phone Number
function showPhoneNumber(name) var successCallback = function(contact)
if (findequals(action)) String name = argsget(0)namefind(name callbackContext)
else if (createequals(action)) void find(String name CallbackContext callbackContext)
Contact contact = query(SELECT where name= + name)callbackContextsuccess(contact)
Problem
How to determine the targets of the callbackContext calls
Can we use the pattern of the action usage
Solution
Determine which callbackContext calls are reachableAD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 23
Static Analysis for Hybrid Apps Building a Unified Call Graph
FilterJavaCallSites details
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 24
Static Analysis for Hybrid Apps Building a Unified Call Graph
FilterJavaCallSites details
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 24
Static Analysis for Hybrid Apps Building a Unified Call Graph
FilterJavaCallSites details
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 24
Static Analysis for Hybrid Apps Building a Unified Call Graph
FilterJavaCallSites results
Developers all use action variable similarly
Therefore Many incorrect edges avoided
But A few calls from Java to JavaScript are missed now
Some store the callbackContext and call asynchronously
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 25
Outline
1 Motivation Hybrid Mobile Apps and their Security Challenges
2 Real World Cordova Usage
3 Static Analysis for Hybrid Apps Building a Unified Call Graph
4 Quality of the Unified Call Graph
5 Conclusions
Quality of the Unified Call Graph
What we have learned app size and cross-language calls
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 28
Outline
1 Motivation Hybrid Mobile Apps and their Security Challenges
2 Real World Cordova Usage
3 Static Analysis for Hybrid Apps Building a Unified Call Graph
4 Quality of the Unified Call Graph
5 Conclusions
Conclusions
Summary
Hybrid mobile apps are getting more popular
they are recommended at SAP
Hybrid mobile apps are juicy targets
Eg gain access to the app via the JS part and use the apprsquos permissions to steal data
Unified Call Graph is a first step in bringing the full power of SAST to hybrid apps
Quality largely depends on used call graph builders
Future work Data-flow analysis on top of Unified Call Graph
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 30
Thank you for your attentionAny questions or remarks
Conclusions
Bibliography
Achim D Brucker and Michael Herzberg
On the static analysis of hybrid mobile apps A report on the state of apache cordova nation
In Juan Caballero and Eric Bodden editors International Symposium on Engineering Secure Software and Systems(ESSoS) Lecture Notes in Computer Science Springer-Verlag 2016
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 32
Motivation Hybrid Mobile Apps and their Security Challenges
Real World Cordova Usage
Static Analysis for Hybrid Apps Building a Unified Call Graph
Quality of the Unified Call Graph
Conclusions
Motivation Hybrid Mobile Apps and their Security Challenges
Example app
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 7
Motivation Hybrid Mobile Apps and their Security Challenges
Technical view
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 8
Motivation Hybrid Mobile Apps and their Security Challenges
Technical view
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 8
Motivation Hybrid Mobile Apps and their Security Challenges
Example Get Phone Number
function showPhoneNumber(name) var successCallback = function(contact)
if (findequals(action)) String name = argsget(0)namefind(name callbackContext)
else if (createequals(action)) void find(String name CallbackContext callbackContext)
Contact contact = query(SELECT where name= + name)callbackContextsuccess(contact)
Problem
How to determine the targets of the callbackContext calls
Can we use the pattern of the action usage
Solution
Determine which callbackContext calls are reachableAD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 23
Static Analysis for Hybrid Apps Building a Unified Call Graph
FilterJavaCallSites details
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 24
Static Analysis for Hybrid Apps Building a Unified Call Graph
FilterJavaCallSites details
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 24
Static Analysis for Hybrid Apps Building a Unified Call Graph
FilterJavaCallSites details
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 24
Static Analysis for Hybrid Apps Building a Unified Call Graph
FilterJavaCallSites results
Developers all use action variable similarly
Therefore Many incorrect edges avoided
But A few calls from Java to JavaScript are missed now
Some store the callbackContext and call asynchronously
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 25
Outline
1 Motivation Hybrid Mobile Apps and their Security Challenges
2 Real World Cordova Usage
3 Static Analysis for Hybrid Apps Building a Unified Call Graph
4 Quality of the Unified Call Graph
5 Conclusions
Quality of the Unified Call Graph
What we have learned app size and cross-language calls
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 28
Outline
1 Motivation Hybrid Mobile Apps and their Security Challenges
2 Real World Cordova Usage
3 Static Analysis for Hybrid Apps Building a Unified Call Graph
4 Quality of the Unified Call Graph
5 Conclusions
Conclusions
Summary
Hybrid mobile apps are getting more popular
they are recommended at SAP
Hybrid mobile apps are juicy targets
Eg gain access to the app via the JS part and use the apprsquos permissions to steal data
Unified Call Graph is a first step in bringing the full power of SAST to hybrid apps
Quality largely depends on used call graph builders
Future work Data-flow analysis on top of Unified Call Graph
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 30
Thank you for your attentionAny questions or remarks
Conclusions
Bibliography
Achim D Brucker and Michael Herzberg
On the static analysis of hybrid mobile apps A report on the state of apache cordova nation
In Juan Caballero and Eric Bodden editors International Symposium on Engineering Secure Software and Systems(ESSoS) Lecture Notes in Computer Science Springer-Verlag 2016
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 32
Motivation Hybrid Mobile Apps and their Security Challenges
Real World Cordova Usage
Static Analysis for Hybrid Apps Building a Unified Call Graph
Quality of the Unified Call Graph
Conclusions
Motivation Hybrid Mobile Apps and their Security Challenges
Technical view
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 8
Motivation Hybrid Mobile Apps and their Security Challenges
Technical view
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 8
Motivation Hybrid Mobile Apps and their Security Challenges
Example Get Phone Number
function showPhoneNumber(name) var successCallback = function(contact)
if (findequals(action)) String name = argsget(0)namefind(name callbackContext)
else if (createequals(action)) void find(String name CallbackContext callbackContext)
Contact contact = query(SELECT where name= + name)callbackContextsuccess(contact)
Problem
How to determine the targets of the callbackContext calls
Can we use the pattern of the action usage
Solution
Determine which callbackContext calls are reachableAD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 23
Static Analysis for Hybrid Apps Building a Unified Call Graph
FilterJavaCallSites details
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 24
Static Analysis for Hybrid Apps Building a Unified Call Graph
FilterJavaCallSites details
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 24
Static Analysis for Hybrid Apps Building a Unified Call Graph
FilterJavaCallSites details
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 24
Static Analysis for Hybrid Apps Building a Unified Call Graph
FilterJavaCallSites results
Developers all use action variable similarly
Therefore Many incorrect edges avoided
But A few calls from Java to JavaScript are missed now
Some store the callbackContext and call asynchronously
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 25
Outline
1 Motivation Hybrid Mobile Apps and their Security Challenges
2 Real World Cordova Usage
3 Static Analysis for Hybrid Apps Building a Unified Call Graph
4 Quality of the Unified Call Graph
5 Conclusions
Quality of the Unified Call Graph
What we have learned app size and cross-language calls
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 28
Outline
1 Motivation Hybrid Mobile Apps and their Security Challenges
2 Real World Cordova Usage
3 Static Analysis for Hybrid Apps Building a Unified Call Graph
4 Quality of the Unified Call Graph
5 Conclusions
Conclusions
Summary
Hybrid mobile apps are getting more popular
they are recommended at SAP
Hybrid mobile apps are juicy targets
Eg gain access to the app via the JS part and use the apprsquos permissions to steal data
Unified Call Graph is a first step in bringing the full power of SAST to hybrid apps
Quality largely depends on used call graph builders
Future work Data-flow analysis on top of Unified Call Graph
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 30
Thank you for your attentionAny questions or remarks
Conclusions
Bibliography
Achim D Brucker and Michael Herzberg
On the static analysis of hybrid mobile apps A report on the state of apache cordova nation
In Juan Caballero and Eric Bodden editors International Symposium on Engineering Secure Software and Systems(ESSoS) Lecture Notes in Computer Science Springer-Verlag 2016
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 32
Motivation Hybrid Mobile Apps and their Security Challenges
Real World Cordova Usage
Static Analysis for Hybrid Apps Building a Unified Call Graph
Quality of the Unified Call Graph
Conclusions
Motivation Hybrid Mobile Apps and their Security Challenges
Technical view
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 8
Motivation Hybrid Mobile Apps and their Security Challenges
Example Get Phone Number
function showPhoneNumber(name) var successCallback = function(contact)
if (findequals(action)) String name = argsget(0)namefind(name callbackContext)
else if (createequals(action)) void find(String name CallbackContext callbackContext)
Contact contact = query(SELECT where name= + name)callbackContextsuccess(contact)
Problem
How to determine the targets of the callbackContext calls
Can we use the pattern of the action usage
Solution
Determine which callbackContext calls are reachableAD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 23
Static Analysis for Hybrid Apps Building a Unified Call Graph
FilterJavaCallSites details
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 24
Static Analysis for Hybrid Apps Building a Unified Call Graph
FilterJavaCallSites details
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 24
Static Analysis for Hybrid Apps Building a Unified Call Graph
FilterJavaCallSites details
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 24
Static Analysis for Hybrid Apps Building a Unified Call Graph
FilterJavaCallSites results
Developers all use action variable similarly
Therefore Many incorrect edges avoided
But A few calls from Java to JavaScript are missed now
Some store the callbackContext and call asynchronously
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 25
Outline
1 Motivation Hybrid Mobile Apps and their Security Challenges
2 Real World Cordova Usage
3 Static Analysis for Hybrid Apps Building a Unified Call Graph
4 Quality of the Unified Call Graph
5 Conclusions
Quality of the Unified Call Graph
What we have learned app size and cross-language calls
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 28
Outline
1 Motivation Hybrid Mobile Apps and their Security Challenges
2 Real World Cordova Usage
3 Static Analysis for Hybrid Apps Building a Unified Call Graph
4 Quality of the Unified Call Graph
5 Conclusions
Conclusions
Summary
Hybrid mobile apps are getting more popular
they are recommended at SAP
Hybrid mobile apps are juicy targets
Eg gain access to the app via the JS part and use the apprsquos permissions to steal data
Unified Call Graph is a first step in bringing the full power of SAST to hybrid apps
Quality largely depends on used call graph builders
Future work Data-flow analysis on top of Unified Call Graph
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 30
Thank you for your attentionAny questions or remarks
Conclusions
Bibliography
Achim D Brucker and Michael Herzberg
On the static analysis of hybrid mobile apps A report on the state of apache cordova nation
In Juan Caballero and Eric Bodden editors International Symposium on Engineering Secure Software and Systems(ESSoS) Lecture Notes in Computer Science Springer-Verlag 2016
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 32
Motivation Hybrid Mobile Apps and their Security Challenges
Real World Cordova Usage
Static Analysis for Hybrid Apps Building a Unified Call Graph
Quality of the Unified Call Graph
Conclusions
Motivation Hybrid Mobile Apps and their Security Challenges
Example Get Phone Number
function showPhoneNumber(name) var successCallback = function(contact)
if (findequals(action)) String name = argsget(0)namefind(name callbackContext)
else if (createequals(action)) void find(String name CallbackContext callbackContext)
