VAnDroid3, as the third version of the VAnDroid framework, is proposed to identify Android Inter-Component Communication (ICC) vulnerabilities at both intra- and inter-app communication levels. VAnDroid3 can be used to analyze app bundles against different types of Android ICC vulnerabilities, including Intent Spoofing, Unauthorized Intent Receipt, Privilege Escalation, Passive Data Leak, Content Pollution, and Custom Permission Vulnerability.
Tool
VAnDroid3 has been developed as a plugin-based software under the Eclipse Platform. Each step of the proposed approach is implemented as a separate component. However, each component provides the required input models for another component.
The tool and user manual are downloadable from this link.
Custom Permission Vulnerability
This attack scenario takes place in a bundle containing three apps: DefinerAttackApp, UserAttackApp, and VictimApp. In this ICC attack, UserAttackApp obtained the dangerous system permission and accessed VictimApp without the user’s consent.
- Attack Demo:
Empirical Evaluation
We provided the datasets of real-world Android applications from different app repositories:
- Benign: A set of 1000 apps, available on the AndroZoo in late December 2019.
- Malicious: A collection of 500 malicious apps, available on the AndroZoo in late December 2018.
- Vulnerable: A collection of 257 vulnerable apps from four Android app vulnerability benchmarks, including DroidBench, ICCBench, Ghera, and UBCBench.
From this dataset, 10 bundles of apps, each containing 35 apps (29 benign apps, 3 malicious apps, and 3 vulnerable apps), are created randomly. The results of running VAnDroid3 on each bundle are downloadable from this link.
