ccs2018.zip_分类_其他_其他下载-pudn.com

<html xmlns="http://www.w3.org/1999/xhtml"><head><meta charset="utf-8"><meta name="generator" content="pdf2htmlEX"><meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1"><link rel="stylesheet" href="https://csdnimg.cn/release/download_crawler_static/css/base.min.css"><link rel="stylesheet" href="https://csdnimg.cn/release/download_crawler_static/css/fancy.min.css"><link rel="stylesheet" href="https://csdnimg.cn/release/download_crawler_static/12728047/raw.css"><script src="https://csdnimg.cn/release/download_crawler_static/js/compatibility.min.js"></script><script src="https://csdnimg.cn/release/download_crawler_static/js/pdf2htmlEX.min.js"></script><script>try{pdf2htmlEX.defaultViewer = new pdf2htmlEX.Viewer({});}catch(e){}</script><title></title></head><body><div id="sidebar" style="display: none"><div id="outline"></div></div><div id="pf1" class="pf w0 h0" data-page-no="1"><div class="pc pc1 w0 h0"><img class="bi x0 y0 w1 h1" alt="" src="https://csdnimg.cn/release/download_crawler_static/12728047/bg1.jpg"><div class="t m0 x1 h2 y1 ff1 fs0 fc0 sc0 ls0 ws0">ClickShield: Are You Hiding Something?</div><div class="t m0 x2 h2 y2 ff1 fs0 fc0 sc0 ls0 ws0">Towards Eradicating Clickjacking on Android</div><div class="t m0 x3 h3 y3 ff2 fs1 fc0 sc0 ls0 ws0">Andrea Possemato</div><div class="t m0 x4 h4 y4 ff2 fs2 fc0 sc0 ls0 ws0">EURECOM, France</div><div class="t m0 x5 h4 y5 ff2 fs2 fc0 sc0 ls0 ws0">andrea.possemato@gmail.com</div><div class="t m0 x6 h3 y3 ff2 fs1 fc0 sc0 ls0 ws0">Andrea Lanzi</div><div class="t m1 x7 h4 y4 ff2 fs2 fc0 sc0 ls0 ws0">Universita’ degli Studi di Milano, Italy</div><div class="t m0 x8 h4 y5 ff2 fs2 fc0 sc0 ls0 ws0">andrea.lanzi@unimi.it</div><div class="t m0 x9 h3 y3 ff2 fs1 fc0 sc0 ls0 ws0">Simon Pak Ho Chung</div><div class="t m0 xa h4 y4 ff2 fs2 fc0 sc0 ls0 ws0">Georgia Institute of Technology, USA</div><div class="t m0 xb h4 y5 ff2 fs2 fc0 sc0 ls0 ws0">pchung34@mail.gatech.edu</div><div class="t m0 xc h3 y6 ff2 fs1 fc0 sc0 ls0 ws0">Wenke Lee</div><div class="t m0 x1 h4 y7 ff2 fs2 fc0 sc0 ls0 ws0">Georgia Institute of Technology, USA</div><div class="t m0 xd h4 y8 ff2 fs2 fc0 sc0 ls0 ws0">wenke.lee@gmail.com</div><div class="t m0 xe h3 y6 ff2 fs1 fc0 sc0 ls0 ws0">Yanick Fratantonio</div><div class="t m0 xf h4 y7 ff2 fs2 fc0 sc0 ls0 ws0">EURECOM, France</div><div class="t m0 x10 h4 y8 ff2 fs2 fc0 sc0 ls0 ws0">yanick.fratantonio@eurecom.fr</div><div class="t m0 x11 h5 y9 ff3 fs3 fc0 sc0 ls0 ws0">ABSTRACT</div><div class="t m2 x11 h6 ya ff2 fs4 fc0 sc0 ls0 ws0">In the context of mobile-based user-interface (UI) attacks, the com-</div><div class="t m3 x11 h6 yb ff2 fs4 fc0 sc0 ls0 ws0">mon belief is that clickjacking is a solved problem. On the contrary,</div><div class="t m4 x11 h6 yc ff2 fs4 fc0 sc0 ls0 ws0">this paper shows that clickjacking is still an open problem for mo-</div><div class="t m3 x11 h6 yd ff2 fs4 fc0 sc0 ls0 ws0">bile devices. In fact, all known academic and industry solutions are</div><div class="t m3 x11 h6 ye ff2 fs4 fc0 sc0 ls0 ws0">either not eective or not applicable in the real-world for backward</div><div class="t m5 x11 h6 yf ff2 fs4 fc0 sc0 ls0 ws0">compatibility reasons. This work shows that, as a consequence,</div><div class="t m6 x11 h6 y10 ff2 fs4 fc0 sc0 ls0 ws0">even popular and sensitive apps like Google Play Store remain, to</div><div class="t m0 x11 h6 y11 ff2 fs4 fc0 sc0 ls0 ws0">date, completely unprotected from clickjacking attacks.</div><div class="t m3 x12 h6 y12 ff2 fs4 fc0 sc0 ls0 ws0">After gathering insights into how apps use the user interface, this</div><div class="t m7 x11 h6 y13 ff2 fs4 fc0 sc0 ls0 ws0">work performs a systematic exploration of the design space for an</div><div class="t m8 x11 h6 y14 ff2 fs4 fc0 sc0 ls0 ws0">eective and practical protection against clickjacking attacks. We</div><div class="t m3 x11 h6 y15 ff2 fs4 fc0 sc0 ls0 ws0">then use this exploration to guide the design of ClickShield, a new</div><div class="t m5 x11 h6 y16 ff2 fs4 fc0 sc0 ls0 ws0">defensive mechanism. To address backward compatibility issues,</div><div class="t m9 x11 h6 y17 ff2 fs4 fc0 sc0 ls0 ws0">our design allows for overlays to cover the screen, and we employ</div><div class="t ma x11 h6 y18 ff2 fs4 fc0 sc0 ls0 ws0">image analysis techniques to determine whether the user could be</div><div class="t m5 x11 h6 y19 ff2 fs4 fc0 sc0 ls0 ws0">confused. We have implemented a prototype and we have tested</div><div class="t mb x11 h6 y1a ff2 fs4 fc0 sc0 ls0 ws0">it against ClickBench, a newly developed benchmark specically</div><div class="t m3 x11 h6 y1b ff2 fs4 fc0 sc0 ls0 ws0">tailored to stress-test clickjacking protection solutions. This dataset</div><div class="t m5 x11 h6 y1c ff2 fs4 fc0 sc0 ls0 ws0">is constituted by 104 test cases, and it includes real-world and</div><div class="t m2 x11 h6 y1d ff2 fs4 fc0 sc0 ls0 ws0">simulated benign and malicious examples that evaluate the system</div><div class="t m7 x11 h6 y1e ff2 fs4 fc0 sc0 ls0 ws0">across a wide range of legitimate and attack scenarios. The results</div><div class="t m5 x11 h6 y1f ff2 fs4 fc0 sc0 ls0 ws0">show that our system is able to address backward compatibility</div><div class="t m3 x11 h6 y20 ff2 fs4 fc0 sc0 ls0 ws0">concerns, to detect all known attacks (including a never-seen-before</div><div class="t m5 x11 h6 y21 ff2 fs4 fc0 sc0 ls0 ws0">real-world malware that was published after we have developed</div><div class="t m0 x11 h6 y22 ff2 fs4 fc0 sc0 ls0 ws0">our solution), and it introduces a negligible overhead.