Code Injection Attacks on HTML5-based Mobile Apps
Authors:
Open Access
- 3 November 2014
- conference paper
- Published by Association for Computing Machinery (ACM)
- p. 66-77
Abstract
Due to the portability advantage, HTML5-based mobile apps are getting more and more popular.Unfortunately, the web technology used by HTML5-based mobile apps has a dangerous feature, which allows data and code to be mixed together, making code injection attacks possible. In this paper, we have conducted a systematic study on this risk in HTML5-based mobile apps. We found a new form of code injection attack, which inherits the fundamental cause of Cross-Site Scripting attack~(XSS), but it uses many more channels to inject code than XSS. These channels, unique to mobile devices, include Contact, SMS, Barcode, MP3, etc. To assess the prevalence of the code injection vulnerability in HTML5-based mobile apps, we have developed a vulnerability detection tool to analyze 15,510 PhoneGap apps collected from Google Play. 478 apps are flagged as vulnerable, with only 2.30\% false-positive rate. We have also implemented a prototype called NoInjection as a Patch to PhoneGap in Android to defend against the attack.Keywords
All Related Versions
Funding Information
- McAfee
- National Science Foundation (1054605, 1018217, 1318814, 1017771)
This publication has 26 references indexed in Scilit:
- Execute This! Analyzing Unsafe and Malicious Dynamic Code Loading in Android Applications2014
- SMV-HUNTER: Large Scale, Automated Detection of SSL/TLS Man-in-the-Middle Vulnerabilities in Android Apps2014
- AppSealer: Automatic Generation of Vulnerability-Specific Patches for Preventing Component Hijacking Attacks in Android Applications2014
- AppIntent2013
- CHEX2012
- Why eve and mallory love android2012
- Attacks on WebView in the Android system2011
- Android permissions demystified2011
- SCRIPTGARD2011
- IceShield: Detection and Mitigation of Malicious Websites with a Frozen DOM2011