Publication Type

Conference Paper

Version

publishedVersion

Publication Date

12-2015

Abstract

Security of authentication protocols heavily relies on the confidentiality of credentials (or authenticators) like passwords and session IDs. However, unlike browser-based web applications for which highly evolved browsers manage the authenticators, Android apps have to construct their own management. We find that most apps simply locate their authenticators into the persistent storage and entrust underlying Android OS for mediation. Consequently, these authenticators can be leaked through compromised backup channels. In this work, we conduct the first systematic investigation on this previously overlooked attack vector. We find that nearly all backup apps on Google Play inadvertently expose backup data to any app with internet and SD card permissions. With this exposure, the malicious apps can steal other apps’ authenticators and obtain complete control over the authenticated sessions. We show that this can be stealthily and efficiently done by building a proof-of-concept app named AuthSniffer. We find that 80 (68.4%) out of the 117 tested topranked apps which have implemented authentication schemes are subject to this threat. Our study should raise the awareness of app developers and protocol analysts about this attack vector.

Discipline

Computer and Systems Architecture | Software Engineering

Research Areas

Software and Cyber-Physical Systems

Publication

20th International Conference on Engineering of Complex Computer Systems, Gold Coast, Australia, 2015 December 9-12

Identifier

10.1109/ICECCS.2015.17

City or Country

Gold Coast, Australia

Additional URL

https://doi.org/10.1109/ICECCS.2015.17

Download

Share

COinS