</div><div class="t m0 x11 h7 y23 ff3 fs5 fc0 sc0 ls0 ws0">ACM Reference Format:</div><div class="t m3 x11 h8 y24 ff2 fs5 fc0 sc0 ls0 ws0">Andrea Possemato, Andrea Lanzi, Simon Pak Ho Chung, Wenke Lee, and Yan-</div><div class="t m5 x11 h8 y25 ff2 fs5 fc0 sc0 ls0 ws0">ick Fratantonio. 2018. ClickShield: Are You Hiding Something? Towards</div><div class="t m5 x11 h8 y26 ff2 fs5 fc0 sc0 ls0 ws0">Eradicating Clickjacking on Android. In 2018 ACM SIGSAC Conference</div><div class="t mc x11 h9 y27 ff4 fs5 fc0 sc0 ls0 ws0">on Computer and Communications Security (CCS ’18), October 15–19, 2018,</div><div class="t md x11 h8 y28 ff4 fs5 fc0 sc0 ls0 ws0">Toronto, ON, Canada . ACM, New York, NY, USA, 17 pages. https://doi.org/</div><div class="t m0 x11 h8 y29 ff2 fs5 fc0 sc0 ls0 ws0">10.1145/3243734.3243785</div><div class="t m5 x11 ha y2a ff2 fs6 fc0 sc0 ls0 ws0">Permission to make digital or hard copies of all or part of this work for personal or</div><div class="t me x11 ha y2b ff2 fs6 fc0 sc0 ls0 ws0">classroom use is granted without fee provided that copies are not made or distributed</div><div class="t m3 x11 ha y2c ff2 fs6 fc0 sc0 ls0 ws0">for prot or commercial advantage and that copies bear this notice and the full citation</div><div class="t m3 x11 ha y2d ff2 fs6 fc0 sc0 ls0 ws0">on the rst page. Copyrights for components of this work owned by others than ACM</div><div class="t m3 x11 ha y2e ff2 fs6 fc0 sc0 ls0 ws0">must be honored. Abstracting with credit is permitted. To copy otherwise, or republish,</div><div class="t m3 x11 ha y2f ff2 fs6 fc0 sc0 ls0 ws0">to post on servers or to redistribute to lists, requires prior specic permission and/or a</div><div class="t m0 x11 ha y30 ff2 fs6 fc0 sc0 ls0 ws0">fee. Request permissions from permissions@acm.org.</div><div class="t m0 x11 hb y31 ff4 fs6 fc0 sc0 ls0 ws0">CCS ’18, October 15–19, 2018, Toronto, ON, Canada</div><div class="t m0 x11 ha y32 ff6 fs6 fc0 sc0 ls0 ws0">© 2018 Association for Computing Machinery.</div><div class="t m0 x11 ha y33 ff2 fs6 fc0 sc0 ls0 ws0">ACM ISBN 978-1-4503-5693-0/18/10.. . $15.00</div><div class="t m0 x11 ha y34 ff2 fs6 fc0 sc0 ls0 ws0">https://doi.org/10.1145/3243734.3243785</div><div class="t m0 x13 h5 y9 ff3 fs3 fc0 sc0 ls0 ws0">1 INTRODUCTION</div><div class="t m5 x13 h6 ya ff2 fs4 fc0 sc0 ls0 ws0">Mobile devices are widespread and they have been subject to a</div><div class="t m5 x13 h6 yb ff2 fs4 fc0 sc0 ls0 ws0">signicant corpus of research. One main area of works is about</div><div class="t m5 x13 h6 yc ff2 fs4 fc0 sc0 ls0 ws0">oensive research, which focuses on attacking these devices to</div><div class="t mf x13 h6 yd ff2 fs4 fc0 sc0 ls0 ws0">highlight vulnerabilities. Within this context, a number of recent</div><div class="t m5 x13 h6 ye ff2 fs4 fc0 sc0 ls0 ws0">works has specically focused on the mobile user-interface (UI).</div><div class="t m1 x13 h6 yf ff2 fs4 fc0 sc0 ls0 ws0">Many of these works have focused on the problem of mobile phish-</div><div class="t m6 x13 h6 y10 ff4 fs4 fc0 sc0 ls0 ws0">ing attacks [</div><div class="t m0 x14 h6 y10 ff2 fs4 fc0 sc0 ls0 ws0">4</div><div class="t m6 x15 h6 y10 ff2 fs4 fc0 sc0 ls0 ws0">,</div><div class="t m0 x16 h6 y10 ff2 fs4 fc0 sc0 ls0 ws0">6</div><div class="t m6 x17 h6 y10 ff2 fs4 fc0 sc0 ls0 ws0">,</div><div class="t m0 x18 h6 y10 ff2 fs4 fc0 sc0 ls0 ws0">9</div><div class="t m6 x19 h6 y10 ff2 fs4 fc0 sc0 ls0 ws0">,</div><div class="t m0 x1a h6 y10 ff2 fs4 fc0 sc0 ls0 ws0">14</div><div class="t m6 x1b h6 y10 ff2 fs4 fc0 sc0 ls0 ws0">,</div><div class="t m0 x1c h6 y10 ff2 fs4 fc0 sc0 ls0 ws0">20</div><div class="t m6 x1d h6 y10 ff2 fs4 fc0 sc0 ls0 ws0">]. In such attacks, the user is tricked by a</div><div class="t m10 x13 h6 y11 ff2 fs4 fc0 sc0 ls0 ws0">malicious app into inserting sensitive input (e.g., usernames, pass-</div><div class="t m5 x13 h6 y12 ff2 fs4 fc0 sc0 ls0 ws0">words) into a window that the malicious app controls. The core</div><div class="t m3 x13 h6 y13 ff2 fs4 fc0 sc0 ls0 ws0">issue enabling these attacks is that users cannot understand whether</div><div class="t m2 x13 h6 y14 ff2 fs4 fc0 sc0 ls0 ws0">they are interacting with a legitimate app (like a banking app) or a</div><div class="t m0 x13 h6 y15 ff2 fs4 fc0 sc0 ls0 ws0">malicious one that is spoong the legitimate UI.