Contact contact = query(SELECT where name= + name)callbackContextsuccess(contact)
Problem
How to determine the targets of the callbackContext calls
Can we use the pattern of the action usage
Solution
Determine which callbackContext calls are reachableAD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 23
Static Analysis for Hybrid Apps Building a Unified Call Graph
FilterJavaCallSites details
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 24
Static Analysis for Hybrid Apps Building a Unified Call Graph
FilterJavaCallSites details
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 24
Static Analysis for Hybrid Apps Building a Unified Call Graph
FilterJavaCallSites details
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 24
Static Analysis for Hybrid Apps Building a Unified Call Graph
FilterJavaCallSites results
Developers all use action variable similarly
Therefore Many incorrect edges avoided
But A few calls from Java to JavaScript are missed now
Some store the callbackContext and call asynchronously
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 25
Outline
1 Motivation Hybrid Mobile Apps and their Security Challenges
2 Real World Cordova Usage
3 Static Analysis for Hybrid Apps Building a Unified Call Graph
4 Quality of the Unified Call Graph
5 Conclusions
Quality of the Unified Call Graph
What we have learned app size and cross-language calls
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 28
Outline
1 Motivation Hybrid Mobile Apps and their Security Challenges
2 Real World Cordova Usage
3 Static Analysis for Hybrid Apps Building a Unified Call Graph
4 Quality of the Unified Call Graph
5 Conclusions
Conclusions
Summary
Hybrid mobile apps are getting more popular
they are recommended at SAP
Hybrid mobile apps are juicy targets
Eg gain access to the app via the JS part and use the apprsquos permissions to steal data
Unified Call Graph is a first step in bringing the full power of SAST to hybrid apps
Quality largely depends on used call graph builders
Future work Data-flow analysis on top of Unified Call Graph
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 30
Thank you for your attentionAny questions or remarks
Conclusions
Bibliography
Achim D Brucker and Michael Herzberg
On the static analysis of hybrid mobile apps A report on the state of apache cordova nation
In Juan Caballero and Eric Bodden editors International Symposium on Engineering Secure Software and Systems(ESSoS) Lecture Notes in Computer Science Springer-Verlag 2016
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 32
Motivation Hybrid Mobile Apps and their Security Challenges
Real World Cordova Usage
Static Analysis for Hybrid Apps Building a Unified Call Graph
Quality of the Unified Call Graph
Conclusions
Motivation Hybrid Mobile Apps and their Security Challenges
Example Get Phone Number
function showPhoneNumber(name) var successCallback = function(contact)
if (findequals(action)) String name = argsget(0)namefind(name callbackContext)
else if (createequals(action)) void find(String name CallbackContext callbackContext)
Contact contact = query(SELECT where name= + name)callbackContextsuccess(contact)
Problem
How to determine the targets of the callbackContext calls
Can we use the pattern of the action usage
Solution
Determine which callbackContext calls are reachableAD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 23
Static Analysis for Hybrid Apps Building a Unified Call Graph
FilterJavaCallSites details
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 24
Static Analysis for Hybrid Apps Building a Unified Call Graph
FilterJavaCallSites details
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 24
Static Analysis for Hybrid Apps Building a Unified Call Graph
FilterJavaCallSites details
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 24
Static Analysis for Hybrid Apps Building a Unified Call Graph
FilterJavaCallSites results
Developers all use action variable similarly
Therefore Many incorrect edges avoided
But A few calls from Java to JavaScript are missed now
Some store the callbackContext and call asynchronously
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 25
Outline
1 Motivation Hybrid Mobile Apps and their Security Challenges
2 Real World Cordova Usage
3 Static Analysis for Hybrid Apps Building a Unified Call Graph
4 Quality of the Unified Call Graph
5 Conclusions
Quality of the Unified Call Graph
What we have learned app size and cross-language calls
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 28
Outline
1 Motivation Hybrid Mobile Apps and their Security Challenges
2 Real World Cordova Usage
3 Static Analysis for Hybrid Apps Building a Unified Call Graph
4 Quality of the Unified Call Graph
5 Conclusions
Conclusions
Summary
Hybrid mobile apps are getting more popular
they are recommended at SAP
Hybrid mobile apps are juicy targets
Eg gain access to the app via the JS part and use the apprsquos permissions to steal data
Unified Call Graph is a first step in bringing the full power of SAST to hybrid apps
Quality largely depends on used call graph builders
Future work Data-flow analysis on top of Unified Call Graph
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 30
Thank you for your attentionAny questions or remarks
Conclusions
Bibliography
Achim D Brucker and Michael Herzberg
On the static analysis of hybrid mobile apps A report on the state of apache cordova nation
In Juan Caballero and Eric Bodden editors International Symposium on Engineering Secure Software and Systems(ESSoS) Lecture Notes in Computer Science Springer-Verlag 2016
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 32
Motivation Hybrid Mobile Apps and their Security Challenges
Real World Cordova Usage
Static Analysis for Hybrid Apps Building a Unified Call Graph
Quality of the Unified Call Graph
Conclusions
Motivation Hybrid Mobile Apps and their Security Challenges
Example Get Phone Number
function showPhoneNumber(name) var successCallback = function(contact)
if (findequals(action)) String name = argsget(0)namefind(name callbackContext)
else if (createequals(action)) void find(String name CallbackContext callbackContext)
Contact contact = query(SELECT where name= + name)callbackContextsuccess(contact)
Problem
How to determine the targets of the callbackContext calls
Can we use the pattern of the action usage
Solution
Determine which callbackContext calls are reachableAD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 23
Static Analysis for Hybrid Apps Building a Unified Call Graph
FilterJavaCallSites details
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 24
Static Analysis for Hybrid Apps Building a Unified Call Graph
FilterJavaCallSites details
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 24
Static Analysis for Hybrid Apps Building a Unified Call Graph
FilterJavaCallSites details
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 24
Static Analysis for Hybrid Apps Building a Unified Call Graph
FilterJavaCallSites results
Developers all use action variable similarly
Therefore Many incorrect edges avoided
But A few calls from Java to JavaScript are missed now
Some store the callbackContext and call asynchronously
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 25
Outline
1 Motivation Hybrid Mobile Apps and their Security Challenges
2 Real World Cordova Usage
3 Static Analysis for Hybrid Apps Building a Unified Call Graph
4 Quality of the Unified Call Graph
5 Conclusions
Quality of the Unified Call Graph
What we have learned app size and cross-language calls
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 28
Outline
1 Motivation Hybrid Mobile Apps and their Security Challenges
2 Real World Cordova Usage
3 Static Analysis for Hybrid Apps Building a Unified Call Graph
4 Quality of the Unified Call Graph
5 Conclusions
Conclusions
Summary
Hybrid mobile apps are getting more popular
they are recommended at SAP
Hybrid mobile apps are juicy targets
Eg gain access to the app via the JS part and use the apprsquos permissions to steal data
Unified Call Graph is a first step in bringing the full power of SAST to hybrid apps
Quality largely depends on used call graph builders
Future work Data-flow analysis on top of Unified Call Graph
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 30
Thank you for your attentionAny questions or remarks
Conclusions
Bibliography
Achim D Brucker and Michael Herzberg
On the static analysis of hybrid mobile apps A report on the state of apache cordova nation
In Juan Caballero and Eric Bodden editors International Symposium on Engineering Secure Software and Systems(ESSoS) Lecture Notes in Computer Science Springer-Verlag 2016
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 32
Motivation Hybrid Mobile Apps and their Security Challenges
Real World Cordova Usage
Static Analysis for Hybrid Apps Building a Unified Call Graph
Quality of the Unified Call Graph
Conclusions
Motivation Hybrid Mobile Apps and their Security Challenges
Example Get Phone Number
function showPhoneNumber(name) var successCallback = function(contact)
if (findequals(action)) String name = argsget(0)namefind(name callbackContext)
else if (createequals(action)) void find(String name CallbackContext callbackContext)
Contact contact = query(SELECT where name= + name)callbackContextsuccess(contact)
Problem
How to determine the targets of the callbackContext calls
Can we use the pattern of the action usage
Solution
Determine which callbackContext calls are reachableAD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 23
Static Analysis for Hybrid Apps Building a Unified Call Graph
FilterJavaCallSites details
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 24
Static Analysis for Hybrid Apps Building a Unified Call Graph
FilterJavaCallSites details
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 24
Static Analysis for Hybrid Apps Building a Unified Call Graph
FilterJavaCallSites details
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 24
Static Analysis for Hybrid Apps Building a Unified Call Graph
FilterJavaCallSites results
Developers all use action variable similarly
Therefore Many incorrect edges avoided
But A few calls from Java to JavaScript are missed now
Some store the callbackContext and call asynchronously
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 25
Outline
1 Motivation Hybrid Mobile Apps and their Security Challenges
2 Real World Cordova Usage
3 Static Analysis for Hybrid Apps Building a Unified Call Graph
4 Quality of the Unified Call Graph
5 Conclusions
Quality of the Unified Call Graph
What we have learned app size and cross-language calls
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 28
Outline
1 Motivation Hybrid Mobile Apps and their Security Challenges
2 Real World Cordova Usage
3 Static Analysis for Hybrid Apps Building a Unified Call Graph
4 Quality of the Unified Call Graph
5 Conclusions
Conclusions
Summary
Hybrid mobile apps are getting more popular
they are recommended at SAP
Hybrid mobile apps are juicy targets
Eg gain access to the app via the JS part and use the apprsquos permissions to steal data
Unified Call Graph is a first step in bringing the full power of SAST to hybrid apps
Quality largely depends on used call graph builders
Future work Data-flow analysis on top of Unified Call Graph
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 30
Thank you for your attentionAny questions or remarks
Conclusions
Bibliography
Achim D Brucker and Michael Herzberg
On the static analysis of hybrid mobile apps A report on the state of apache cordova nation
In Juan Caballero and Eric Bodden editors International Symposium on Engineering Secure Software and Systems(ESSoS) Lecture Notes in Computer Science Springer-Verlag 2016
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 32
Motivation Hybrid Mobile Apps and their Security Challenges
Real World Cordova Usage
Static Analysis for Hybrid Apps Building a Unified Call Graph
Quality of the Unified Call Graph
Conclusions
Motivation Hybrid Mobile Apps and their Security Challenges
Example Get Phone Number
function showPhoneNumber(name) var successCallback = function(contact)
if (findequals(action)) String name = argsget(0)namefind(name callbackContext)
else if (createequals(action)) void find(String name CallbackContext callbackContext)
Contact contact = query(SELECT where name= + name)callbackContextsuccess(contact)
Problem
How to determine the targets of the callbackContext calls
Can we use the pattern of the action usage
Solution
Determine which callbackContext calls are reachableAD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 23
Static Analysis for Hybrid Apps Building a Unified Call Graph
FilterJavaCallSites details
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 24
Static Analysis for Hybrid Apps Building a Unified Call Graph
FilterJavaCallSites details
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 24
Static Analysis for Hybrid Apps Building a Unified Call Graph
FilterJavaCallSites details
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 24
Static Analysis for Hybrid Apps Building a Unified Call Graph
FilterJavaCallSites results
Developers all use action variable similarly
Therefore Many incorrect edges avoided
But A few calls from Java to JavaScript are missed now
Some store the callbackContext and call asynchronously
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 25
Outline
