VenomAttack: automated and adaptive activity hijacking in Android
Pu SUN1,2,3, Sen CHEN4, Lingling FAN5, Pengfei GAO1, Fu SONG1(), Min YANG6
1. School of Information Science and Technology, ShanghaiTech University, Shanghai 201210, China 2. Shanghai Institute of Microsystem and Information Technology, Chinese Academy of Sciences, Shanghai 200050, China 3. University of Chinese Academy of Sciences, Beijing 100049, China 4. College of Intelligence and Computing, Tianjin University, Tianjin 300350, China 5. College of Cyber Science, Nankai University, Tianjin 300350, China 6. School of Computer Science, Fudan University, Shanghai 200438, China
Activity hijacking is one of the most powerful attacks in Android. Though promising, all the prior activity hijacking attacks suffer from some limitations and have limited attack capabilities. They no longer pose security threats in recent Android due to the presence of effective defense mechanisms. In this work, we propose the first automated and adaptive activity hijacking attack, named VenomAttack, enabling a spectrum of customized attacks (e.g., phishing, spoofing, and DoS) on a large scale in recent Android, even the state-of-the-art defense mechanisms are deployed. Specifically, we propose to use hotpatch techniques to identify vulnerable devices and update attack payload without re-installation and re-distribution, hence bypassing offline detection. We present a newly-discovered flaw in Android and a bug in derivatives of Android, each of which allows us to check if a target app is running in the background or not, by which we can determine the right attack timing via a designed transparent activity. We also propose an automated fake activity generation approach, allowing large-scale attacks. Requiring only the common permission INTERNET, we can hijack activities at the right timing without destroying the GUI integrity of the foreground app. We conduct proof-of-concept attacks, showing that VenomAttack poses severe security risks on recent Android versions. The user study demonstrates the effectiveness of VenomAttack in real-world scenarios, achieving a high success rate (95%) without users’ awareness. That would call more attention to the stakeholders like Google.
. [J]. Frontiers of Computer Science, 2023, 17(1): 171801.
Pu SUN, Sen CHEN, Lingling FAN, Pengfei GAO, Fu SONG, Min YANG. VenomAttack: automated and adaptive activity hijacking in Android. Front. Comput. Sci., 2023, 17(1): 171801.
Do you think the financial apps provide more functionalities after login?
Yes or No
Question-2
Based on your past experience, is it common to re-login after app switching?
Yes or No
Question-3
Are you aware any attacks during the study?
Yes or No
Question-4
If yes, when do you think attacks occur?
Question-5
If yes, what makes you aware of the attacks?
Tab.5
Fig.9
Fig.10
Fig.11
Android device
Android version
API level
Init time /ms
Back to background time/ms
HUAWEI Nova5 Pro
EMUI 10.1.0
29
6
5
HUAWEI HONOR 30S
Magic UI 3.1.1
29
7
6
Xiaomi MI 9
MIUI 12.0.3
29
8
4
Xiaomi Redmi10X Pro
MIUI 11.0.5
29
7
3
Xiaomi Redmi K30
MIUI 12.0.5
29
17
7
OPPO Realme X
ColorOS V7
29
14
9
Tab.6
Fig.12
1
L Lu, Z Li, Z Wu, W Lee, G Jiang. CHEX: statically vetting Android apps for component hijacking vulnerabilities. In: Proceedings of 2012 ACM Conference on Computer and Communications Security. 2012, 229–240
2
G Rydstedt, B Gourdin, E Bursztein, D Boneh. Framing attacks on smart phones and dumb routers: tap-jacking and geo-localization attacks. In: Proceedings of the 4th USENIX Conference on Offensive Technologies. 2010, 1–8
3
Q A Chen, Z Qian, Z M Mao. Peeking into your app without actually seeing it: UI state inference and novel Android attacks. In: Proceedings of the 23rd USENIX Conference on Security Symposium. 2014, 1037−1052
4
Z Wang, C Li, Y Guan, Y Xue, Y Dong. ActivityHijacker: hijacking the Android activity component for sensitive data. In: Proceedings of the 25th International Conference on Computer Communication and Networks. 2016, 1–9
5
C Ren, Y Zhang, H Xue, T Wei, P Liu. Towards discovering and understanding task hijacking in Android. In: Proceedings of the 24th USENIX Conference on Security Symposium. 2015, 945–959
6
S Lee, S Hwang, S Ryu. All about activity injection: threats, semantics, and detection. In: Proceedings of the 32nd IEEE/ACM International Conference on Automated Software Engineering. 2017, 252–262
7
Y Ren, Y Li, F Yuan, F Zhang. Hijacking activity technology analysis and research in Android system. In: Proceedings of the International Conference on Trustworthy Computing and Services. 2013, 46–53