</div><div class="t ma x1e h6 y16 ff2 fs4 fc0 sc0 ls0 ws0">Another class of attacks against user-interfaces (UI) is clickjack-</div><div class="t m3 x13 h6 y17 ff4 fs4 fc0 sc0 ls0 ws0">ing, which is the focus of this paper. Such attacks work by creating</div><div class="t m4 x13 h6 y18 ff2 fs4 fc0 sc0 ls0 ws0">an opaque overlay that completely covers a security-sensitive app</div><div class="t m3 x13 h6 y19 ff2 fs4 fc0 sc0 ls0 ws0">(such as the Settings app): while the user believes she is interacting</div><div class="t m3 x13 h6 y1a ff2 fs4 fc0 sc0 ls0 ws0">with an innocuous overlay, she is in fact interacting with the target</div><div class="t m5 x13 h6 y1b ff2 fs4 fc0 sc0 ls0 ws0">app on the bottom (and she could unknowingly grant powerful</div><div class="t m0 x13 h6 y1c ff2 fs4 fc0 sc0 ls0 ws0">permissions to a malicious app).</div><div class="t m5 x1e h6 y1d ff2 fs4 fc0 sc0 ls0 ws0">These attacks have been known for several years [</div><div class="t m0 x1f h6 y1d ff2 fs4 fc0 sc0 ls0 ws0">1</div><div class="t m5 x20 h6 y1d ff2 fs4 fc0 sc0 ls0 ws0">,</div><div class="t m0 x21 h6 y1d ff2 fs4 fc0 sc0 ls0 ws0">2</div><div class="t m5 x22 h6 y1d ff2 fs4 fc0 sc0 ls0 ws0">,</div><div class="t m0 x23 h6 y1d ff2 fs4 fc0 sc0 ls0 ws0">17</div><div class="t m5 x24 h6 y1d ff2 fs4 fc0 sc0 ls0 ws0">,</div><div class="t m0 x25 h6 y1d ff2 fs4 fc0 sc0 ls0 ws0">24</div><div class="t m5 x26 h6 y1d ff2 fs4 fc0 sc0 ls0 ws0">,</div><div class="t m0 x13 h6 y1e ff2 fs4 fc0 sc0 ls0 ws0">26</div><div class="t m5 x27 h6 y1e ff2 fs4 fc0 sc0 ls0 ws0">,</div><div class="t m0 x28 h6 y1e ff2 fs4 fc0 sc0 ls0 ws0">30</div><div class="t m5 x29 h6 y1e ff2 fs4 fc0 sc0 ls0 ws0">,</div><div class="t m0 x2a h6 y1e ff2 fs4 fc0 sc0 ls0 ws0">31</div><div class="t m5 x2b h6 y1e ff2 fs4 fc0 sc0 ls0 ws0">] and, in response, Google has implemented a security</div><div class="t m5 x13 h6 y1f ff2 fs4 fc0 sc0 ls0 ws0">mechanism called “obscured ag.” Such protection allows apps</div><div class="t m5 x13 h6 y20 ff2 fs4 fc0 sc0 ls0 ws0">to detect whether, at the moment of the click, a sensitive widget</div><div class="t m3 x13 h6 y21 ff2 fs4 fc0 sc0 ls0 ws0">button was covered by an overlay and, if that is the case, apps have a</div><div class="t m3 x13 h6 y22 ff2 fs4 fc0 sc0 ls0 ws0">chance to refuse the click. Google adopted this security mechanism</div><div class="t m11 x13 h6 y35 ff2 fs4 fc0 sc0 ls0 ws0">to protect the most security-sensitive of its Android apps, such as</div><div class="t m0 x13 h6 y36 ff2 fs4 fc0 sc0 ls0 ws0">the Settings app.</div><div class="t me x1e h6 y37 ff2 fs4 fc0 sc0 ls0 ws0">However, a recent work called Cloak & Dagger (C&D from now</div><div class="t m3 x13 h6 y38 ff2 fs4 fc0 sc0 ls0 ws0">on) showed how this defense mechanism can be bypassed [</div><div class="t m0 x2c h6 y38 ff2 fs4 fc0 sc0 ls0 ws0">10</div><div class="t m3 x2d h6 y38 ff2 fs4 fc0 sc0 ls0 ws0">]. The</div><div class="t m9 x13 h6 y39 ff2 fs4 fc0 sc0 ls0 ws0">authors of this work developed a new attack, called context-hiding</div><div class="t m3 x13 h6 y3a ff4 fs4 fc0 sc0 ls0 ws0">attack, which consists in covering the entire screen except the target</div><div class="t m12 x13 h6 y3b ff2 fs4 fc0 sc0 ls0 ws0">button: In this way, the obscured ag protection does not trigger</div><div class="t m13 x13 h6 y3c ff2 fs4 fc0 sc0 ls0 ws0">and, at the same time, the attacker is still able to confuse the user</div><div class="t m0 x13 h6 y3d ff2 fs4 fc0 sc0 ls0 ws0">by hiding all the relevant security-sensitive context information.</div><div class="t m5 x1e h6 y3e ff2 fs4 fc0 sc0 ls0 ws0">In response to this attack, Google implemented an additional</div><div class="t m12 x13 h6 y3f ff2 fs4 fc0 sc0 ls0 ws0">defensive mechanism: in recent versions of Android, when users</div><div class="t m5 x13 h6 y40 ff2 fs4 fc0 sc0 ls0 ws0">browse to the accessibility service menu (the main target of the</div><div class="t m3 x13 h6 y41 ff2 fs4 fc0 sc0 ls0 ws0">C&D work), all overlays drawn on top disappear. To the best of our</div><div class="t m13 x13 h6 y42 ff2 fs4 fc0 sc0 ls0 ws0">knowledge, this hide overlays defense mechanism is sucient to</div><div class="t m5 x13 h6 y43 ff2 fs4 fc0 sc0 ls0 ws0">defeat clickjacking attacks (including C&D), mainly because the</div><div class="t m3 x13 h6 y44 ff2 fs4 fc0 sc0 ls0 ws0">attacker does not have any possibility to confuse the user anymore.