1 Motivation Hybrid Mobile Apps and their Security Challenges
2 Real World Cordova Usage
3 Static Analysis for Hybrid Apps Building a Unified Call Graph
4 Quality of the Unified Call Graph
5 Conclusions
Quality of the Unified Call Graph
What we have learned app size and cross-language calls
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 28
Outline
1 Motivation Hybrid Mobile Apps and their Security Challenges
2 Real World Cordova Usage
3 Static Analysis for Hybrid Apps Building a Unified Call Graph
4 Quality of the Unified Call Graph
5 Conclusions
Conclusions
Summary
Hybrid mobile apps are getting more popular
they are recommended at SAP
Hybrid mobile apps are juicy targets
Eg gain access to the app via the JS part and use the apprsquos permissions to steal data
Unified Call Graph is a first step in bringing the full power of SAST to hybrid apps
Quality largely depends on used call graph builders
Future work Data-flow analysis on top of Unified Call Graph
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 30
Thank you for your attentionAny questions or remarks
Conclusions
Bibliography
Achim D Brucker and Michael Herzberg
On the static analysis of hybrid mobile apps A report on the state of apache cordova nation
In Juan Caballero and Eric Bodden editors International Symposium on Engineering Secure Software and Systems(ESSoS) Lecture Notes in Computer Science Springer-Verlag 2016
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 32
Motivation Hybrid Mobile Apps and their Security Challenges
Real World Cordova Usage
Static Analysis for Hybrid Apps Building a Unified Call Graph
Quality of the Unified Call Graph
Conclusions
Motivation Hybrid Mobile Apps and their Security Challenges
Example Get Phone Number
function showPhoneNumber(name) var successCallback = function(contact)
if (findequals(action)) String name = argsget(0)namefind(name callbackContext)
else if (createequals(action)) void find(String name CallbackContext callbackContext)
Contact contact = query(SELECT where name= + name)callbackContextsuccess(contact)
Problem
How to determine the targets of the callbackContext calls
Can we use the pattern of the action usage
Solution
Determine which callbackContext calls are reachableAD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 23
Static Analysis for Hybrid Apps Building a Unified Call Graph
FilterJavaCallSites details
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 24
Static Analysis for Hybrid Apps Building a Unified Call Graph
FilterJavaCallSites details
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 24
Static Analysis for Hybrid Apps Building a Unified Call Graph
FilterJavaCallSites details
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 24
Static Analysis for Hybrid Apps Building a Unified Call Graph
FilterJavaCallSites results
Developers all use action variable similarly
Therefore Many incorrect edges avoided
But A few calls from Java to JavaScript are missed now
Some store the callbackContext and call asynchronously
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 25
Outline
1 Motivation Hybrid Mobile Apps and their Security Challenges
2 Real World Cordova Usage
3 Static Analysis for Hybrid Apps Building a Unified Call Graph
4 Quality of the Unified Call Graph
5 Conclusions
Quality of the Unified Call Graph
What we have learned app size and cross-language calls
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 28
Outline
1 Motivation Hybrid Mobile Apps and their Security Challenges
2 Real World Cordova Usage
3 Static Analysis for Hybrid Apps Building a Unified Call Graph
4 Quality of the Unified Call Graph
5 Conclusions
Conclusions
Summary
Hybrid mobile apps are getting more popular
they are recommended at SAP
Hybrid mobile apps are juicy targets
Eg gain access to the app via the JS part and use the apprsquos permissions to steal data
Unified Call Graph is a first step in bringing the full power of SAST to hybrid apps
Quality largely depends on used call graph builders
Future work Data-flow analysis on top of Unified Call Graph
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 30
Thank you for your attentionAny questions or remarks
Conclusions
Bibliography
Achim D Brucker and Michael Herzberg
On the static analysis of hybrid mobile apps A report on the state of apache cordova nation
In Juan Caballero and Eric Bodden editors International Symposium on Engineering Secure Software and Systems(ESSoS) Lecture Notes in Computer Science Springer-Verlag 2016
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 32
Motivation Hybrid Mobile Apps and their Security Challenges
Real World Cordova Usage
Static Analysis for Hybrid Apps Building a Unified Call Graph
Quality of the Unified Call Graph
Conclusions
Motivation Hybrid Mobile Apps and their Security Challenges
Example Get Phone Number
function showPhoneNumber(name) var successCallback = function(contact)
if (findequals(action)) String name = argsget(0)namefind(name callbackContext)
else if (createequals(action)) void find(String name CallbackContext callbackContext)
Contact contact = query(SELECT where name= + name)callbackContextsuccess(contact)
Problem
How to determine the targets of the callbackContext calls
Can we use the pattern of the action usage
Solution
Determine which callbackContext calls are reachableAD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 23
Static Analysis for Hybrid Apps Building a Unified Call Graph
FilterJavaCallSites details
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 24
Static Analysis for Hybrid Apps Building a Unified Call Graph
FilterJavaCallSites details
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 24
Static Analysis for Hybrid Apps Building a Unified Call Graph
FilterJavaCallSites details
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 24
Static Analysis for Hybrid Apps Building a Unified Call Graph
FilterJavaCallSites results
Developers all use action variable similarly
Therefore Many incorrect edges avoided
But A few calls from Java to JavaScript are missed now
Some store the callbackContext and call asynchronously
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 25
Outline
1 Motivation Hybrid Mobile Apps and their Security Challenges
2 Real World Cordova Usage
3 Static Analysis for Hybrid Apps Building a Unified Call Graph
4 Quality of the Unified Call Graph
5 Conclusions
Quality of the Unified Call Graph
What we have learned app size and cross-language calls
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 28
Outline
1 Motivation Hybrid Mobile Apps and their Security Challenges
2 Real World Cordova Usage
3 Static Analysis for Hybrid Apps Building a Unified Call Graph
4 Quality of the Unified Call Graph
5 Conclusions
Conclusions
Summary
Hybrid mobile apps are getting more popular
they are recommended at SAP
Hybrid mobile apps are juicy targets
Eg gain access to the app via the JS part and use the apprsquos permissions to steal data
Unified Call Graph is a first step in bringing the full power of SAST to hybrid apps
Quality largely depends on used call graph builders
Future work Data-flow analysis on top of Unified Call Graph
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 30
Thank you for your attentionAny questions or remarks
Conclusions
Bibliography
Achim D Brucker and Michael Herzberg
On the static analysis of hybrid mobile apps A report on the state of apache cordova nation
In Juan Caballero and Eric Bodden editors International Symposium on Engineering Secure Software and Systems(ESSoS) Lecture Notes in Computer Science Springer-Verlag 2016
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 32
Motivation Hybrid Mobile Apps and their Security Challenges
Real World Cordova Usage
Static Analysis for Hybrid Apps Building a Unified Call Graph
Quality of the Unified Call Graph
Conclusions
Motivation Hybrid Mobile Apps and their Security Challenges
First security assessment
Problem JSJava Bridge is vulnerable toinjection attacks
For regular apps Static ApplicationSecurity Testing (SAST)
But No support for cross-language analysis
Our goalProvide basis (call graph) to apply SAST tohybrid mobile apps
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 10
Outline
1 Motivation Hybrid Mobile Apps and their Security Challenges
2 Real World Cordova Usage
3 Static Analysis for Hybrid Apps Building a Unified Call Graph
4 Quality of the Unified Call Graph
5 Conclusions
Real World Cordova Usage
What we were interested in
Main goals
Understand the use of Cordova
Learn requirements for Cordova security testing tools
Looking for answers for questions like
How many apps are using Cordova
How is Cordova used by app developers
Are cross-language calls common or not
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 12
Real World Cordova Usage
Test sets
Selection of apps
all apps that ship Cordova from Googlersquos Top 1000
100 apps ship Cordova pluginsonly 50 actually use Cordova (5)
three selected apps from SAP (using SAP Kapsel)
one artificial test app (to test our tool)
Manual analysis of 8 apps (including one from SAP)
to understand the use of Cordova
to assess the quality of our automated analysis
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 13
if (findequals(action)) String name = argsget(0)namefind(name callbackContext)
else if (createequals(action)) void find(String name CallbackContext callbackContext)
Contact contact = query(SELECT where name= + name)callbackContextsuccess(contact)
Problem
How to determine the targets of the callbackContext calls
Can we use the pattern of the action usage
Solution
Determine which callbackContext calls are reachableAD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 23
Static Analysis for Hybrid Apps Building a Unified Call Graph
FilterJavaCallSites details
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 24
Static Analysis for Hybrid Apps Building a Unified Call Graph
FilterJavaCallSites details
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 24
Static Analysis for Hybrid Apps Building a Unified Call Graph
FilterJavaCallSites details
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 24
Static Analysis for Hybrid Apps Building a Unified Call Graph
FilterJavaCallSites results
Developers all use action variable similarly
Therefore Many incorrect edges avoided
But A few calls from Java to JavaScript are missed now
Some store the callbackContext and call asynchronously
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 25
Outline
1 Motivation Hybrid Mobile Apps and their Security Challenges
2 Real World Cordova Usage
3 Static Analysis for Hybrid Apps Building a Unified Call Graph
4 Quality of the Unified Call Graph
5 Conclusions
Quality of the Unified Call Graph
What we have learned app size and cross-language calls
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 28
Outline
1 Motivation Hybrid Mobile Apps and their Security Challenges
2 Real World Cordova Usage
3 Static Analysis for Hybrid Apps Building a Unified Call Graph
4 Quality of the Unified Call Graph
5 Conclusions
Conclusions
Summary
Hybrid mobile apps are getting more popular
they are recommended at SAP
Hybrid mobile apps are juicy targets
Eg gain access to the app via the JS part and use the apprsquos permissions to steal data
Unified Call Graph is a first step in bringing the full power of SAST to hybrid apps
Quality largely depends on used call graph builders
Future work Data-flow analysis on top of Unified Call Graph
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 30
Thank you for your attentionAny questions or remarks
Conclusions
Bibliography
Achim D Brucker and Michael Herzberg
On the static analysis of hybrid mobile apps A report on the state of apache cordova nation
In Juan Caballero and Eric Bodden editors International Symposium on Engineering Secure Software and Systems(ESSoS) Lecture Notes in Computer Science Springer-Verlag 2016
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 32
Motivation Hybrid Mobile Apps and their Security Challenges
Real World Cordova Usage
Static Analysis for Hybrid Apps Building a Unified Call Graph
Quality of the Unified Call Graph
Conclusions
Outline
1 Motivation Hybrid Mobile Apps and their Security Challenges
2 Real World Cordova Usage
3 Static Analysis for Hybrid Apps Building a Unified Call Graph
4 Quality of the Unified Call Graph
5 Conclusions
Real World Cordova Usage
What we were interested in
Main goals
Understand the use of Cordova
Learn requirements for Cordova security testing tools
Looking for answers for questions like
How many apps are using Cordova
How is Cordova used by app developers
Are cross-language calls common or not
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 12
Real World Cordova Usage
Test sets
Selection of apps
all apps that ship Cordova from Googlersquos Top 1000
100 apps ship Cordova pluginsonly 50 actually use Cordova (5)
three selected apps from SAP (using SAP Kapsel)
one artificial test app (to test our tool)
Manual analysis of 8 apps (including one from SAP)
to understand the use of Cordova
to assess the quality of our automated analysis
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 13
if (findequals(action)) String name = argsget(0)namefind(name callbackContext)
else if (createequals(action)) void find(String name CallbackContext callbackContext)
Contact contact = query(SELECT where name= + name)callbackContextsuccess(contact)
Problem
