A Risk Estimation Study of Native Code Vulnerabilities in Android Applications

TL;DR

This paper introduces a rapid risk assessment method for detecting vulnerabilities in native C/C++ code within Android applications, enabling developers to identify and patch security issues before release.

Contribution

It presents a novel fast, risk-based approach combining regex detection and vulnerability scoring to evaluate native code risks in large-scale Android app analysis.

Findings

Over 60% of analyzed apps contain native code.

Many apps have known vulnerabilities in popular libraries.

The approach effectively identifies high-risk native code in large datasets.

Abstract

Android is the most used Operating System worldwide for mobile devices, with hundreds of thousands of apps downloaded daily. Although these apps are primarily written in Java and Kotlin, advanced functionalities such as graphics or cryptography are provided through native C/C++ libraries. These libraries can be affected by common vulnerabilities in C/C++ code (e.g., memory errors such as buffer overflow), through which attackers can read/modify data or execute arbitrary code. The detection and assessment of vulnerabilities in Android native code have only been recently explored by previous research work. In this paper, we propose a fast risk-based approach that provides a risk score related to the native part of an Android application. In this way, before an app is released, the developer can check if the app may contain vulnerabilities in the Native Code and, if present, patch them to publish a more secure application. To this end, we first use fast regular expressions to detect library versions and possible vulnerable functions. Then, we apply scores extracted from a vulnerability database to the analyzed application, thus obtaining a risk score representative of the whole app. We demonstrate the validity of our approach by performing a large-scale analysis on more than $100,000$ applications (but only $40\%$ contained native code) and $15$ popular libraries carrying known vulnerabilities. The attained results show that many applications contain well-known vulnerabilities that miscreants can potentially exploit, posing serious concerns about the security of the whole Android applications landscape.