LeakScope

LeakScope is a static analysis tool to automatically detect data leakage vulnerabilities in mobile apps. The key component of LeakScope is the String Value Analysis, which is designed to apply value-set analysis for revealing the possible values of the keys that are used by the cloud provider to connect the apps with the corresponding back-end instances. This component takes the apk file of the app, the target cloud APIs, and the index of parameters as input and generates the values of the keys that can be solved.

For more details, please see the following running example and our paper (S&P 2019)

Dependencies

This is an Eclipse project that depends on Flowdroid:

• flowdroid
  • soot-infoflow-android
  • soot-infoflow-cmd
  • soot-infoflow-summaries
  • soot-infoflow

Running Example

target example code from example/ValueSetAnalysisExample.apk

package com.example.vsa.valuesetanalysisexample;  
  
import ...
public class VsaTest {  
  
    String keypart1;  
    String keypart2;  
  
    public void init(Context arg3){  
        keypart1 = getHardcodedStr();  
        keypart2 = arg3.getResources().getString(R.string.key_part2);  
    }  
  
    public String getHardcodedStr(){  
        return "hardcode";  
    }  
  
    public CloudStorageAccount getAccount() throws URISyntaxException, InvalidKeyException {  
        String key = "part1:";  
        key += keypart1;  
        key += "|part2:";  
        key += keypart2; 
         
	//target function
        return CloudStorageAccount.parse(key);  
    }  
}

configuration file

{
  "apk":"example/ValueSetAnalysisExample.apk",
  "methods":
    [
      {
        "method":"<com.microsoft.azure.storage.CloudStorageAccount: com.microsoft.azure.storage.CloudStorageAccount parse(java.lang.String)>",
        "parmIndexs":[0]
      }
    ]
}

run

$ java -jar ValueSetAnalysis.jar ./libs/android.jar ./example/example.json 
May 20, 2019 8:53:14 PM brut.androlib.res.AndrolibResources loadMainPkg
INFO: Loading resource table...
Using './libs/android.jar' as android.jar
com.example.vsa.valuesetanalysisexample[CG time]:10035
com.example.vsa.valuesetanalysisexample[CG time]:10774
...
com.example.vsa.valuesetanalysisexample===========================875195900===========================
Class: com.example.vsa.valuesetanalysisexample.VsaTest
Method: <com.example.vsa.valuesetanalysisexample.VsaTest: com.microsoft.azure.storage.CloudStorageAccount getAccount()>
Target: $r3 = staticinvoke <com.microsoft.azure.storage.CloudStorageAccount: com.microsoft.azure.storage.CloudStorageAccount parse(java.lang.String)>($r2)
Solved: true
Depend: 422751563, 1674086835, 
BackwardContexts: 
  0
    $r1 = new java.lang.StringBuilder
    specialinvoke $r1.<java.lang.StringBuilder: void <init>()>()
    virtualinvoke $r1.<java.lang.StringBuilder: java.lang.StringBuilder append(java.lang.String)>("part1:")
    $r2 = $r0.<com.example.vsa.valuesetanalysisexample.VsaTest: java.lang.String keypart1>
    virtualinvoke $r1.<java.lang.StringBuilder: java.lang.StringBuilder append(java.lang.String)>($r2)
    $r2 = virtualinvoke $r1.<java.lang.StringBuilder: java.lang.String toString()>()
    $r1 = new java.lang.StringBuilder
    specialinvoke $r1.<java.lang.StringBuilder: void <init>()>()
    virtualinvoke $r1.<java.lang.StringBuilder: java.lang.StringBuilder append(java.lang.String)>($r2)
    virtualinvoke $r1.<java.lang.StringBuilder: java.lang.StringBuilder append(java.lang.String)>("|part2:")
    $r2 = virtualinvoke $r1.<java.lang.StringBuilder: java.lang.String toString()>()
    $r1 = new java.lang.StringBuilder
    specialinvoke $r1.<java.lang.StringBuilder: void <init>()>()
    virtualinvoke $r1.<java.lang.StringBuilder: java.lang.StringBuilder append(java.lang.String)>($r2)
    $r2 = $r0.<com.example.vsa.valuesetanalysisexample.VsaTest: java.lang.String keypart2>
    virtualinvoke $r1.<java.lang.StringBuilder: java.lang.StringBuilder append(java.lang.String)>($r2)
    $r2 = virtualinvoke $r1.<java.lang.StringBuilder: java.lang.String toString()>()
    $r3 = staticinvoke <com.microsoft.azure.storage.CloudStorageAccount: com.microsoft.azure.storage.CloudStorageAccount parse(java.lang.String)>($r2)
ValueSet: 
   |0:part1:hardcode|part2:fromres,

com.example.vsa.valuesetanalysisexample===========================422751563===========================
Field: <com.example.vsa.valuesetanalysisexample.VsaTest: java.lang.String keypart2>
Solved: true
Depend: 1568161955, 
ValueSet: 
   |-1:fromres,

com.example.vsa.valuesetanalysisexample===========================1674086835===========================
Field: <com.example.vsa.valuesetanalysisexample.VsaTest: java.lang.String keypart1>
Solved: true
Depend: 38076305, 
ValueSet: 
   |-1:hardcode,

com.example.vsa.valuesetanalysisexample===========================1568161955===========================
Class: com.example.vsa.valuesetanalysisexample.VsaTest
Method: <com.example.vsa.valuesetanalysisexample.VsaTest: void init(android.content.Context)>
Target: $r0.<com.example.vsa.valuesetanalysisexample.VsaTest: java.lang.String keypart2> = $r2
Solved: true
Depend: 
BackwardContexts: 
  0
    $r2 = virtualinvoke $r3.<android.content.res.Resources: java.lang.String getString(int)>(2131427369)
    $r0.<com.example.vsa.valuesetanalysisexample.VsaTest: java.lang.String keypart2> = $r2
ValueSet: 
   |-1:fromres,

com.example.vsa.valuesetanalysisexample[{"0":["part1:hardcode|part2:fromres"]}]

Citing

If you create a research work that uses our work, please citing the associated paper:

@inproceedings{leakscope:sp19,
  author    = {Chaoshun Zuo and Zhiqiang Lin and Yinqian Zhang} ,
  title     = {Why Does Your Data Leak? Uncovering the Data Leakage in Cloud From Mobile Apps},
  booktitle = {Proceedings of the 2019 IEEE Symposium on Security and Privacy},
  address   = {San Francisco, CA},
  month     = {May},
  year      = 2019,
}