</div><div class="t m5 x13 h6 y45 ff2 fs4 fc0 sc0 ls0 ws0">The common belief is thus that clickjacking is overall a solved</div><div class="c x11 y46 w2 hc"><div class="t m0 x0 hd y47 ff7 fs7 fc0 sc0 ls0 ws0">Session 6B: Mobile 1</div></div><div class="c x2e y46 w3 hc"><div class="t m0 x0 hd y47 ff7 fs7 fc0 sc0 ls0 ws0">CCS’18, October 15-19, 2018, Toronto, ON, Canada</div></div><div class="c x2f y48 w4 hc"><div class="t m0 x0 hd y47 ff7 fs7 fc0 sc0 ls0 ws0">1120</div></div><a class="l" rel='nofollow' onclick='return false;'><div class="d m14"></div></a><a class="l" rel='nofollow' onclick='return false;'><div class="d m14"></div></a><a class="l" rel='nofollow' onclick='return false;'><div class="d m14"></div></a><a class="l" rel='nofollow' onclick='return false;'><div class="d m14"></div></a><a class="l" rel='nofollow' onclick='return false;'><div class="d m14"></div></a><a class="l" rel='nofollow' onclick='return false;'><div class="d m14"></div></a><a class="l" rel='nofollow' onclick='return false;'><div class="d m14"></div></a><a class="l" rel='nofollow' onclick='return false;'><div class="d m14"></div></a><a class="l" rel='nofollow' onclick='return false;'><div class="d m14"></div></a><a class="l" rel='nofollow' onclick='return false;'><div class="d m14"></div></a><a class="l" rel='nofollow' onclick='return false;'><div class="d m14"></div></a><a class="l" rel='nofollow' onclick='return false;'><div class="d m14"></div></a><a class="l" rel='nofollow' onclick='return false;'><div class="d m14"></div></a><a class="l" rel='nofollow' onclick='return false;'><div class="d m14"></div></a><a class="l" rel='nofollow' onclick='return false;'><div class="d m14"></div></a><a class="l" rel='nofollow' onclick='return false;'><div class="d m14"></div></a><a class="l" rel='nofollow' onclick='return false;'><div class="d m14"></div></a></div><div class="pi" data-data='{"ctm":[1.568627,0.000000,0.000000,1.568627,0.000000,0.000000]}'></div></div></body></html>

<div id="pf2" class="pf w0 h0" data-page-no="2"><div class="pc pc2 w0 h0"><img class="bi x0 y0 w1 h1" alt="" src="https://csdnimg.cn/release/download_crawler_static/12728047/bg2.jpg"><div class="t m3 x11 h6 y49 ff2 fs4 fc0 sc0 ls0 ws0">problem in mobile devices context. This paper, however, shows that</div><div class="t m0 x11 h6 y4a ff2 fs4 fc0 sc0 ls0 ws0">this is not the case.</div><div class="t m0 x11 he y4b ff3 fs4 fc0 sc0 ls0 ws0">Clickjacking on mobile is an open problem.</div><div class="t m5 x30 h6 y4b ff2 fs4 fc0 sc0 ls0 ws0">Clickjacking is</div><div class="t m3 x11 h6 y4c ff2 fs4 fc0 sc0 ls0 ws0">not a one-o bug—it is caused by a design issue—and it is very chal-</div><div class="t m15 x11 h6 y4d ff2 fs4 fc0 sc0 ls0 ws0">lenging to prevent in the general case. In fact, the “hide overlays”</div><div class="t m5 x11 h6 y4e ff2 fs4 fc0 sc0 ls0 ws0">defense from Google, while being eective, has two fundamen-</div><div class="t m13 x11 h6 y4f ff2 fs4 fc0 sc0 ls0 ws0">tal problems. First, we have identied several popular apps (with</div><div class="t m3 x11 h6 y50 ff2 fs4 fc0 sc0 ls0 ws0">millions of users) whose core functionality—to act as a screen lter—</div><div class="t m16 x11 h6 y51 ff2 fs4 fc0 sc0 ls0 ws0">specically relies on creating persistent on-top fullscreen overlays.</div><div class="t me x11 h6 y52 ff2 fs4 fc0 sc0 ls0 ws0">Thus, Google’s defense cannot be widely adopted due to backward</div><div class="t m0 x11 h6 y53 ff2 fs4 fc0 sc0 ls0 ws0">compatibility issues—it would in fact aect the user experience of</div><div class="t m17 x11 h6 y54 ff2 fs4 fc0 sc0 ls0 ws0">all these apps with frequent interferences and ickering problems.</div><div class="t md x11 h6 y55 ff2 fs4 fc0 sc0 ls0 ws0">Second, as we will show in this paper, Google deployed this x to</div><div class="t m5 x11 h6 y56 ff2 fs4 fc0 sc0 ls0 ws0">protect parts of the Settings app, but many other apps including</div><div class="t m3 x11 h6 y57 ff2 fs4 fc0 sc0 ls0 ws0">Google own apps, such as the Google Play Store, and other popular</div><div class="t m12 x11 h6 y58 ff2 fs4 fc0 sc0 ls0 ws0">third-party apps are left completely unprotected. We believe this</div><div class="t m5 x11 h6 y59 ff2 fs4 fc0 sc0 ls0 ws0">is due to the backward compatibility concerns mentioned above.</div><div class="t m5 x11 h6 y5a ff2 fs4 fc0 sc0 ls0 ws0">We note that the best defense available to third-party apps, the</div><div class="t m18 x11 h6 y5b ff2 fs4 fc0 sc0 ls0 ws0">obscured ag, would also break the user experience for millions of</div><div class="t m0 x11 h6 y5c ff2 fs4 fc0 sc0 ls0 ws0">users.</div><div class="t m0 x11 he y5d ff3 fs4 fc0 sc0 ls0 ws0">The design space for a practical defense.</div><div class="t m9 x31 h6 y5d ff2 fs4 fc0 sc0 ls0 ws0">Solving this problem</div><div class="t m5 x11 h6 y5e ff2 fs4 fc0 sc0 ls0 ws0">in the general case is very challenging since we need to design a</div><div class="t m5 x11 h6 y5f ff2 fs4 fc0 sc0 ls0 ws0">protection system that is eective and, at same time, it does not</div><div class="t m3 x11 h6 y60 ff2 fs4 fc0 sc0 ls0 ws0">break compatibility with existing apps. There are multiple proposed</div><div class="t m8 x11 h6 y61 ff2 fs4 fc0 sc0 ls0 ws0">solutions, from both the academic and industry communities: We</div><div class="t m19 x11 h6 y62 ff2 fs4 fc0 sc0 ls0 ws0">show that none of these are both eective (in preventing attacks)</div><div class="t m5 x11 h6 y63 ff2 fs4 fc0 sc0 ls0 ws0">and practical (especially when applied in all new existing attack</div><div class="t m0 x11 h6 y64 ff2 fs4 fc0 sc0 ls0 ws0">scenarios described in this paper).