How to determine the targets of the callbackContext calls
Can we use the pattern of the action usage
Solution
Determine which callbackContext calls are reachableAD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 23
Static Analysis for Hybrid Apps Building a Unified Call Graph
FilterJavaCallSites details
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 24
Static Analysis for Hybrid Apps Building a Unified Call Graph
FilterJavaCallSites details
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 24
Static Analysis for Hybrid Apps Building a Unified Call Graph
FilterJavaCallSites details
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 24
Static Analysis for Hybrid Apps Building a Unified Call Graph
FilterJavaCallSites results
Developers all use action variable similarly
Therefore Many incorrect edges avoided
But A few calls from Java to JavaScript are missed now
Some store the callbackContext and call asynchronously
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 25
Outline
1 Motivation Hybrid Mobile Apps and their Security Challenges
2 Real World Cordova Usage
3 Static Analysis for Hybrid Apps Building a Unified Call Graph
4 Quality of the Unified Call Graph
5 Conclusions
Quality of the Unified Call Graph
What we have learned app size and cross-language calls
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 28
Outline
1 Motivation Hybrid Mobile Apps and their Security Challenges
2 Real World Cordova Usage
3 Static Analysis for Hybrid Apps Building a Unified Call Graph
4 Quality of the Unified Call Graph
5 Conclusions
Conclusions
Summary
Hybrid mobile apps are getting more popular
they are recommended at SAP
Hybrid mobile apps are juicy targets
Eg gain access to the app via the JS part and use the apprsquos permissions to steal data
Unified Call Graph is a first step in bringing the full power of SAST to hybrid apps
Quality largely depends on used call graph builders
Future work Data-flow analysis on top of Unified Call Graph
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 30
Thank you for your attentionAny questions or remarks
Conclusions
Bibliography
Achim D Brucker and Michael Herzberg
On the static analysis of hybrid mobile apps A report on the state of apache cordova nation
In Juan Caballero and Eric Bodden editors International Symposium on Engineering Secure Software and Systems(ESSoS) Lecture Notes in Computer Science Springer-Verlag 2016
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 32
Motivation Hybrid Mobile Apps and their Security Challenges
Real World Cordova Usage
Static Analysis for Hybrid Apps Building a Unified Call Graph
Quality of the Unified Call Graph
Conclusions
Real World Cordova Usage
What we were interested in
Main goals
Understand the use of Cordova
Learn requirements for Cordova security testing tools
Looking for answers for questions like
How many apps are using Cordova
How is Cordova used by app developers
Are cross-language calls common or not
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 12
Real World Cordova Usage
Test sets
Selection of apps
all apps that ship Cordova from Googlersquos Top 1000
100 apps ship Cordova pluginsonly 50 actually use Cordova (5)
three selected apps from SAP (using SAP Kapsel)
one artificial test app (to test our tool)
Manual analysis of 8 apps (including one from SAP)
to understand the use of Cordova
to assess the quality of our automated analysis
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 13
if (findequals(action)) String name = argsget(0)namefind(name callbackContext)
else if (createequals(action)) void find(String name CallbackContext callbackContext)
Contact contact = query(SELECT where name= + name)callbackContextsuccess(contact)
Problem
How to determine the targets of the callbackContext calls
Can we use the pattern of the action usage
Solution
Determine which callbackContext calls are reachableAD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 23
Static Analysis for Hybrid Apps Building a Unified Call Graph
FilterJavaCallSites details
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 24
Static Analysis for Hybrid Apps Building a Unified Call Graph
FilterJavaCallSites details
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 24
Static Analysis for Hybrid Apps Building a Unified Call Graph
FilterJavaCallSites details
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 24
Static Analysis for Hybrid Apps Building a Unified Call Graph
FilterJavaCallSites results
Developers all use action variable similarly
Therefore Many incorrect edges avoided
But A few calls from Java to JavaScript are missed now
Some store the callbackContext and call asynchronously
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 25
Outline
1 Motivation Hybrid Mobile Apps and their Security Challenges
2 Real World Cordova Usage
3 Static Analysis for Hybrid Apps Building a Unified Call Graph
4 Quality of the Unified Call Graph
5 Conclusions
Quality of the Unified Call Graph
What we have learned app size and cross-language calls
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 28
Outline
1 Motivation Hybrid Mobile Apps and their Security Challenges
2 Real World Cordova Usage
3 Static Analysis for Hybrid Apps Building a Unified Call Graph
4 Quality of the Unified Call Graph
5 Conclusions
Conclusions
Summary
Hybrid mobile apps are getting more popular
they are recommended at SAP
Hybrid mobile apps are juicy targets
Eg gain access to the app via the JS part and use the apprsquos permissions to steal data
Unified Call Graph is a first step in bringing the full power of SAST to hybrid apps
Quality largely depends on used call graph builders
Future work Data-flow analysis on top of Unified Call Graph
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 30
Thank you for your attentionAny questions or remarks
Conclusions
Bibliography
Achim D Brucker and Michael Herzberg
On the static analysis of hybrid mobile apps A report on the state of apache cordova nation
In Juan Caballero and Eric Bodden editors International Symposium on Engineering Secure Software and Systems(ESSoS) Lecture Notes in Computer Science Springer-Verlag 2016
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 32
Motivation Hybrid Mobile Apps and their Security Challenges
Real World Cordova Usage
Static Analysis for Hybrid Apps Building a Unified Call Graph
Quality of the Unified Call Graph
Conclusions
Real World Cordova Usage
Test sets
Selection of apps
all apps that ship Cordova from Googlersquos Top 1000
100 apps ship Cordova pluginsonly 50 actually use Cordova (5)
three selected apps from SAP (using SAP Kapsel)
one artificial test app (to test our tool)
Manual analysis of 8 apps (including one from SAP)
to understand the use of Cordova
to assess the quality of our automated analysis
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 13
if (findequals(action)) String name = argsget(0)namefind(name callbackContext)
else if (createequals(action)) void find(String name CallbackContext callbackContext)
Contact contact = query(SELECT where name= + name)callbackContextsuccess(contact)
Problem
How to determine the targets of the callbackContext calls
Can we use the pattern of the action usage
Solution
Determine which callbackContext calls are reachableAD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 23
Static Analysis for Hybrid Apps Building a Unified Call Graph
FilterJavaCallSites details
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 24
Static Analysis for Hybrid Apps Building a Unified Call Graph
FilterJavaCallSites details
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 24
Static Analysis for Hybrid Apps Building a Unified Call Graph
FilterJavaCallSites details
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 24
Static Analysis for Hybrid Apps Building a Unified Call Graph
FilterJavaCallSites results
Developers all use action variable similarly
Therefore Many incorrect edges avoided
But A few calls from Java to JavaScript are missed now
Some store the callbackContext and call asynchronously
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 25
Outline
1 Motivation Hybrid Mobile Apps and their Security Challenges
2 Real World Cordova Usage
3 Static Analysis for Hybrid Apps Building a Unified Call Graph
4 Quality of the Unified Call Graph
5 Conclusions
Quality of the Unified Call Graph
What we have learned app size and cross-language calls
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 28
Outline
1 Motivation Hybrid Mobile Apps and their Security Challenges
2 Real World Cordova Usage
3 Static Analysis for Hybrid Apps Building a Unified Call Graph
4 Quality of the Unified Call Graph
5 Conclusions
Conclusions
Summary
Hybrid mobile apps are getting more popular
they are recommended at SAP
Hybrid mobile apps are juicy targets
Eg gain access to the app via the JS part and use the apprsquos permissions to steal data
Unified Call Graph is a first step in bringing the full power of SAST to hybrid apps
Quality largely depends on used call graph builders
Future work Data-flow analysis on top of Unified Call Graph
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 30
Thank you for your attentionAny questions or remarks
Conclusions
Bibliography
Achim D Brucker and Michael Herzberg
On the static analysis of hybrid mobile apps A report on the state of apache cordova nation
In Juan Caballero and Eric Bodden editors International Symposium on Engineering Secure Software and Systems(ESSoS) Lecture Notes in Computer Science Springer-Verlag 2016
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 32
Motivation Hybrid Mobile Apps and their Security Challenges
Real World Cordova Usage
Static Analysis for Hybrid Apps Building a Unified Call Graph
if (findequals(action)) String name = argsget(0)namefind(name callbackContext)
else if (createequals(action)) void find(String name CallbackContext callbackContext)
Contact contact = query(SELECT where name= + name)callbackContextsuccess(contact)
Problem
How to determine the targets of the callbackContext calls
Can we use the pattern of the action usage
Solution
Determine which callbackContext calls are reachableAD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 23
Static Analysis for Hybrid Apps Building a Unified Call Graph
FilterJavaCallSites details
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 24
Static Analysis for Hybrid Apps Building a Unified Call Graph
FilterJavaCallSites details
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 24
Static Analysis for Hybrid Apps Building a Unified Call Graph
FilterJavaCallSites details
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 24
Static Analysis for Hybrid Apps Building a Unified Call Graph
FilterJavaCallSites results
Developers all use action variable similarly
Therefore Many incorrect edges avoided
But A few calls from Java to JavaScript are missed now
Some store the callbackContext and call asynchronously
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 25
Outline
1 Motivation Hybrid Mobile Apps and their Security Challenges
2 Real World Cordova Usage
3 Static Analysis for Hybrid Apps Building a Unified Call Graph
4 Quality of the Unified Call Graph
5 Conclusions
Quality of the Unified Call Graph
What we have learned app size and cross-language calls
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 28
Outline
1 Motivation Hybrid Mobile Apps and their Security Challenges
2 Real World Cordova Usage
3 Static Analysis for Hybrid Apps Building a Unified Call Graph
4 Quality of the Unified Call Graph
5 Conclusions
Conclusions
Summary
Hybrid mobile apps are getting more popular
they are recommended at SAP
Hybrid mobile apps are juicy targets
Eg gain access to the app via the JS part and use the apprsquos permissions to steal data
Unified Call Graph is a first step in bringing the full power of SAST to hybrid apps
Quality largely depends on used call graph builders
Future work Data-flow analysis on top of Unified Call Graph
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 30
Thank you for your attentionAny questions or remarks
Conclusions
Bibliography
Achim D Brucker and Michael Herzberg
On the static analysis of hybrid mobile apps A report on the state of apache cordova nation
In Juan Caballero and Eric Bodden editors International Symposium on Engineering Secure Software and Systems(ESSoS) Lecture Notes in Computer Science Springer-Verlag 2016
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 32
Motivation Hybrid Mobile Apps and their Security Challenges
Real World Cordova Usage
Static Analysis for Hybrid Apps Building a Unified Call Graph
Quality of the Unified Call Graph
Conclusions
Real World Cordova Usage
What we have learned app size
App size
mobile apps are notalways small
SAP apps seem to belarger than the average
Exceptional apps
No HTMLJS in APK
Ship Cordova but do not useit
App Category JS [kLoC] Java [kLoC]
sap01 Finance 355 170sap02 Business 3453 535sap03 Business 5723 1358
app01 Finance 263 178app02 Finance 112 168app03 Social 46 1037app04 Business 375 168app05 Finance 200 448app06 Finance 304 243app07 Travel amp Local 1290 3040app08 Entertainment 367 230app09 Lifestyle 363 447app10 Finance 437 184app11 Business 140 4389
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 15
Outline
1 Motivation Hybrid Mobile Apps and their Security Challenges
2 Real World Cordova Usage
