The lifetime of Android API vulnerabilities: case study on the JavaScript-to-Java interface

Daniel R. Thomas; Alastair R. Beresford; Thomas Coudray; Tom Sutcliffe; Adrian Taylor

doi:10.1007/978-3-319-26096-9_13

The lifetime of Android API vulnerabilities: case study on the JavaScript-to-Java interface

Daniel R. Thomas, Alastair R. Beresford, Thomas Coudray, Tom Sutcliffe, Adrian Taylor

Computer And Information Sciences

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution book

16 Citations (Scopus)

22 Downloads (Pure)

Abstract

We examine the lifetime of API vulnerabilities on Android and propose an exponential decay model of the uptake of updates after the release of a fix. We apply our model to a case study of the JavaScript-to-Java interface vulnerability. This vulnerability allows untrusted JavaScript in a WebView to break out of the JavaScript sandbox allowing remote code execution on Android phones, this can often then be further exploited to gain root access. While this vulnerability was first reported in 2012-12-21 we predict that the fix will not have been deployed to 95% of devices until 2018-01-10, 5.2 years after the release of the fix. We show how this vulnerability is exploitable in many apps and the role that ad-libraries have in making this flaw so widespread.

Original language	English
Title of host publication	Cambridge International Workshop on Security Protocols
Subtitle of host publication	Security Protocols 2015: Security Protocols XXIII
Publisher	Springer
Pages	126-138
Number of pages	12
ISBN (Print)	9783319260969
DOIs	https://doi.org/10.1007/978-3-319-26096-9_13
Publication status	Published - 1 Apr 2015

Publication series

Name	LNCS
Volume	9379

Keywords

API security
Android
WebView
security updates
ad-libraries
JavaScript
Java
vulnerabilities
network attacker
RCE

Access to Document

10.1007/978-3-319-26096-9_13

Thomas-etal-SP2015-The-lifetime-Android-API-vulnerabilities-case-study-JavaScript-to-Java-interfaceAccepted author manuscript, 382 KB

Daniel Thomas
- d.thomasstrath.acuk
- Computer And Information Sciences - Senior Lecturer
- StrathCyber
Person: Academic

Cite this

Thomas, D. R., Beresford, A. R., Coudray, T., Sutcliffe, T., & Taylor, A. (2015). The lifetime of Android API vulnerabilities: case study on the JavaScript-to-Java interface. In Cambridge International Workshop on Security Protocols: Security Protocols 2015: Security Protocols XXIII (pp. 126-138). (LNCS; Vol. 9379). Springer. https://doi.org/10.1007/978-3-319-26096-9_13

@inproceedings{110a2b24e16e4d8b94269e43e2d0aa52,

title = "The lifetime of Android API vulnerabilities: case study on the JavaScript-to-Java interface",

abstract = "We examine the lifetime of API vulnerabilities on Android and propose an exponential decay model of the uptake of updates after the release of a fix. We apply our model to a case study of the JavaScript-to-Java interface vulnerability. This vulnerability allows untrusted JavaScript in a WebView to break out of the JavaScript sandbox allowing remote code execution on Android phones, this can often then be further exploited to gain root access. While this vulnerability was first reported in 2012-12-21 we predict that the fix will not have been deployed to 95% of devices until 2018-01-10, 5.2 years after the release of the fix. We show how this vulnerability is exploitable in many apps and the role that ad-libraries have in making this flaw so widespread.",

keywords = "API security, Android, WebView, security updates, ad-libraries, JavaScript, Java, vulnerabilities, network attacker, RCE",

author = "Thomas, {Daniel R.} and Beresford, {Alastair R.} and Thomas Coudray and Tom Sutcliffe and Adrian Taylor",

year = "2015",

month = apr,

day = "1",

doi = "10.1007/978-3-319-26096-9_13",

language = "English",

isbn = "9783319260969",

series = "LNCS",

publisher = "Springer",

pages = "126--138",

booktitle = "Cambridge International Workshop on Security Protocols",

}

The lifetime of Android API vulnerabilities: case study on the JavaScript-to-Java interface. / Thomas, Daniel R.; Beresford, Alastair R.; Coudray, Thomas et al.
Cambridge International Workshop on Security Protocols: Security Protocols 2015: Security Protocols XXIII. Springer, 2015. p. 126-138 (LNCS; Vol. 9379).

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution book

TY - GEN

T1 - The lifetime of Android API vulnerabilities

T2 - case study on the JavaScript-to-Java interface

AU - Thomas, Daniel R.

AU - Beresford, Alastair R.

AU - Coudray, Thomas

AU - Sutcliffe, Tom

AU - Taylor, Adrian

PY - 2015/4/1

Y1 - 2015/4/1

N2 - We examine the lifetime of API vulnerabilities on Android and propose an exponential decay model of the uptake of updates after the release of a fix. We apply our model to a case study of the JavaScript-to-Java interface vulnerability. This vulnerability allows untrusted JavaScript in a WebView to break out of the JavaScript sandbox allowing remote code execution on Android phones, this can often then be further exploited to gain root access. While this vulnerability was first reported in 2012-12-21 we predict that the fix will not have been deployed to 95% of devices until 2018-01-10, 5.2 years after the release of the fix. We show how this vulnerability is exploitable in many apps and the role that ad-libraries have in making this flaw so widespread.

AB - We examine the lifetime of API vulnerabilities on Android and propose an exponential decay model of the uptake of updates after the release of a fix. We apply our model to a case study of the JavaScript-to-Java interface vulnerability. This vulnerability allows untrusted JavaScript in a WebView to break out of the JavaScript sandbox allowing remote code execution on Android phones, this can often then be further exploited to gain root access. While this vulnerability was first reported in 2012-12-21 we predict that the fix will not have been deployed to 95% of devices until 2018-01-10, 5.2 years after the release of the fix. We show how this vulnerability is exploitable in many apps and the role that ad-libraries have in making this flaw so widespread.

KW - API security

KW - Android

KW - WebView

KW - security updates

KW - ad-libraries

KW - JavaScript

KW - Java

KW - vulnerabilities

KW - network attacker

KW - RCE

U2 - 10.1007/978-3-319-26096-9_13

DO - 10.1007/978-3-319-26096-9_13

M3 - Conference contribution book

SN - 9783319260969

T3 - LNCS

SP - 126

EP - 138

BT - Cambridge International Workshop on Security Protocols

PB - Springer

ER -

The lifetime of Android API vulnerabilities: case study on the JavaScript-to-Java interface

Abstract

Publication series

Keywords

Access to Document

Fingerprint

Profiles

Daniel Thomas

Cite this