LibCapsule: Complete Confinement of Third-Party Libraries in Android Applications
Jun Qiu, Xuewu Yang, Huamao Wu, Yajin Zhou, Jinku Li, Jianfeng Ma · IEEE Transactions on Dependable and Secure Computing · 2021
Android application (or app) developers increasingly integrate third-party libraries to enrich the functionality of their apps. However, current permission model on Android cannot constrain the behaviors of in-app third-party libraries for allowing them to operate with the same permissions as their host app. This brings serious security and privacy concerns to users. In this article, we proposeLibCapsule, a user-level solution to confine third-party libraries from potential permission abuses. Compared to previous systems,LibCapsuleis able to providecompleteconfinement of third-party libraries in Android apps, including the static Java code, dynamically loaded code and native code of third-party libraries. We have developed a prototype ofLibCapsule, and collected 204 popular third-party libraries as well as 2,021 apps to evaluate it. The evaluation results indicate thatLibCapsuleis capable of enforcing complete and fine-grained regulation on third-party libraries according to customized security policies with a low performance overhead. To engage the whole community, we will release the dataset of third-party libraries and apps in our evaluation.