</div><div class="t m5 x12 h6 y65 ff2 fs4 fc0 sc0 ls0 ws0">To prevent the design of another problematic solution, in this</div><div class="t m1a x11 h6 y66 ff2 fs4 fc0 sc0 ls0 ws0">paper we rst gather insights on how apps use the user interface,</div><div class="t m9 x11 h6 y67 ff2 fs4 fc0 sc0 ls0 ws0">and we then systematically explore the design space by drawing a</div><div class="t m3 x11 h6 y68 ff2 fs4 fc0 sc0 ls0 ws0">number of observations that, independently from a given proposed</div><div class="t m3 x11 h6 y69 ff2 fs4 fc0 sc0 ls0 ws0">solution, we believe must all be taken into account when designing</div><div class="t m3 x11 h6 y6a ff2 fs4 fc0 sc0 ls0 ws0">a system that is both eective and practical. This exploration guided</div><div class="t m5 x11 h6 y6b ff2 fs4 fc0 sc0 ls0 ws0">us to the design of a new protection mechanism, dubbed Click-</div><div class="t m5 x11 h6 y6c ff5 fs4 fc0 sc0 ls0 ws0">Shield. Our defense diers from existing ones because it tackles</div><div class="t m0 x11 h6 y6d ff2 fs4 fc0 sc0 ls0 ws0">the problem of clickjacking at its root: the possibility of deceiving</div><div class="t md x11 h6 y6e ff2 fs4 fc0 sc0 ls0 ws0">the user. We thus do not focus on the many technical ways single</div><div class="t m3 x11 h6 y6f ff2 fs4 fc0 sc0 ls0 ws0">overlays can be created—too many to be properly enumerated—and</div><div class="t m9 x11 h6 y70 ff2 fs4 fc0 sc0 ls0 ws0">we focus instead of the net eect that these overlays have on what</div><div class="t m5 x11 h6 y71 ff2 fs4 fc0 sc0 ls0 ws0">the user actually sees on the screen. To this end, we devised e-</div><div class="t m3 x11 h6 y72 ff2 fs4 fc0 sc0 ls0 ws0">cient techniques based on image analysis to answer questions such</div><div class="t m5 x11 h6 y73 ff2 fs4 fc0 sc0 ls0 ws0">as is what the user seeing dierent than what the target app would</div><div class="t m5 x11 hf y74 ff4 fs4 fc0 sc0 ls0 ws0">have liked to display? Was the view from the target app modied?</div><div class="t m8 x11 hf y75 ff4 fs4 fc0 sc0 ls0 ws0">If yes, was it modie d in a uniform way so that the full (potentially</div><div class="t m0 x11 hf y76 ff4 fs4 fc0 sc0 ls0 ws0">security-related) context is still available for the user?</div><div class="t md x12 h6 y77 ff2 fs4 fc0 sc0 ls0 ws0">We have implemented a prototype of this system, and we have</div><div class="t m3 x11 h6 y78 ff2 fs4 fc0 sc0 ls0 ws0">tested it against ClickBench, a newly developed benchmark specif-</div><div class="t m1b x11 h6 y79 ff2 fs4 fc0 sc0 ls0 ws0">ically tailored to stress-test clickjacking protection solutions. This</div><div class="t m1a x11 h6 y7a ff2 fs4 fc0 sc0 ls0 ws0">dataset is constituted by 104 test cases, and it includes real-world</div><div class="t m5 x11 h6 y7b ff2 fs4 fc0 sc0 ls0 ws0">and simulated benign and malicious examples that evaluate the</div><div class="t m1b x11 h6 y7c ff2 fs4 fc0 sc0 ls0 ws0">system across a wide range of legitimate and attack scenarios. We</div><div class="t me x11 h6 y7d ff2 fs4 fc0 sc0 ls0 ws0">note that some of these test cases have been developed specically</div><div class="t mf x11 h6 y7e ff2 fs4 fc0 sc0 ls0 ws0">to evade our own system and that we included in the benchmark</div><div class="t m3 x11 h6 y7f ff2 fs4 fc0 sc0 ls0 ws0">even a never-seen-before real-world malware sample that was made</div><div class="t m5 x13 h6 y49 ff2 fs4 fc0 sc0 ls0 ws0">public after we had nalized our prototype. Nonetheless, Click-</div><div class="t m9 x13 h6 y4a ff5 fs4 fc0 sc0 ls0 ws0">Shield is able to detect all attack scenarios without being aected</div><div class="t m2 x13 h6 y80 ff2 fs4 fc0 sc0 ls0 ws0">by backward compatibility concerns. Moreover, our proposal has a</div><div class="t m9 x13 h6 y81 ff2 fs4 fc0 sc0 ls0 ws0">negligible performance impact, and it is thus suitable for adoption</div><div class="t m1c x13 h6 y82 ff2 fs4 fc0 sc0 ls0 ws0">on mobile devices. We believe ClickShield to be the rst practical</div><div class="t m12 x13 h6 y83 ff2 fs4 fc0 sc0 ls0 ws0">approach that has the potential to fully eradicate clickjacking on</div><div class="t m0 x13 h6 y84 ff2 fs4 fc0 sc0 ls0 ws0">Android.</div><div class="t m0 x13 h6 y85 ff2 fs4 fc0 sc0 ls0 ws0">In summary, this paper makes the following contributions:</div><div class="t m0 x32 h10 y86 ff8 fs4 fc0 sc0 ls0 ws0">•</div><div class="t m1d x33 h6 y86 ff2 fs4 fc0 sc0 ls0 ws0">We highlight how clickjacking on mobile devices is still an</div><div class="t m3 x33 h6 y87 ff2 fs4 fc0 sc0 ls0 ws0">open problem and how the attack surface is much wider than</div><div class="t m0 xe h6 y88 ff2 fs4 fc0 sc0 ls0 ws0">what previously thought.</div><div class="t m0 x32 h10 y89 ff8 fs4 fc0 sc0 ls0 ws0">•</div><div class="t m5 x33 h6 y89 ff2 fs4 fc0 sc0 ls0 ws0">We show how current defense mechanisms fall short and</div><div class="t m5 xe h6 y8a ff2 fs4 fc0 sc0 ls0 ws0">we discuss the main challenge Google is facing: backward</div><div class="t m1e x33 h6 y8b ff2 fs4 fc0 sc0 ls0 ws0">compatibility issues, which would break core functionality</div><div class="t m0 x33 h6 y8c ff2 fs4 fc0 sc0 ls0 ws0">of popular apps used by millions of users.