3 Static Analysis for Hybrid Apps Building a Unified Call Graph
4 Quality of the Unified Call Graph
5 Conclusions
Static Analysis for Hybrid Apps Building a Unified Call Graph
Challenges
Based on the examined apps
Cordova relies heavily on dynamic mechanisms both on JavaScript and Java side
Developers modify their plugins and sometimes implement their own
Deep framework analysis Modelling framework Modelling plugins
Closest to the actualprogram
But Framework veryexpensive
Models the Cordovaframework
Analyses plugins
Models both frameworkand plugins
Analyses only UI andbusiness logic part
But Developers canwrite own plugins
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 17
Static Analysis for Hybrid Apps Building a Unified Call Graph
Our approachanalyze plugins but model the Cordova framework
First build call graphs of Java and JavaScript separatly
Connect them using four heuristics that exploit frequent coding patterns
if (findequals(action)) String name = argsget(0)namefind(name callbackContext)
else if (createequals(action)) void find(String name CallbackContext callbackContext)
Contact contact = query(SELECT where name= + name)callbackContextsuccess(contact)
Problem
How to determine the targets of the callbackContext calls
Can we use the pattern of the action usage
Solution
Determine which callbackContext calls are reachableAD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 23
Static Analysis for Hybrid Apps Building a Unified Call Graph
FilterJavaCallSites details
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 24
Static Analysis for Hybrid Apps Building a Unified Call Graph
FilterJavaCallSites details
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 24
Static Analysis for Hybrid Apps Building a Unified Call Graph
FilterJavaCallSites details
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 24
Static Analysis for Hybrid Apps Building a Unified Call Graph
FilterJavaCallSites results
Developers all use action variable similarly
Therefore Many incorrect edges avoided
But A few calls from Java to JavaScript are missed now
Some store the callbackContext and call asynchronously
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 25
Outline
1 Motivation Hybrid Mobile Apps and their Security Challenges
2 Real World Cordova Usage
3 Static Analysis for Hybrid Apps Building a Unified Call Graph
4 Quality of the Unified Call Graph
5 Conclusions
Quality of the Unified Call Graph
What we have learned app size and cross-language calls
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 28
Outline
1 Motivation Hybrid Mobile Apps and their Security Challenges
2 Real World Cordova Usage
3 Static Analysis for Hybrid Apps Building a Unified Call Graph
4 Quality of the Unified Call Graph
5 Conclusions
Conclusions
Summary
Hybrid mobile apps are getting more popular
they are recommended at SAP
Hybrid mobile apps are juicy targets
Eg gain access to the app via the JS part and use the apprsquos permissions to steal data
Unified Call Graph is a first step in bringing the full power of SAST to hybrid apps
Quality largely depends on used call graph builders
Future work Data-flow analysis on top of Unified Call Graph
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 30
Thank you for your attentionAny questions or remarks
Conclusions
Bibliography
Achim D Brucker and Michael Herzberg
On the static analysis of hybrid mobile apps A report on the state of apache cordova nation
In Juan Caballero and Eric Bodden editors International Symposium on Engineering Secure Software and Systems(ESSoS) Lecture Notes in Computer Science Springer-Verlag 2016
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 32
Motivation Hybrid Mobile Apps and their Security Challenges
Real World Cordova Usage
Static Analysis for Hybrid Apps Building a Unified Call Graph
Quality of the Unified Call Graph
Conclusions
Outline
1 Motivation Hybrid Mobile Apps and their Security Challenges
2 Real World Cordova Usage
3 Static Analysis for Hybrid Apps Building a Unified Call Graph
4 Quality of the Unified Call Graph
5 Conclusions
Static Analysis for Hybrid Apps Building a Unified Call Graph
Challenges
Based on the examined apps
Cordova relies heavily on dynamic mechanisms both on JavaScript and Java side
Developers modify their plugins and sometimes implement their own
Deep framework analysis Modelling framework Modelling plugins
Closest to the actualprogram
But Framework veryexpensive
Models the Cordovaframework
Analyses plugins
Models both frameworkand plugins
Analyses only UI andbusiness logic part
But Developers canwrite own plugins
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 17
Static Analysis for Hybrid Apps Building a Unified Call Graph
Our approachanalyze plugins but model the Cordova framework
First build call graphs of Java and JavaScript separatly
Connect them using four heuristics that exploit frequent coding patterns
if (findequals(action)) String name = argsget(0)namefind(name callbackContext)
else if (createequals(action)) void find(String name CallbackContext callbackContext)
Contact contact = query(SELECT where name= + name)callbackContextsuccess(contact)
Problem
How to determine the targets of the callbackContext calls
Can we use the pattern of the action usage
Solution
Determine which callbackContext calls are reachableAD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 23
Static Analysis for Hybrid Apps Building a Unified Call Graph
FilterJavaCallSites details
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 24
Static Analysis for Hybrid Apps Building a Unified Call Graph
FilterJavaCallSites details
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 24
Static Analysis for Hybrid Apps Building a Unified Call Graph
FilterJavaCallSites details
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 24
Static Analysis for Hybrid Apps Building a Unified Call Graph
FilterJavaCallSites results
Developers all use action variable similarly
Therefore Many incorrect edges avoided
But A few calls from Java to JavaScript are missed now
Some store the callbackContext and call asynchronously
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 25
Outline
1 Motivation Hybrid Mobile Apps and their Security Challenges
2 Real World Cordova Usage
3 Static Analysis for Hybrid Apps Building a Unified Call Graph
4 Quality of the Unified Call Graph
5 Conclusions
Quality of the Unified Call Graph
What we have learned app size and cross-language calls
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 28
Outline
1 Motivation Hybrid Mobile Apps and their Security Challenges
2 Real World Cordova Usage
3 Static Analysis for Hybrid Apps Building a Unified Call Graph
4 Quality of the Unified Call Graph
5 Conclusions
Conclusions
Summary
Hybrid mobile apps are getting more popular
they are recommended at SAP
Hybrid mobile apps are juicy targets
Eg gain access to the app via the JS part and use the apprsquos permissions to steal data
Unified Call Graph is a first step in bringing the full power of SAST to hybrid apps
Quality largely depends on used call graph builders
Future work Data-flow analysis on top of Unified Call Graph
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 30
Thank you for your attentionAny questions or remarks
Conclusions
Bibliography
Achim D Brucker and Michael Herzberg
On the static analysis of hybrid mobile apps A report on the state of apache cordova nation
In Juan Caballero and Eric Bodden editors International Symposium on Engineering Secure Software and Systems(ESSoS) Lecture Notes in Computer Science Springer-Verlag 2016
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 32
Motivation Hybrid Mobile Apps and their Security Challenges
Real World Cordova Usage
Static Analysis for Hybrid Apps Building a Unified Call Graph
Quality of the Unified Call Graph
Conclusions
Static Analysis for Hybrid Apps Building a Unified Call Graph
Challenges
Based on the examined apps
Cordova relies heavily on dynamic mechanisms both on JavaScript and Java side
Developers modify their plugins and sometimes implement their own
Deep framework analysis Modelling framework Modelling plugins
Closest to the actualprogram
But Framework veryexpensive
Models the Cordovaframework
Analyses plugins
Models both frameworkand plugins
Analyses only UI andbusiness logic part
But Developers canwrite own plugins
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 17
Static Analysis for Hybrid Apps Building a Unified Call Graph
Our approachanalyze plugins but model the Cordova framework
First build call graphs of Java and JavaScript separatly
Connect them using four heuristics that exploit frequent coding patterns
if (findequals(action)) String name = argsget(0)namefind(name callbackContext)
else if (createequals(action)) void find(String name CallbackContext callbackContext)
Contact contact = query(SELECT where name= + name)callbackContextsuccess(contact)
Problem
How to determine the targets of the callbackContext calls
Can we use the pattern of the action usage
Solution
Determine which callbackContext calls are reachableAD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 23
Static Analysis for Hybrid Apps Building a Unified Call Graph
FilterJavaCallSites details
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 24
Static Analysis for Hybrid Apps Building a Unified Call Graph
FilterJavaCallSites details
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 24
Static Analysis for Hybrid Apps Building a Unified Call Graph
FilterJavaCallSites details
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 24
Static Analysis for Hybrid Apps Building a Unified Call Graph
FilterJavaCallSites results
Developers all use action variable similarly
Therefore Many incorrect edges avoided
But A few calls from Java to JavaScript are missed now
Some store the callbackContext and call asynchronously
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 25
Outline
1 Motivation Hybrid Mobile Apps and their Security Challenges
2 Real World Cordova Usage
3 Static Analysis for Hybrid Apps Building a Unified Call Graph
4 Quality of the Unified Call Graph
5 Conclusions
Quality of the Unified Call Graph
What we have learned app size and cross-language calls
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 28
Outline
1 Motivation Hybrid Mobile Apps and their Security Challenges
2 Real World Cordova Usage
3 Static Analysis for Hybrid Apps Building a Unified Call Graph
4 Quality of the Unified Call Graph
5 Conclusions
Conclusions
Summary
Hybrid mobile apps are getting more popular
they are recommended at SAP
Hybrid mobile apps are juicy targets
Eg gain access to the app via the JS part and use the apprsquos permissions to steal data
Unified Call Graph is a first step in bringing the full power of SAST to hybrid apps
Quality largely depends on used call graph builders
Future work Data-flow analysis on top of Unified Call Graph
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 30
Thank you for your attentionAny questions or remarks
Conclusions
Bibliography
Achim D Brucker and Michael Herzberg
On the static analysis of hybrid mobile apps A report on the state of apache cordova nation
In Juan Caballero and Eric Bodden editors International Symposium on Engineering Secure Software and Systems(ESSoS) Lecture Notes in Computer Science Springer-Verlag 2016
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 32
Motivation Hybrid Mobile Apps and their Security Challenges
Real World Cordova Usage
Static Analysis for Hybrid Apps Building a Unified Call Graph
Quality of the Unified Call Graph
Conclusions
Static Analysis for Hybrid Apps Building a Unified Call Graph
Our approachanalyze plugins but model the Cordova framework
First build call graphs of Java and JavaScript separatly
Connect them using four heuristics that exploit frequent coding patterns
if (findequals(action)) String name = argsget(0)namefind(name callbackContext)
else if (createequals(action)) void find(String name CallbackContext callbackContext)
Contact contact = query(SELECT where name= + name)callbackContextsuccess(contact)
Problem
How to determine the targets of the callbackContext calls
Can we use the pattern of the action usage
Solution
Determine which callbackContext calls are reachableAD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 23
Static Analysis for Hybrid Apps Building a Unified Call Graph
FilterJavaCallSites details
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 24
Static Analysis for Hybrid Apps Building a Unified Call Graph
FilterJavaCallSites details
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 24
Static Analysis for Hybrid Apps Building a Unified Call Graph
FilterJavaCallSites details
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 24
Static Analysis for Hybrid Apps Building a Unified Call Graph
FilterJavaCallSites results
Developers all use action variable similarly
Therefore Many incorrect edges avoided
But A few calls from Java to JavaScript are missed now
Some store the callbackContext and call asynchronously
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 25
Outline
1 Motivation Hybrid Mobile Apps and their Security Challenges
2 Real World Cordova Usage
3 Static Analysis for Hybrid Apps Building a Unified Call Graph
4 Quality of the Unified Call Graph
5 Conclusions
Quality of the Unified Call Graph
What we have learned app size and cross-language calls
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 28
