Publication Type
Journal Article
Version
acceptedVersion
Publication Date
6-2021
Abstract
App repackaging has been raising serious concerns about the health of the Android ecosystem, and repackage-proofing is an important mitigation against threat of such attacks. However, existing app repackage-proofing schemes were only evaluated against trivial adversaries simulated using analyzers for other purposes (e.g., disclosing privacy leakage vulnerabilities), hence were shown “effective” mainly because their key programming features were not even supported by those toolkits. Furthermore, existing works have also neglected dynamic adversaries capable of manipulating victim apps at runtime, making them vulnerable against such stronger opponents. In this paper, we propose a novel repackage-proofing framework, which deploys distributed detection and response sites into the subject app’s native partition to cross-verify all its code files. The detection sites transmit obtained integrity metrics to response sites via secure communication channels built on the subject app’s own control flows using a specialized obfuscation technique based on Collatz conjecture, turning the repackage-proofing process into complicated implicit flows that are intrinsically difficult to be resolved due to the conjecture’s nonlinear dynamical behaviors. We evaluated our framework using sophisticated Android data-flow analyzers. Results showed that our prototype effectively impeded analyses aiming to trace the information flows of its cross-verification.
Keywords
App repackaging, repackage-proofing, code obfuscation, Collatz conjecture
Discipline
Information Security | Software Engineering
Research Areas
Cybersecurity
Publication
IEEE Transactions on Dependable and Secure Computing
First Page
1
Last Page
15
ISSN
1545-5971
Identifier
10.1109/TDSC.2021.3091654
Publisher
Institute of Electrical and Electronics Engineers
Citation
MA, Haoyu; LI, Shijia; GAO, Debin; and JIA, Chunfu.
Secure repackage-proofing framework for Android apps using Collatz conjecture. (2021). IEEE Transactions on Dependable and Secure Computing. 1-15.
Available at: https://ink.library.smu.edu.sg/sis_research/6733
Creative Commons License
This work is licensed under a Creative Commons Attribution-NonCommercial-No Derivative Works 4.0 International License.