</div><div class="t m0 x32 h10 y8d ff8 fs4 fc0 sc0 ls0 ws0">•</div><div class="t m3 x33 h6 y8d ff2 fs4 fc0 sc0 ls0 ws0">We gather insights on how apps use the user interface and we</div><div class="t m17 x33 h6 y8e ff2 fs4 fc0 sc0 ls0 ws0">systematically explore the design space for an eective and</div><div class="t m10 x33 h6 y8f ff2 fs4 fc0 sc0 ls0 ws0">practical defense mechanism. We build on these insights to</div><div class="t m16 x33 h6 y90 ff2 fs4 fc0 sc0 ls0 ws0">design ClickShield, a novel defense mechanism for mobile</div><div class="t m0 x33 h6 y91 ff2 fs4 fc0 sc0 ls0 ws0">clickjacking.</div><div class="t m0 x32 h10 y92 ff8 fs4 fc0 sc0 ls0 ws0">•</div><div class="t m5 x33 h6 y92 ff2 fs4 fc0 sc0 ls0 ws0">We evaluate ClickShield against ClickBench, the rst</div><div class="t m16 x33 h6 y93 ff2 fs4 fc0 sc0 ls0 ws0">benchmark dataset for clickjacking solutions. We show that</div><div class="t me x33 h6 y94 ff2 fs4 fc0 sc0 ls0 ws0">our system is eective at stopping the threat of clickjacking</div><div class="t m0 x33 h6 y95 ff2 fs4 fc0 sc0 ls0 ws0">and it addresses backward compatibility concerns.</div><div class="t m5 x13 h6 y96 ff2 fs4 fc0 sc0 ls0 ws0">To ease the reproducibility of this work, we will publicly release</div><div class="t m0 x13 h6 y97 ff2 fs4 fc0 sc0 ls0 ws0">our prototype and our benchmark dataset.</div><div class="t m0 x13 h5 y98 ff3 fs3 fc0 sc0 ls0 ws0">2 BACKGROUND ON ANDROID UI</div><div class="t m3 x13 h6 y99 ff2 fs4 fc0 sc0 ls0 ws0">In Android, third-party apps having the SYSTEM_ALERT_WINDOW</div><div class="t m3 x13 h6 y9a ff2 fs4 fc0 sc0 ls0 ws0">permission have the ability to create arbitrary windows, also known</div><div class="t m5 x13 h6 y9b ff2 fs4 fc0 sc0 ls0 ws0">as overlays, that are rendered on top of the current activity. For</div><div class="t m5 x13 h6 y9c ff2 fs4 fc0 sc0 ls0 ws0">apps hosted on the ocial Google Play Store, this permission is</div><div class="t m5 x13 h6 y9d ff2 fs4 fc0 sc0 ls0 ws0">automatically granted, without the user being notied about it.</div><div class="t m3 x13 h6 y9e ff2 fs4 fc0 sc0 ls0 ws0">Apps have complete control over the overlays they create. In partic-</div><div class="t m1 x13 h6 y9f ff2 fs4 fc0 sc0 ls0 ws0">ular, they can control their size and position, and whether they are</div><div class="t m5 x13 h6 ya0 ff2 fs4 fc0 sc0 ls0 ws0">opaque or (semi-)transparent. Apps can also create overlays that</div><div class="t m10 x13 h6 ya1 ff2 fs4 fc0 sc0 ls0 ws0">are either clickable (i.e., when the user clicks on them, the overlay</div><div class="t m1f x13 h6 ya2 ff2 fs4 fc0 sc0 ls0 ws0">will capture the click) or passthrough (i.e., the click is not captured</div><div class="t m5 x13 h6 ya3 ff2 fs4 fc0 sc0 ls0 ws0">by the overlay and it is passed to the overlay or activity beneath</div><div class="t m20 x13 h6 ya4 ff2 fs4 fc0 sc0 ls0 ws0">it). Starting from Android 8.0, apps are forbidden to draw overlays</div><div class="t m5 x13 h6 ya5 ff2 fs4 fc0 sc0 ls0 ws0">on top of the lock screen, the status bar, and the navigation bar.</div><div class="t m3 x13 h6 ya6 ff2 fs4 fc0 sc0 ls0 ws0">While these new constraints are an eective protection against ran-</div><div class="t m3 x13 h6 ya7 ff2 fs4 fc0 sc0 ls0 ws0">somware (because it does not have a chance to completely lock the</div><div class="t m1e x13 h6 ya8 ff2 fs4 fc0 sc0 ls0 ws0">device), they have no impact against clickjacking attacks because</div><div class="t m0 x13 h6 ya9 ff2 fs4 fc0 sc0 ls0 ws0">overlaying these sensitive UI components is not relevant.</div><div class="t m0 x13 h5 yaa ff3 fs3 fc0 sc0 ls0 ws0">3 CLICKJACKING ON ANDROID</div><div class="t m1d x13 h6 yab ff2 fs4 fc0 sc0 ls0 ws0">This section discusses current techniques to perform clickjacking</div><div class="t m16 x13 h6 yac ff2 fs4 fc0 sc0 ls0 ws0">on Android and the security mechanisms in place to prevent them.</div><div class="t m0 x13 he yad ff3 fs4 fc0 sc0 ls0 ws0">Traditional clickjacking attack.</div><div class="t m5 x34 h6 yad ff2 fs4 fc0 sc0 ls0 ws0">The essence of a clickjacking</div><div class="t m3 x13 h6 yae ff2 fs4 fc0 sc0 ls0 ws0">attack is about confusing the user and luring her to perform a “click”</div><div class="t m6 x13 h6 yaf ff2 fs4 fc0 sc0 ls0 ws0">action so that the attacker achieves her malicious goals (e.g., addi-</div><div class="t m5 x13 h6 yb0 ff2 fs4 fc0 sc0 ls0 ws0">tional permissions are granted). Traditional clickjacking attacks,</div><div class="t m21 x13 h6 yb1 ff2 fs4 fc0 sc0 ls0 ws0">introduced in [</div><div class="t m0 x35 h6 yb1 ff2 fs4 fc0 sc0 ls0 ws0">17</div><div class="t m21 x36 h6 yb1 ff2 fs4 fc0 sc0 ls0 ws0">], consist in the following steps: 1) The attacker</div><div class="t m5 x13 h6 yb2 ff2 fs4 fc0 sc0 ls0 ws0">creates an overlay that is fullscreen, opaque, and passthrough; 2)</div><div class="c x11 y46 w2 hc"><div class="t m0 x0 hd y47 ff7 fs7 fc0 sc0 ls0 ws0">Session 6B: Mobile 1</div></div><div class="c x2e y46 w3 hc"><div class="t m0 x0 hd y47 ff7 fs7 fc0 sc0 ls0 ws0">CCS’18, October 15-19, 2018, Toronto, ON, Canada</div></div><div class="c x2f y48 w4 hc"><div class="t m0 x0 hd y47 ff7 fs7 fc0 sc0 ls0 ws0">1121</div></div><a class="l" rel='nofollow' onclick='return false;'><div class="d m14"></div></a></div><div class="pi" data-data='{"ctm":[1.568627,0.000000,0.000000,1.568627,0.000000,0.000000]}'></div></div>