Outline
1 Motivation Hybrid Mobile Apps and their Security Challenges
2 Real World Cordova Usage
3 Static Analysis for Hybrid Apps Building a Unified Call Graph
4 Quality of the Unified Call Graph
5 Conclusions
Conclusions
Summary
Hybrid mobile apps are getting more popular
they are recommended at SAP
Hybrid mobile apps are juicy targets
Eg gain access to the app via the JS part and use the apprsquos permissions to steal data
Unified Call Graph is a first step in bringing the full power of SAST to hybrid apps
Quality largely depends on used call graph builders
Future work Data-flow analysis on top of Unified Call Graph
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 30
Thank you for your attentionAny questions or remarks
Conclusions
Bibliography
Achim D Brucker and Michael Herzberg
On the static analysis of hybrid mobile apps A report on the state of apache cordova nation
In Juan Caballero and Eric Bodden editors International Symposium on Engineering Secure Software and Systems(ESSoS) Lecture Notes in Computer Science Springer-Verlag 2016
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 32
Motivation Hybrid Mobile Apps and their Security Challenges
Real World Cordova Usage
Static Analysis for Hybrid Apps Building a Unified Call Graph
Quality of the Unified Call Graph
Conclusions
Static Analysis for Hybrid Apps Building a Unified Call Graph
if (findequals(action)) String name = argsget(0)namefind(name callbackContext)
else if (createequals(action)) void find(String name CallbackContext callbackContext)
Contact contact = query(SELECT where name= + name)callbackContextsuccess(contact)
Problem
How to determine the targets of the callbackContext calls
Can we use the pattern of the action usage
Solution
Determine which callbackContext calls are reachableAD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 23
Static Analysis for Hybrid Apps Building a Unified Call Graph
FilterJavaCallSites details
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 24
Static Analysis for Hybrid Apps Building a Unified Call Graph
FilterJavaCallSites details
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 24
Static Analysis for Hybrid Apps Building a Unified Call Graph
FilterJavaCallSites details
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 24
Static Analysis for Hybrid Apps Building a Unified Call Graph
FilterJavaCallSites results
Developers all use action variable similarly
Therefore Many incorrect edges avoided
But A few calls from Java to JavaScript are missed now
Some store the callbackContext and call asynchronously
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 25
Outline
1 Motivation Hybrid Mobile Apps and their Security Challenges
2 Real World Cordova Usage
3 Static Analysis for Hybrid Apps Building a Unified Call Graph
4 Quality of the Unified Call Graph
5 Conclusions
Quality of the Unified Call Graph
What we have learned app size and cross-language calls
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 28
Outline
1 Motivation Hybrid Mobile Apps and their Security Challenges
2 Real World Cordova Usage
3 Static Analysis for Hybrid Apps Building a Unified Call Graph
4 Quality of the Unified Call Graph
5 Conclusions
Conclusions
Summary
Hybrid mobile apps are getting more popular
they are recommended at SAP
Hybrid mobile apps are juicy targets
Eg gain access to the app via the JS part and use the apprsquos permissions to steal data
Unified Call Graph is a first step in bringing the full power of SAST to hybrid apps
Quality largely depends on used call graph builders
Future work Data-flow analysis on top of Unified Call Graph
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 30
Thank you for your attentionAny questions or remarks
Conclusions
Bibliography
Achim D Brucker and Michael Herzberg
On the static analysis of hybrid mobile apps A report on the state of apache cordova nation
In Juan Caballero and Eric Bodden editors International Symposium on Engineering Secure Software and Systems(ESSoS) Lecture Notes in Computer Science Springer-Verlag 2016
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 32
Motivation Hybrid Mobile Apps and their Security Challenges
Real World Cordova Usage
Static Analysis for Hybrid Apps Building a Unified Call Graph
Quality of the Unified Call Graph
Conclusions
Static Analysis for Hybrid Apps Building a Unified Call Graph
if (findequals(action)) String name = argsget(0)namefind(name callbackContext)
else if (createequals(action)) void find(String name CallbackContext callbackContext)
Contact contact = query(SELECT where name= + name)callbackContextsuccess(contact)
Problem
How to determine the targets of the callbackContext calls
Can we use the pattern of the action usage
Solution
Determine which callbackContext calls are reachableAD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 23
Static Analysis for Hybrid Apps Building a Unified Call Graph
FilterJavaCallSites details
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 24
Static Analysis for Hybrid Apps Building a Unified Call Graph
FilterJavaCallSites details
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 24
Static Analysis for Hybrid Apps Building a Unified Call Graph
FilterJavaCallSites details
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 24
Static Analysis for Hybrid Apps Building a Unified Call Graph
FilterJavaCallSites results
Developers all use action variable similarly
Therefore Many incorrect edges avoided
But A few calls from Java to JavaScript are missed now
Some store the callbackContext and call asynchronously
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 25
Outline
1 Motivation Hybrid Mobile Apps and their Security Challenges
2 Real World Cordova Usage
3 Static Analysis for Hybrid Apps Building a Unified Call Graph
4 Quality of the Unified Call Graph
5 Conclusions
Quality of the Unified Call Graph
What we have learned app size and cross-language calls
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 28
Outline
1 Motivation Hybrid Mobile Apps and their Security Challenges
2 Real World Cordova Usage
3 Static Analysis for Hybrid Apps Building a Unified Call Graph
4 Quality of the Unified Call Graph
5 Conclusions
Conclusions
Summary
Hybrid mobile apps are getting more popular
they are recommended at SAP
Hybrid mobile apps are juicy targets
Eg gain access to the app via the JS part and use the apprsquos permissions to steal data
Unified Call Graph is a first step in bringing the full power of SAST to hybrid apps
Quality largely depends on used call graph builders
Future work Data-flow analysis on top of Unified Call Graph
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 30
Thank you for your attentionAny questions or remarks
Conclusions
Bibliography
Achim D Brucker and Michael Herzberg
On the static analysis of hybrid mobile apps A report on the state of apache cordova nation
In Juan Caballero and Eric Bodden editors International Symposium on Engineering Secure Software and Systems(ESSoS) Lecture Notes in Computer Science Springer-Verlag 2016
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 32
Motivation Hybrid Mobile Apps and their Security Challenges
Real World Cordova Usage
Static Analysis for Hybrid Apps Building a Unified Call Graph
Quality of the Unified Call Graph
Conclusions
Static Analysis for Hybrid Apps Building a Unified Call Graph
ConvertModules Results
Most useful for
small pluginsmore precise analysis
Allows finding of callback functions in app code
Less errors due to less ambiguity of dynamic mechanism
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 20
Static Analysis for Hybrid Apps Building a Unified Call Graph
ReplaceCordovaExec
function showPhoneNumber(name) var successCallback = function(contact)
if (findequals(action)) String name = argsget(0)namefind(name callbackContext)
else if (createequals(action)) void find(String name CallbackContext callbackContext)
Contact contact = query(SELECT where name= + name)callbackContextsuccess(contact)
Problem
How to determine the targets of the callbackContext calls
Can we use the pattern of the action usage
Solution
Determine which callbackContext calls are reachableAD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 23
Static Analysis for Hybrid Apps Building a Unified Call Graph
FilterJavaCallSites details
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 24
Static Analysis for Hybrid Apps Building a Unified Call Graph
FilterJavaCallSites details
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 24
Static Analysis for Hybrid Apps Building a Unified Call Graph
FilterJavaCallSites details
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 24
Static Analysis for Hybrid Apps Building a Unified Call Graph
FilterJavaCallSites results
Developers all use action variable similarly
Therefore Many incorrect edges avoided
But A few calls from Java to JavaScript are missed now
Some store the callbackContext and call asynchronously
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 25
Outline
1 Motivation Hybrid Mobile Apps and their Security Challenges
2 Real World Cordova Usage
3 Static Analysis for Hybrid Apps Building a Unified Call Graph
4 Quality of the Unified Call Graph
5 Conclusions
Quality of the Unified Call Graph
What we have learned app size and cross-language calls
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 28
Outline
1 Motivation Hybrid Mobile Apps and their Security Challenges
2 Real World Cordova Usage
3 Static Analysis for Hybrid Apps Building a Unified Call Graph
4 Quality of the Unified Call Graph
5 Conclusions
Conclusions
Summary
Hybrid mobile apps are getting more popular
they are recommended at SAP
Hybrid mobile apps are juicy targets
Eg gain access to the app via the JS part and use the apprsquos permissions to steal data
Unified Call Graph is a first step in bringing the full power of SAST to hybrid apps
Quality largely depends on used call graph builders
Future work Data-flow analysis on top of Unified Call Graph
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 30
Thank you for your attentionAny questions or remarks
Conclusions
Bibliography
Achim D Brucker and Michael Herzberg
On the static analysis of hybrid mobile apps A report on the state of apache cordova nation
In Juan Caballero and Eric Bodden editors International Symposium on Engineering Secure Software and Systems(ESSoS) Lecture Notes in Computer Science Springer-Verlag 2016
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 32
Motivation Hybrid Mobile Apps and their Security Challenges
Real World Cordova Usage
Static Analysis for Hybrid Apps Building a Unified Call Graph
Quality of the Unified Call Graph
Conclusions
Static Analysis for Hybrid Apps Building a Unified Call Graph
ReplaceCordovaExec
function showPhoneNumber(name) var successCallback = function(contact)
if (findequals(action)) String name = argsget(0)namefind(name callbackContext)
else if (createequals(action)) void find(String name CallbackContext callbackContext)
Contact contact = query(SELECT where name= + name)callbackContextsuccess(contact)
Problem
How to determine the targets of the callbackContext calls
Can we use the pattern of the action usage
Solution
Determine which callbackContext calls are reachableAD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 23
Static Analysis for Hybrid Apps Building a Unified Call Graph
FilterJavaCallSites details
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 24
Static Analysis for Hybrid Apps Building a Unified Call Graph
FilterJavaCallSites details
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 24
Static Analysis for Hybrid Apps Building a Unified Call Graph
FilterJavaCallSites details
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 24
Static Analysis for Hybrid Apps Building a Unified Call Graph
FilterJavaCallSites results
Developers all use action variable similarly
Therefore Many incorrect edges avoided
But A few calls from Java to JavaScript are missed now
Some store the callbackContext and call asynchronously
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 25
Outline
1 Motivation Hybrid Mobile Apps and their Security Challenges
2 Real World Cordova Usage
3 Static Analysis for Hybrid Apps Building a Unified Call Graph
4 Quality of the Unified Call Graph
5 Conclusions
Quality of the Unified Call Graph
What we have learned app size and cross-language calls
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 28
Outline
1 Motivation Hybrid Mobile Apps and their Security Challenges
2 Real World Cordova Usage
3 Static Analysis for Hybrid Apps Building a Unified Call Graph
4 Quality of the Unified Call Graph
5 Conclusions
Conclusions
Summary
Hybrid mobile apps are getting more popular
they are recommended at SAP
Hybrid mobile apps are juicy targets
Eg gain access to the app via the JS part and use the apprsquos permissions to steal data
Unified Call Graph is a first step in bringing the full power of SAST to hybrid apps
Quality largely depends on used call graph builders
Future work Data-flow analysis on top of Unified Call Graph
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 30
Thank you for your attentionAny questions or remarks
Conclusions
Bibliography
Achim D Brucker and Michael Herzberg
On the static analysis of hybrid mobile apps A report on the state of apache cordova nation
