Crafting Intents to Detect ICC Vulnerabilities of Android Apps
Tianjun Wu, Yuexiang Yang · 2016
Android enables an intra-and inter-app communication that can be misused thus resulting in various ICC (inter-component communication) vulnerabilities such as null pointer, Intent spoofing, Intent hijack, and data leak. This paper proposes a fuzzing framework called ICCFuzzer to uncover various types of ICC vulnerabilities, by combining path-insensitive ICFG analysis and generative data fuzzing. Firstly, the static analysis extracts Intent structure, string constants, and events relevant to ICC vulnerabilities for the fuzzer to penetrate deeper into app logic. Secondly, the fuzzer constructs and injects proper Intents and events according to the information collected by static analysis, and then records ICC vulnerabilities triggered. Experiments on DroidBench and real-world apps show the effectiveness of this method.