<div id="pf3" class="pf w0 h0" data-page-no="3"><div class="pc pc3 w0 h0"><img class="bi x0 y0 w1 h1" alt="" src="https://csdnimg.cn/release/download_crawler_static/12728047/bg3.jpg"><div class="t ma x11 h6 y49 ff2 fs4 fc0 sc0 ls0 ws0">Unbeknownst to the user, the attacker spawns the victim app (e.g.,</div><div class="t m1a x11 h6 y4a ff2 fs4 fc0 sc0 ls0 ws0">the Android Settings app) below the opaque overlay; 3) The mali-</div><div class="t m22 x11 h6 y80 ff2 fs4 fc0 sc0 ls0 ws0">cious app lures the user to click on a specic point on the screen;</div><div class="t m11 x11 h6 y81 ff2 fs4 fc0 sc0 ls0 ws0">and 4) The click passes through the opaque overlay and reaches a</div><div class="t m3 x11 h6 y82 ff2 fs4 fc0 sc0 ls0 ws0">security-sensitive button beneath the malicious app, at which point</div><div class="t m0 x11 h6 y83 ff2 fs4 fc0 sc0 ls0 ws0">the attack is completed.</div><div class="t m5 x12 h6 y84 ff2 fs4 fc0 sc0 ls0 ws0">While the steps above focus on hijacking one single click, the</div><div class="t m6 x11 h6 y85 ff2 fs4 fc0 sc0 ls0 ws0">recent Cloak & Dagger work [</div><div class="t m0 x37 h6 y85 ff2 fs4 fc0 sc0 ls0 ws0">10</div><div class="t m6 x38 h6 y85 ff2 fs4 fc0 sc0 ls0 ws0">] showed how this technique can</div><div class="t m5 x11 h6 yb3 ff2 fs4 fc0 sc0 ls0 ws0">be easily extended to a multi-click scenario: by using a combina-</div><div class="t m1e x11 h6 yb4 ff2 fs4 fc0 sc0 ls0 ws0">tion of ags when creating the overlays, the attacker can create a</div><div class="t m1d x11 h6 yb5 ff2 fs4 fc0 sc0 ls0 ws0">side-channel to infer that the user has just clicked where she was</div><div class="t m5 x11 h6 yb6 ff2 fs4 fc0 sc0 ls0 ws0">supposed to click; upon the reception of this “signal,” it can then</div><div class="t m5 x11 h6 yb7 ff2 fs4 fc0 sc0 ls0 ws0">modify the on-top overlays to lure the user to click on the next</div><div class="t m3 x11 h6 yb8 ff2 fs4 fc0 sc0 ls0 ws0">button. Of course, the higher the number of clicks required, the less</div><div class="t m16 x11 h6 yb9 ff2 fs4 fc0 sc0 ls0 ws0">practical the attack is. However, the authors of C&D work showed</div><div class="t mc x11 h6 yba ff2 fs4 fc0 sc0 ls0 ws0">through a user study that even an attack requiring three clicks is</div><div class="t m0 x11 h6 ybb ff2 fs4 fc0 sc0 ls0 ws0">very practical.</div><div class="t m0 x11 he ybc ff3 fs4 fc0 sc0 ls0 ws0">Obscured ag defense.</div><div class="t m3 x39 h6 ybc ff2 fs4 fc0 sc0 ls0 ws0">To protect from these threats, Google im-</div><div class="t m5 x11 h6 ybd ff2 fs4 fc0 sc0 ls0 ws0">plemented a mechanism to allow apps (both Google’s own and</div><div class="t m5 x11 h6 ybe ff2 fs4 fc0 sc0 ls0 ws0">third-party ones) to protect themselves. This mechanism, called</div><div class="t m13 x3a h6 ybf ff2 fs4 fc0 sc0 ls0 ws0">“obscured ag,” works by signaling (via a boolean ag) to</div><div class="t m0 x3b h11 ybf ff9 fs4 fc0 sc0 ls0 ws0">Button</div><div class="t m5 x11 h6 yc0 ff2 fs4 fc0 sc0 ls0 ws0">widgets that, when the click was performed, an overlay was cov-</div><div class="t m23 x11 h6 yc1 ff2 fs4 fc0 sc0 ls0 ws0">ering (or “obscuring”) it, independently from whether the on-top</div><div class="t mf x11 h6 yc2 ff2 fs4 fc0 sc0 ls0 ws0">overlay is opaque or transparent. This is how the Android frame-</div><div class="t m1d x11 h6 yc3 ff2 fs4 fc0 sc0 ls0 ws0">work signals to an app the possibility of an on-going clickjacking</div><div class="t m3 x11 h6 yc4 ff2 fs4 fc0 sc0 ls0 ws0">attack. Google adopted this mechanism to protect its most sensitive</div><div class="t m0 x11 h6 yc5 ff2 fs4 fc0 sc0 ls0 ws0">Android apps, such as the Settings app.</div><div class="t m0 x11 he yc6 ff3 fs4 fc0 sc0 ls0 ws0">Context-hiding attack.</div><div class="t m12 x1 h6 yc6 ff2 fs4 fc0 sc0 ls0 ws0">Although the obscured ag mechanism</div><div class="t m5 x11 h6 yc7 ff2 fs4 fc0 sc0 ls0 ws0">raises the bar for attacks, it was recently discovered to be easily</div><div class="t m5 x11 h6 yc8 ff2 fs4 fc0 sc0 ls0 ws0">bypassable, with a technique called “context-hiding attack” [</div><div class="t m0 x3c h6 yc8 ff2 fs4 fc0 sc0 ls0 ws0">10</div><div class="t m5 x3d h6 yc8 ff2 fs4 fc0 sc0 ls0 ws0">].