In Juan Caballero and Eric Bodden editors International Symposium on Engineering Secure Software and Systems(ESSoS) Lecture Notes in Computer Science Springer-Verlag 2016
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 32
Motivation Hybrid Mobile Apps and their Security Challenges
Real World Cordova Usage
Static Analysis for Hybrid Apps Building a Unified Call Graph
Quality of the Unified Call Graph
Conclusions
Static Analysis for Hybrid Apps Building a Unified Call Graph
ReplaceCordovaExec
function showPhoneNumber(name) var successCallback = function(contact)
alert(Phone number +contactsphone)function stub1(succ fail)
if (findequals(action)) String name = argsget(0)namefind(name callbackContext)
else if (createequals(action)) void find(String name CallbackContext callbackContext)
Contact contact = query(SELECT where name= + name)callbackContextsuccess(contact)
Problem
How to determine the targets of the callbackContext calls
Can we use the pattern of the action usage
Solution
Determine which callbackContext calls are reachableAD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 23
Static Analysis for Hybrid Apps Building a Unified Call Graph
FilterJavaCallSites details
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 24
Static Analysis for Hybrid Apps Building a Unified Call Graph
FilterJavaCallSites details
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 24
Static Analysis for Hybrid Apps Building a Unified Call Graph
FilterJavaCallSites details
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 24
Static Analysis for Hybrid Apps Building a Unified Call Graph
FilterJavaCallSites results
Developers all use action variable similarly
Therefore Many incorrect edges avoided
But A few calls from Java to JavaScript are missed now
Some store the callbackContext and call asynchronously
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 25
Outline
1 Motivation Hybrid Mobile Apps and their Security Challenges
2 Real World Cordova Usage
3 Static Analysis for Hybrid Apps Building a Unified Call Graph
4 Quality of the Unified Call Graph
5 Conclusions
Quality of the Unified Call Graph
What we have learned app size and cross-language calls
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 28
Outline
1 Motivation Hybrid Mobile Apps and their Security Challenges
2 Real World Cordova Usage
3 Static Analysis for Hybrid Apps Building a Unified Call Graph
4 Quality of the Unified Call Graph
5 Conclusions
Conclusions
Summary
Hybrid mobile apps are getting more popular
they are recommended at SAP
Hybrid mobile apps are juicy targets
Eg gain access to the app via the JS part and use the apprsquos permissions to steal data
Unified Call Graph is a first step in bringing the full power of SAST to hybrid apps
Quality largely depends on used call graph builders
Future work Data-flow analysis on top of Unified Call Graph
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 30
Thank you for your attentionAny questions or remarks
Conclusions
Bibliography
Achim D Brucker and Michael Herzberg
On the static analysis of hybrid mobile apps A report on the state of apache cordova nation
In Juan Caballero and Eric Bodden editors International Symposium on Engineering Secure Software and Systems(ESSoS) Lecture Notes in Computer Science Springer-Verlag 2016
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 32
Motivation Hybrid Mobile Apps and their Security Challenges
Real World Cordova Usage
Static Analysis for Hybrid Apps Building a Unified Call Graph
Quality of the Unified Call Graph
Conclusions
Static Analysis for Hybrid Apps Building a Unified Call Graph
ReplaceCordovaExec Results
Neccessary to find any Java to JavaScript calls
Most apps use exec to communicate only some bypass it
Inexpensive way to get context-sensitivity where it is needed the most
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 22
Static Analysis for Hybrid Apps Building a Unified Call Graph
if (findequals(action)) String name = argsget(0)namefind(name callbackContext)
else if (createequals(action)) void find(String name CallbackContext callbackContext)
Contact contact = query(SELECT where name= + name)callbackContextsuccess(contact)
Problem
How to determine the targets of the callbackContext calls
Can we use the pattern of the action usage
Solution
Determine which callbackContext calls are reachableAD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 23
Static Analysis for Hybrid Apps Building a Unified Call Graph
FilterJavaCallSites details
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 24
Static Analysis for Hybrid Apps Building a Unified Call Graph
FilterJavaCallSites details
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 24
Static Analysis for Hybrid Apps Building a Unified Call Graph
FilterJavaCallSites details
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 24
Static Analysis for Hybrid Apps Building a Unified Call Graph
FilterJavaCallSites results
Developers all use action variable similarly
Therefore Many incorrect edges avoided
But A few calls from Java to JavaScript are missed now
Some store the callbackContext and call asynchronously
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 25
Outline
1 Motivation Hybrid Mobile Apps and their Security Challenges
2 Real World Cordova Usage
3 Static Analysis for Hybrid Apps Building a Unified Call Graph
4 Quality of the Unified Call Graph
5 Conclusions
Quality of the Unified Call Graph
What we have learned app size and cross-language calls
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 28
Outline
1 Motivation Hybrid Mobile Apps and their Security Challenges
2 Real World Cordova Usage
3 Static Analysis for Hybrid Apps Building a Unified Call Graph
4 Quality of the Unified Call Graph
5 Conclusions
Conclusions
Summary
Hybrid mobile apps are getting more popular
they are recommended at SAP
Hybrid mobile apps are juicy targets
Eg gain access to the app via the JS part and use the apprsquos permissions to steal data
Unified Call Graph is a first step in bringing the full power of SAST to hybrid apps
Quality largely depends on used call graph builders
Future work Data-flow analysis on top of Unified Call Graph
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 30
Thank you for your attentionAny questions or remarks
Conclusions
Bibliography
Achim D Brucker and Michael Herzberg
On the static analysis of hybrid mobile apps A report on the state of apache cordova nation
In Juan Caballero and Eric Bodden editors International Symposium on Engineering Secure Software and Systems(ESSoS) Lecture Notes in Computer Science Springer-Verlag 2016
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 32
Motivation Hybrid Mobile Apps and their Security Challenges
Real World Cordova Usage
Static Analysis for Hybrid Apps Building a Unified Call Graph
Quality of the Unified Call Graph
Conclusions
Static Analysis for Hybrid Apps Building a Unified Call Graph
if (findequals(action)) String name = argsget(0)namefind(name callbackContext)
else if (createequals(action)) void find(String name CallbackContext callbackContext)
Contact contact = query(SELECT where name= + name)callbackContextsuccess(contact)
Problem
How to determine the targets of the callbackContext calls
Can we use the pattern of the action usage
Solution
Determine which callbackContext calls are reachableAD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 23
Static Analysis for Hybrid Apps Building a Unified Call Graph
FilterJavaCallSites details
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 24
Static Analysis for Hybrid Apps Building a Unified Call Graph
FilterJavaCallSites details
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 24
Static Analysis for Hybrid Apps Building a Unified Call Graph
FilterJavaCallSites details
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 24
Static Analysis for Hybrid Apps Building a Unified Call Graph
FilterJavaCallSites results
Developers all use action variable similarly
Therefore Many incorrect edges avoided
But A few calls from Java to JavaScript are missed now
Some store the callbackContext and call asynchronously
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 25
Outline
1 Motivation Hybrid Mobile Apps and their Security Challenges
2 Real World Cordova Usage
3 Static Analysis for Hybrid Apps Building a Unified Call Graph
4 Quality of the Unified Call Graph
5 Conclusions
Quality of the Unified Call Graph
What we have learned app size and cross-language calls
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 28
Outline
1 Motivation Hybrid Mobile Apps and their Security Challenges
2 Real World Cordova Usage
3 Static Analysis for Hybrid Apps Building a Unified Call Graph
4 Quality of the Unified Call Graph
5 Conclusions
Conclusions
Summary
Hybrid mobile apps are getting more popular
they are recommended at SAP
Hybrid mobile apps are juicy targets
Eg gain access to the app via the JS part and use the apprsquos permissions to steal data
Unified Call Graph is a first step in bringing the full power of SAST to hybrid apps
Quality largely depends on used call graph builders
Future work Data-flow analysis on top of Unified Call Graph
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 30
Thank you for your attentionAny questions or remarks
Conclusions
Bibliography
Achim D Brucker and Michael Herzberg
On the static analysis of hybrid mobile apps A report on the state of apache cordova nation
In Juan Caballero and Eric Bodden editors International Symposium on Engineering Secure Software and Systems(ESSoS) Lecture Notes in Computer Science Springer-Verlag 2016
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 32
Motivation Hybrid Mobile Apps and their Security Challenges
Real World Cordova Usage
Static Analysis for Hybrid Apps Building a Unified Call Graph
Quality of the Unified Call Graph
Conclusions
Static Analysis for Hybrid Apps Building a Unified Call Graph
FilterJavaCallSites details
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 24
Static Analysis for Hybrid Apps Building a Unified Call Graph
FilterJavaCallSites details
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 24
Static Analysis for Hybrid Apps Building a Unified Call Graph
FilterJavaCallSites details
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 24
Static Analysis for Hybrid Apps Building a Unified Call Graph
FilterJavaCallSites results
Developers all use action variable similarly
Therefore Many incorrect edges avoided
But A few calls from Java to JavaScript are missed now
Some store the callbackContext and call asynchronously
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 25
Outline
1 Motivation Hybrid Mobile Apps and their Security Challenges
2 Real World Cordova Usage
3 Static Analysis for Hybrid Apps Building a Unified Call Graph
4 Quality of the Unified Call Graph
5 Conclusions
Quality of the Unified Call Graph
What we have learned app size and cross-language calls
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 28
Outline
1 Motivation Hybrid Mobile Apps and their Security Challenges
2 Real World Cordova Usage
3 Static Analysis for Hybrid Apps Building a Unified Call Graph
4 Quality of the Unified Call Graph
5 Conclusions
Conclusions
Summary
Hybrid mobile apps are getting more popular
they are recommended at SAP
Hybrid mobile apps are juicy targets
Eg gain access to the app via the JS part and use the apprsquos permissions to steal data
Unified Call Graph is a first step in bringing the full power of SAST to hybrid apps
Quality largely depends on used call graph builders
Future work Data-flow analysis on top of Unified Call Graph
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 30
Thank you for your attentionAny questions or remarks
Conclusions
Bibliography
Achim D Brucker and Michael Herzberg
On the static analysis of hybrid mobile apps A report on the state of apache cordova nation
In Juan Caballero and Eric Bodden editors International Symposium on Engineering Secure Software and Systems(ESSoS) Lecture Notes in Computer Science Springer-Verlag 2016
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 32
Motivation Hybrid Mobile Apps and their Security Challenges
Real World Cordova Usage
Static Analysis for Hybrid Apps Building a Unified Call Graph
Quality of the Unified Call Graph
Conclusions
Static Analysis for Hybrid Apps Building a Unified Call Graph
FilterJavaCallSites details
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 24
Static Analysis for Hybrid Apps Building a Unified Call Graph
FilterJavaCallSites details
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 24
Static Analysis for Hybrid Apps Building a Unified Call Graph
FilterJavaCallSites results
Developers all use action variable similarly
Therefore Many incorrect edges avoided
But A few calls from Java to JavaScript are missed now
Some store the callbackContext and call asynchronously
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 25
Outline
1 Motivation Hybrid Mobile Apps and their Security Challenges
2 Real World Cordova Usage
3 Static Analysis for Hybrid Apps Building a Unified Call Graph
4 Quality of the Unified Call Graph
5 Conclusions
Quality of the Unified Call Graph
What we have learned app size and cross-language calls
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 28
Outline
1 Motivation Hybrid Mobile Apps and their Security Challenges
2 Real World Cordova Usage
3 Static Analysis for Hybrid Apps Building a Unified Call Graph
