Authors: Chen Shi (Iowa State University), Chris Chao-Chun Cheng (Iowa State University), and Yong Guan (Iowa State University)
DFRWS USA 2022
Abstract
With advancements in technology, people are taking advantage of mobile devices to access e-mails, search the web, and video chat. Therefore, extracting evidence from mobile phones is an important component of the investigation process. As Android app developers could leverage existing native libraries to implement a part of the program, evidentiary data are generated and stored by these native libraries. However, current state-of-art Android static analysis tools, such asFlowDroid [16], Evihunter[19], DroidSafe [22], and CHEX [27] adopt the conservative approach for data-flow analysis on native method invocation. None of those tools have the capability to capture the data flow within native libraries. In this work, we propose a new approach to conduct native data-flow analysis for security vetting of Android native libraries and build an analysis framework, called LibDroid to compute data-flow and summarize taint propagation forAndroid native libraries. The common question app users and developers often face are whether certain native libraries contain hidden functions or utilize user private information. LibDroid aims to answer this question. Therefore, we build a precise and efficient data-flow analysis with the support ofSummarizeNativeMethodalgorithm, and pre-computed Android Native Libraries Database (ANLD) for 13,138 native libraries collected from 2,627 real-world Android applications. The ANLD includes the taint propagation summary of each native method and potential evidentiary data generated or stored within the native library. We evaluate LibDroid on 52 open-source native libraries and 2,627real-world apps. Our results show that LibDroid can precisely summarize the information flow within the native libraries.