Automatic permission inference for hybrid mobile apps

Article type: Research Article

Authors: Mao, Jian^{a; *} | Ma, Hanjun^a | Chen, Yue^a | Jia, Yaoqi^b | Liang, Zhenkai^b

Affiliations: [a] School of Electronic and Information Engineering, Beihang University, Beijing, China | [b] School of Computing, National University of Singapore, Singapore, Singapore

Correspondence: [*] Corresponding author. E-mail: maojian@buaa.edu.cn.

Abstract: The application permission system is one of the key components of Android security. Developers often use it incorrectly and claim more permissions than necessary, due to limitations of developers’ knowledge and development tools. When application’s vulnerabilities are exploited, the additional permissions give attackers more capability to carry out attacks. Hybrid mobile applications (apps) are a class of mobile apps that are built from web technologies, such as HTML, JavaScript, and CSS. In such applications, it is often easier to inject third-party code through vulnerabilities. When developers do not specify app’s permissions correctly, the injected code will result in dangerous actions breaching system security. In this paper, we develop an automatic tool to assist developers to identify the permissions required by the apps based on the hybrid mobile apps’ runtime permission checking.

Keywords: Hybrid mobile app, permission, Android, security, automatic tool

DOI: 10.3233/JHS-160538

Journal: Journal of High Speed Networks, vol. 22, no. 1, pp. 55-64, 2016