4 Quality of the Unified Call Graph
5 Conclusions
Conclusions
Summary
Hybrid mobile apps are getting more popular
they are recommended at SAP
Hybrid mobile apps are juicy targets
Eg gain access to the app via the JS part and use the apprsquos permissions to steal data
Unified Call Graph is a first step in bringing the full power of SAST to hybrid apps
Quality largely depends on used call graph builders
Future work Data-flow analysis on top of Unified Call Graph
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 30
Thank you for your attentionAny questions or remarks
Conclusions
Bibliography
Achim D Brucker and Michael Herzberg
On the static analysis of hybrid mobile apps A report on the state of apache cordova nation
In Juan Caballero and Eric Bodden editors International Symposium on Engineering Secure Software and Systems(ESSoS) Lecture Notes in Computer Science Springer-Verlag 2016
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 32
Motivation Hybrid Mobile Apps and their Security Challenges
Real World Cordova Usage
Static Analysis for Hybrid Apps Building a Unified Call Graph
Quality of the Unified Call Graph
Conclusions
Static Analysis for Hybrid Apps Building a Unified Call Graph
FilterJavaCallSites details
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 24
Static Analysis for Hybrid Apps Building a Unified Call Graph
FilterJavaCallSites results
Developers all use action variable similarly
Therefore Many incorrect edges avoided
But A few calls from Java to JavaScript are missed now
Some store the callbackContext and call asynchronously
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 25
Outline
1 Motivation Hybrid Mobile Apps and their Security Challenges
2 Real World Cordova Usage
3 Static Analysis for Hybrid Apps Building a Unified Call Graph
4 Quality of the Unified Call Graph
5 Conclusions
Quality of the Unified Call Graph
What we have learned app size and cross-language calls
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 28
Outline
1 Motivation Hybrid Mobile Apps and their Security Challenges
2 Real World Cordova Usage
3 Static Analysis for Hybrid Apps Building a Unified Call Graph
4 Quality of the Unified Call Graph
5 Conclusions
Conclusions
Summary
Hybrid mobile apps are getting more popular
they are recommended at SAP
Hybrid mobile apps are juicy targets
Eg gain access to the app via the JS part and use the apprsquos permissions to steal data
Unified Call Graph is a first step in bringing the full power of SAST to hybrid apps
Quality largely depends on used call graph builders
Future work Data-flow analysis on top of Unified Call Graph
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 30
Thank you for your attentionAny questions or remarks
Conclusions
Bibliography
Achim D Brucker and Michael Herzberg
On the static analysis of hybrid mobile apps A report on the state of apache cordova nation
In Juan Caballero and Eric Bodden editors International Symposium on Engineering Secure Software and Systems(ESSoS) Lecture Notes in Computer Science Springer-Verlag 2016
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 32
Motivation Hybrid Mobile Apps and their Security Challenges
Real World Cordova Usage
Static Analysis for Hybrid Apps Building a Unified Call Graph
Quality of the Unified Call Graph
Conclusions
Static Analysis for Hybrid Apps Building a Unified Call Graph
FilterJavaCallSites results
Developers all use action variable similarly
Therefore Many incorrect edges avoided
But A few calls from Java to JavaScript are missed now
Some store the callbackContext and call asynchronously
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 25
Outline
1 Motivation Hybrid Mobile Apps and their Security Challenges
2 Real World Cordova Usage
3 Static Analysis for Hybrid Apps Building a Unified Call Graph
4 Quality of the Unified Call Graph
5 Conclusions
Quality of the Unified Call Graph
What we have learned app size and cross-language calls
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 28
Outline
1 Motivation Hybrid Mobile Apps and their Security Challenges
2 Real World Cordova Usage
3 Static Analysis for Hybrid Apps Building a Unified Call Graph
4 Quality of the Unified Call Graph
5 Conclusions
Conclusions
Summary
Hybrid mobile apps are getting more popular
they are recommended at SAP
Hybrid mobile apps are juicy targets
Eg gain access to the app via the JS part and use the apprsquos permissions to steal data
Unified Call Graph is a first step in bringing the full power of SAST to hybrid apps
Quality largely depends on used call graph builders
Future work Data-flow analysis on top of Unified Call Graph
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 30
Thank you for your attentionAny questions or remarks
Conclusions
Bibliography
Achim D Brucker and Michael Herzberg
On the static analysis of hybrid mobile apps A report on the state of apache cordova nation
In Juan Caballero and Eric Bodden editors International Symposium on Engineering Secure Software and Systems(ESSoS) Lecture Notes in Computer Science Springer-Verlag 2016
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 32
Motivation Hybrid Mobile Apps and their Security Challenges
Real World Cordova Usage
Static Analysis for Hybrid Apps Building a Unified Call Graph
Quality of the Unified Call Graph
Conclusions
Outline
1 Motivation Hybrid Mobile Apps and their Security Challenges
2 Real World Cordova Usage
3 Static Analysis for Hybrid Apps Building a Unified Call Graph
4 Quality of the Unified Call Graph
5 Conclusions
Quality of the Unified Call Graph
What we have learned app size and cross-language calls
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 28
Outline
1 Motivation Hybrid Mobile Apps and their Security Challenges
2 Real World Cordova Usage
3 Static Analysis for Hybrid Apps Building a Unified Call Graph
4 Quality of the Unified Call Graph
5 Conclusions
Conclusions
Summary
Hybrid mobile apps are getting more popular
they are recommended at SAP
Hybrid mobile apps are juicy targets
Eg gain access to the app via the JS part and use the apprsquos permissions to steal data
Unified Call Graph is a first step in bringing the full power of SAST to hybrid apps
Quality largely depends on used call graph builders
Future work Data-flow analysis on top of Unified Call Graph
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 30
Thank you for your attentionAny questions or remarks
Conclusions
Bibliography
Achim D Brucker and Michael Herzberg
On the static analysis of hybrid mobile apps A report on the state of apache cordova nation
In Juan Caballero and Eric Bodden editors International Symposium on Engineering Secure Software and Systems(ESSoS) Lecture Notes in Computer Science Springer-Verlag 2016
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 32
Motivation Hybrid Mobile Apps and their Security Challenges
Real World Cordova Usage
Static Analysis for Hybrid Apps Building a Unified Call Graph
Quality of the Unified Call Graph
Conclusions
Quality of the Unified Call Graph
What we have learned app size and cross-language calls
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 28
Outline
1 Motivation Hybrid Mobile Apps and their Security Challenges
2 Real World Cordova Usage
3 Static Analysis for Hybrid Apps Building a Unified Call Graph
4 Quality of the Unified Call Graph
5 Conclusions
Conclusions
Summary
Hybrid mobile apps are getting more popular
they are recommended at SAP
Hybrid mobile apps are juicy targets
Eg gain access to the app via the JS part and use the apprsquos permissions to steal data
Unified Call Graph is a first step in bringing the full power of SAST to hybrid apps
Quality largely depends on used call graph builders
Future work Data-flow analysis on top of Unified Call Graph
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 30
Thank you for your attentionAny questions or remarks
Conclusions
Bibliography
Achim D Brucker and Michael Herzberg
On the static analysis of hybrid mobile apps A report on the state of apache cordova nation
In Juan Caballero and Eric Bodden editors International Symposium on Engineering Secure Software and Systems(ESSoS) Lecture Notes in Computer Science Springer-Verlag 2016
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 32
Motivation Hybrid Mobile Apps and their Security Challenges
Real World Cordova Usage
Static Analysis for Hybrid Apps Building a Unified Call Graph
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 28
Outline
1 Motivation Hybrid Mobile Apps and their Security Challenges
2 Real World Cordova Usage
3 Static Analysis for Hybrid Apps Building a Unified Call Graph
4 Quality of the Unified Call Graph
5 Conclusions
Conclusions
Summary
Hybrid mobile apps are getting more popular
they are recommended at SAP
Hybrid mobile apps are juicy targets
Eg gain access to the app via the JS part and use the apprsquos permissions to steal data
Unified Call Graph is a first step in bringing the full power of SAST to hybrid apps
Quality largely depends on used call graph builders
Future work Data-flow analysis on top of Unified Call Graph
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 30
Thank you for your attentionAny questions or remarks
Conclusions
Bibliography
Achim D Brucker and Michael Herzberg
On the static analysis of hybrid mobile apps A report on the state of apache cordova nation
In Juan Caballero and Eric Bodden editors International Symposium on Engineering Secure Software and Systems(ESSoS) Lecture Notes in Computer Science Springer-Verlag 2016
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 32
Motivation Hybrid Mobile Apps and their Security Challenges
Real World Cordova Usage
Static Analysis for Hybrid Apps Building a Unified Call Graph
Quality of the Unified Call Graph
Conclusions
Outline
1 Motivation Hybrid Mobile Apps and their Security Challenges
2 Real World Cordova Usage
3 Static Analysis for Hybrid Apps Building a Unified Call Graph
4 Quality of the Unified Call Graph
5 Conclusions
Conclusions
Summary
Hybrid mobile apps are getting more popular
they are recommended at SAP
Hybrid mobile apps are juicy targets
Eg gain access to the app via the JS part and use the apprsquos permissions to steal data
Unified Call Graph is a first step in bringing the full power of SAST to hybrid apps
Quality largely depends on used call graph builders
Future work Data-flow analysis on top of Unified Call Graph
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 30
Thank you for your attentionAny questions or remarks
Conclusions
Bibliography
Achim D Brucker and Michael Herzberg
On the static analysis of hybrid mobile apps A report on the state of apache cordova nation
In Juan Caballero and Eric Bodden editors International Symposium on Engineering Secure Software and Systems(ESSoS) Lecture Notes in Computer Science Springer-Verlag 2016
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 32
Motivation Hybrid Mobile Apps and their Security Challenges
Real World Cordova Usage
Static Analysis for Hybrid Apps Building a Unified Call Graph
Quality of the Unified Call Graph
Conclusions
Conclusions
Summary
Hybrid mobile apps are getting more popular
they are recommended at SAP
Hybrid mobile apps are juicy targets
Eg gain access to the app via the JS part and use the apprsquos permissions to steal data
Unified Call Graph is a first step in bringing the full power of SAST to hybrid apps
Quality largely depends on used call graph builders
Future work Data-flow analysis on top of Unified Call Graph
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 30
Thank you for your attentionAny questions or remarks
Conclusions
Bibliography
Achim D Brucker and Michael Herzberg
On the static analysis of hybrid mobile apps A report on the state of apache cordova nation
In Juan Caballero and Eric Bodden editors International Symposium on Engineering Secure Software and Systems(ESSoS) Lecture Notes in Computer Science Springer-Verlag 2016
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 32
Motivation Hybrid Mobile Apps and their Security Challenges
Real World Cordova Usage
Static Analysis for Hybrid Apps Building a Unified Call Graph
Quality of the Unified Call Graph
Conclusions
Thank you for your attentionAny questions or remarks
Conclusions
Bibliography
Achim D Brucker and Michael Herzberg
On the static analysis of hybrid mobile apps A report on the state of apache cordova nation
In Juan Caballero and Eric Bodden editors International Symposium on Engineering Secure Software and Systems(ESSoS) Lecture Notes in Computer Science Springer-Verlag 2016
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 32
Motivation Hybrid Mobile Apps and their Security Challenges
Real World Cordova Usage
Static Analysis for Hybrid Apps Building a Unified Call Graph
Quality of the Unified Call Graph
Conclusions
Conclusions
Bibliography
Achim D Brucker and Michael Herzberg
On the static analysis of hybrid mobile apps A report on the state of apache cordova nation
In Juan Caballero and Eric Bodden editors International Symposium on Engineering Secure Software and Systems(ESSoS) Lecture Notes in Computer Science Springer-Verlag 2016
AD Brucker and M Herzberg The University of Sheffield On the Static Analysis of Hybrid Mobile Apps April 7 2016 32
Motivation Hybrid Mobile Apps and their Security Challenges
Real World Cordova Usage
Static Analysis for Hybrid Apps Building a Unified Call Graph