Precisely and Scalably Vetting JavaScript Bridge in Android Hybrid Apps Conference Paper uri icon

abstract

  • 2017, Springer International Publishing AG. In this paper, we propose a novel system, named BridgeScope, for precise and scalable vetting of JavaScript Bridge security issues in Android hybrid apps. BridgeScope is flexible and can be leveraged to analyze a diverse set of WebView implementations, such as Androids default WebView, and Mozillas Rhino-based WebView. Furthermore, BridgeScope can automatically generate test exploit code to further confirm any discovered JavaScript Bridge vulnerability. We evaluated BridgeScope to demonstrate that it is precise and effective in finding JavaScript Bridge vulnerabilities. On average, it can vet an app within seven seconds with a low false positive rate. A large scale evaluation identified hundreds of potentially vulnerable real-world popular apps that could lead to critical exploitation. Furthermore, we also demonstrate that BridgeScope can discover malicious functionalities that leverage JavaScript Bridge in real-world malicious apps, even when the associated malicious severs were unavailable.

published proceedings

  • Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)

author list (cited authors)

  • Yang, G., Mendoza, A., Zhang, J., & Gu, G.

citation count

  • 10

complete list of authors

  • Yang, Guangliang||Mendoza, Abner||Zhang, Jialong||Gu, Guofei

publication date

  • January 2017