Скачать или смотреть Static Detection and Automatic Exploitation of Intent Message Vulnerabilities in Android

By Daniele Gallingani

"We identified a set of vulnerabilities that common Android Apps programming (mis)practices might introduce.

We developed an effective static analyzer to automatically detect a set of vulnerabilities rising by incorrect Android‰Ûªs Inter-Component Communication usage.

We completed our analysis by automatically demonstrating whether the vulnerabilities identified by static analysis can actually be exploited or not at run-time

by an attacker.

We adopt a formal and sound approach to automatically produce malicious payloads able to reproduce the dangerous behavior in vulnerable applications.



The lack of exhaustive sanity checks when receiving messages from unknown sources is the evidence of the underestimation of this problem in real world application development."