8
Y Xiao, G Bai, J Mao, Z Liang, W Cheng. Privilege leakage and information stealing through the Android task mechanism. In: Proceedings of 2017 IEEE Symposium on Privacy-Aware Computing. 2017, 152–163
9
L Yang , Y Zhi , T Wei , S Yu , J Ma . Inference attack in Android activity based on program fingerprint. Journal of Network and Computer Applications, 2019, 127 : 92– 106
10
L Luo, Q Zeng, C Cao, K Chen, J Liu, L Liu, N Gao, M Yang, X Xing, P Liu. System service call-oriented symbolic execution of Android framework with applications to vulnerability discovery and exploit generation. In: Proceedings of the 15th Annual International Conference on Mobile Systems, Applications, and Services. 2017, 225–238
11
C Ren, P Liu, S Zhu. WindowGuard: systematic protection of GUI security in Android. In: Proceedings of the 24th Annual Network and Distributed System Security Symposium. 2017
12
J Liu, D Wu, J Xue. TDroid: exposing app switching attacks in Android with control flow specialization. In: Proceedings of the 33rd ACM/IEEE International Conference on Automated Software Engineering. 2018, 236–247
13
F Liu, H Cai, G Wang, D Yao, K O Elish, B G Ryder. MR-Droid: a scalable and prioritized analysis of inter-app communication risks. In: Proceedings of 2017 IEEE Security and Privacy Workshops. 2017, 189–198
14
F Yan, Y Li, L Zhang. ActivityShielder: an activity hijacking defense scheme for Android devices. In: Proceedings of the 27th International Conference on Computer Communication and Networks. 2018, 1–9
15
Chen S, Fan L, Chen C, Su T, Li W, Liu Y, Xu L. StoryDroid: automated generation of storyboard for android apps . In: Proceedings of the 41st IEEE/ACM International Conference on Software Engineering. 2019, 596–607
16
T Chen, J He, F Song, G Wang, Z Wu, J Yan. Android stack machine. In: Proceedings of the 30th International Conference on Computer Aided Verification. 2018, 487–504
17
A Bkakria, M Graa, N Cuppens-Boulahia, F Cuppens, J L Lanet. Real-time detection and reaction to activity hijacking attacks in Android smartphones (short paper). In: Proceedings of the 15th Annual Conference on Privacy, Security and Trust (PST). 2017, 253–258
18
L Li , D Li , T F Bissyandé , J Klein , Traon Y Le , D Lo , L Cavallaro . Understanding android app piggybacking: a systematic study of malicious code grafting. IEEE Transactions on Information Forensics and Security, 2017, 12( 6): 1269– 1284
19
J Gao, L Li, P Kong, T F Bissyandé, J Klein. Borrowing your enemy’s arrows: the case of code reuse in Android via direct inter-app code invocation. In: Proceedings of the 28th ACM Joint Meeting on European Software Engineering Conference and Symposium on the Foundations of Software Engineering. 2020, 939−951
20
G S Tuncay, J Qian, C A Gunter. See no evil: phishing for permissions with false transparency. In: Proceedings of the 29th USENIX Security Symposium. 2020, 415−432
21
B Saltaformaggio, R Bhatia, Z Gu, X Zhang, D Xu. GUITAR: piecing together android app GUIs from memory images. In: Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security. 2015, 120−132
22
S Chen , L Fan , C Chen , M Xue , Y Liu , L Xu . GUI-Squatting attack: automated generation of Android phishing apps. IEEE Transactions on Dependable and Secure Computing, 2021, 18( 6): 2551– 2568
23
F Song , Y Lei , S Chen , L Fan , Y Liu . Advanced evasion attacks and mitigations on practical ML-based phishing website classifiers. International Journal of Intelligent Systems, 2021, 36( 9): 5210– 5240
24
S Chen, T Su, L Fan, G Meng, M Xue, Y Liu, L Xu. Are mobile banking apps secure? what can be improved?. In: Proceedings of the 26th ACM Joint Meeting on European Software Engineering Conference and Symposium on the Foundations of Software Engineering. 2018, 797−802
25
F Song, T Touili. Model-checking for android malware detection. In: Proceedings of the 12th Asian Symposium on Programming Languages and Systems. 2014, 216−235
26
Z Xu, K Ren, F Song. Android malware family classification and characterization using CFG and DFG. In: Proceedings of 2019 International Symposium on Theoretical Aspects of Software Engineering. 2019, 49−56
27
Chen S, Fan L, Meng G, Su T, Xue M, Xue Y, Liu Y, Xu L. An empirical assessment of security risks of global android banking apps. In: Proceedings of the 42nd IEEE/ACM International Conference on Software Engineering. 2020, 1310−1322
28
Tang C, Chen S, Fan L, Xu L, Liu Y, Tang Z, Dou L. A large-scale empirical study on industrial fake apps. In: Proceedings of the 41st IEEE/ACM International Conference on Software Engineering: Software Engineering in Practice. 2019, 183−192
