LeakScope is a static analysis tool to automatically detect data leakage vulnerabilities in mobile apps. The key component of LeakScope is the String Value Analysis, which is designed to apply value-set analysis for revealing the possible values of the keys that are used by the cloud provider to connect the apps with the corresponding back-end instances. This component takes the apk file of the app, the target cloud APIs, and the index of parameters as input and generates the values of the keys that can be solved.
For more details, please see the following running example and our paper (S&P 2019)
This is an Eclipse project that depends on Flowdroid:
package com.example.vsa.valuesetanalysisexample; import ... public class VsaTest { String keypart1; String keypart2; public void init(Context arg3){ keypart1 = getHardcodedStr(); keypart2 = arg3.getResources().getString(R.string.key_part2); } public String getHardcodedStr(){ return "hardcode"; } public CloudStorageAccount getAccount() throws URISyntaxException, InvalidKeyException { String key = "part1:"; key += keypart1; key += "|part2:"; key += keypart2; //target function return CloudStorageAccount.parse(key); } }
{
"apk":"example/ValueSetAnalysisExample.apk",
"methods":
[
{
"method":"<com.microsoft.azure.storage.CloudStorageAccount: com.microsoft.azure.storage.CloudStorageAccount parse(java.lang.String)>",
"parmIndexs":[0]
}
]
}$ java -jar ValueSetAnalysis.jar ./libs/android.jar ./example/example.json May 20, 2019 8:53:14 PM brut.androlib.res.AndrolibResources loadMainPkg INFO: Loading resource table... Using './libs/android.jar' as android.jar com.example.vsa.valuesetanalysisexample[CG time]:10035 com.example.vsa.valuesetanalysisexample[CG time]:10774 ... com.example.vsa.valuesetanalysisexample===========================875195900=========================== Class: com.example.vsa.valuesetanalysisexample.VsaTest Method: <com.example.vsa.valuesetanalysisexample.VsaTest: com.microsoft.azure.storage.CloudStorageAccount getAccount()> Target: $r3 = staticinvoke <com.microsoft.azure.storage.CloudStorageAccount: com.microsoft.azure.storage.CloudStorageAccount parse(java.lang.String)>($r2) Solved: true Depend: 422751563, 1674086835, BackwardContexts: 0 $r1 = new java.lang.StringBuilder specialinvoke $r1.<java.lang.StringBuilder: void <init>()>() virtualinvoke $r1.<java.lang.StringBuilder: java.lang.StringBuilder append(java.lang.String)>("part1:") $r2 = $r0.<com.example.vsa.valuesetanalysisexample.VsaTest: java.lang.String keypart1> virtualinvoke $r1.<java.lang.StringBuilder: java.lang.StringBuilder append(java.lang.String)>($r2) $r2 = virtualinvoke $r1.<java.lang.StringBuilder: java.lang.String toString()>() $r1 = new java.lang.StringBuilder specialinvoke $r1.<java.lang.StringBuilder: void <init>()>() virtualinvoke $r1.<java.lang.StringBuilder: java.lang.StringBuilder append(java.lang.String)>($r2) virtualinvoke $r1.<java.lang.StringBuilder: java.lang.StringBuilder append(java.lang.String)>("|part2:") $r2 = virtualinvoke $r1.<java.lang.StringBuilder: java.lang.String toString()>() $r1 = new java.lang.StringBuilder specialinvoke $r1.<java.lang.StringBuilder: void <init>()>() virtualinvoke $r1.<java.lang.StringBuilder: java.lang.StringBuilder append(java.lang.String)>($r2) $r2 = $r0.<com.example.vsa.valuesetanalysisexample.VsaTest: java.lang.String keypart2> virtualinvoke $r1.<java.lang.StringBuilder: java.lang.StringBuilder append(java.lang.String)>($r2) $r2 = virtualinvoke $r1.<java.lang.StringBuilder: java.lang.String toString()>() $r3 = staticinvoke <com.microsoft.azure.storage.CloudStorageAccount: com.microsoft.azure.storage.CloudStorageAccount parse(java.lang.String)>($r2) ValueSet: |0:part1:hardcode|part2:fromres, com.example.vsa.valuesetanalysisexample===========================422751563=========================== Field: <com.example.vsa.valuesetanalysisexample.VsaTest: java.lang.String keypart2> Solved: true Depend: 1568161955, ValueSet: |-1:fromres, com.example.vsa.valuesetanalysisexample===========================1674086835=========================== Field: <com.example.vsa.valuesetanalysisexample.VsaTest: java.lang.String keypart1> Solved: true Depend: 38076305, ValueSet: |-1:hardcode, com.example.vsa.valuesetanalysisexample===========================1568161955=========================== Class: com.example.vsa.valuesetanalysisexample.VsaTest Method: <com.example.vsa.valuesetanalysisexample.VsaTest: void init(android.content.Context)> Target: $r0.<com.example.vsa.valuesetanalysisexample.VsaTest: java.lang.String keypart2> = $r2 Solved: true Depend: BackwardContexts: 0 $r2 = virtualinvoke $r3.<android.content.res.Resources: java.lang.String getString(int)>(2131427369) $r0.<com.example.vsa.valuesetanalysisexample.VsaTest: java.lang.String keypart2> = $r2 ValueSet: |-1:fromres, com.example.vsa.valuesetanalysisexample[{"0":["part1:hardcode|part2:fromres"]}]
If you create a research work that uses our work, please citing the associated paper:
@inproceedings{leakscope:sp19,
author = {Chaoshun Zuo and Zhiqiang Lin and Yinqian Zhang} ,
title = {Why Does Your Data Leak? Uncovering the Data Leakage in Cloud From Mobile Apps},
booktitle = {Proceedings of the 2019 IEEE Symposium on Security and Privacy},
address = {San Francisco, CA},
month = {May},
year = 2019,
}