</div><div class="t m5 x11 h6 yc9 ff2 fs4 fc0 sc0 ls0 ws0">The key observation behind this technique is that as long as an</div><div class="t m24 x11 h6 yca ff2 fs4 fc0 sc0 ls0 ws0">attacker can hide the real, security-sensitive context surrounding a</div><div class="t m3 x11 h6 ycb ff2 fs4 fc0 sc0 ls0 ws0">generic OK button, it is easy to lure the user to click on it. Thus, by</div><div class="t m3 x11 h6 ycc ff2 fs4 fc0 sc0 ls0 ws0">covering the entire screen except the target OK button, the obscured</div><div class="t m0 x11 h6 ycd ff2 fs4 fc0 sc0 ls0 ws0">ag defense can be bypassed.</div><div class="t m0 x11 he yce ff3 fs4 fc0 sc0 ls0 ws0">Hide overlays defense.</div><div class="t m19 x39 h6 yce ff2 fs4 fc0 sc0 ls0 ws0">Finally, to counter the threat of context-</div><div class="t m21 x11 h6 ycf ff2 fs4 fc0 sc0 ls0 ws0">hiding attack, Google implemented a new defense mechanism to</div><div class="t m5 x11 h6 yd0 ff2 fs4 fc0 sc0 ls0 ws0">prevent it: in modern versions of Android (from Android 7.1.2),</div><div class="t m25 x11 h6 yd1 ff2 fs4 fc0 sc0 ls0 ws0">when the user browses to the accessibility service menu or permis-</div><div class="t m9 x11 h6 yd2 ff2 fs4 fc0 sc0 ls0 ws0">sion settings, all overlays are hidden, thus removing the possibility</div><div class="t m0 x11 h6 yd3 ff2 fs4 fc0 sc0 ls0 ws0">for the user to be confused (and for malware to mount an attack).</div><div class="t m0 x11 he yd4 ff3 fs4 fc0 sc0 ls0 ws0">Current Limitations.</div><div class="t m3 x3e h6 yd4 ff2 fs4 fc0 sc0 ls0 ws0">The “Hide overlay” defense is very eective:</div><div class="t m18 x11 h6 yd5 ff2 fs4 fc0 sc0 ls0 ws0">Since all the on-top overlays are hidden, there is no chance for the</div><div class="t m5 x11 h6 yd6 ff2 fs4 fc0 sc0 ls0 ws0">attacker to confuse the user, and, to the best of our knowledge,</div><div class="t m3 x11 h6 yd7 ff2 fs4 fc0 sc0 ls0 ws0">clickjacking is thus prevented. However, this mechanism is very ag-</div><div class="t m3 x11 h6 yd8 ff2 fs4 fc0 sc0 ls0 ws0">gressive and, as we will describe in Section 6, it has two limitations.</div><div class="t m5 x11 h6 yd9 ff2 fs4 fc0 sc0 ls0 ws0">First, it is too powerful to be made available to third-party apps,</div><div class="t m5 x11 h6 yda ff2 fs4 fc0 sc0 ls0 ws0">which thus remain unprotected. Second, it creates a number of</div><div class="t m3 x11 h6 ydb ff2 fs4 fc0 sc0 ls0 ws0">severe backward compatibility issues, which would break the main</div><div class="t mc x11 h6 ydc ff2 fs4 fc0 sc0 ls0 ws0">functionality of apps installed by millions of users. The obscured</div><div class="t m3 x11 h6 ydd ff2 fs4 fc0 sc0 ls0 ws0">ag mechanism is aected by similar backward compatibility issues.</div><div class="t m1c x11 h6 yde ff2 fs4 fc0 sc0 ls0 ws0">It is in fact not uncommon to read about users puzzled by usability</div><div class="t m3 x11 h6 ydf ff2 fs4 fc0 sc0 ls0 ws0">problems due to these mechanisms [</div><div class="t m0 x3f h6 ydf ff2 fs4 fc0 sc0 ls0 ws0">27</div><div class="t m3 x40 h6 ydf ff2 fs4 fc0 sc0 ls0 ws0">]. This aspect pushed Google</div><div class="t m5 x11 h6 ye0 ff2 fs4 fc0 sc0 ls0 ws0">to adopt this security mechanism only to protect the most sensi-</div><div class="t m26 x11 h6 ye1 ff2 fs4 fc0 sc0 ls0 ws0">tive parts of the Android system (such as the permission granting</div><div class="t m1a x13 h6 y49 ff2 fs4 fc0 sc0 ls0 ws0">popups), leaving many sensitive Google-owned apps (such as the</div><div class="t m0 x13 h6 y4a ff2 fs4 fc0 sc0 ls0 ws0">Google Play Store app) completely unprotected.</div><div class="t m0 x13 h5 ye2 ff3 fs3 fc0 sc0 ls0 ws0">4 NEW ATTACK SCENARIOS</div><div class="t m5 x13 h6 ye3 ff2 fs4 fc0 sc0 ls0 ws0">This section discusses known and several previously unknown</div><div class="t m5 x13 h6 ye4 ff2 fs4 fc0 sc0 ls0 ws0">clickjacking attack scenarios. The feasibility of these attacks has</div><div class="t m5 x13 h6 ye5 ff2 fs4 fc0 sc0 ls0 ws0">been tested on a fully updated Nexus 5X running the latest ver-</div><div class="t m27 x13 h6 ye6 ff2 fs4 fc0 sc0 ls0 ws0">sion of Android (8.0) available at the time of writing. For the sake</div><div class="t m13 x13 h6 ye7 ff2 fs4 fc0 sc0 ls0 ws0">of completeness, we include in this discussion previously known</div><div class="t m5 x13 h6 ye8 ff2 fs4 fc0 sc0 ls0 ws0">examples that are now prevented by currently deployed security</div><div class="t m4 x13 h6 ye9 ff2 fs4 fc0 sc0 ls0 ws0">mechanisms. The list of attacks, their feasibility, and their novelty</div><div class="t m0 x13 h6 yea ff2 fs4 fc0 sc0 ls0 ws0">are systematize in Table 2, in the Appendix.</div><div class="t m5 x1e h6 yeb ff2 fs4 fc0 sc0 ls0 ws0">Previous works have shown how clickjacking can be used to</div><div class="t m3 x13 h6 yec ff2 fs4 fc0 sc0 ls0 ws0">lure the user to unknowingly grant additional permissions (e.g., the</div><div class="t m3 x41 h6 yed ff2 fs4 fc0 sc0 ls0 ws0">“location” permission) or even to enable accessibility service shown</div><div class="t m28 x13 h6 yee ff2 fs4 fc0 sc0 ls0 ws0">to be enough to fully compromise the device [</div><div class="t m0 x42 h6 yee ff2 fs4 fc0 sc0 ls0 ws0">10</div><div class="t m28 x43 h6 yee ff2 fs4 fc0 sc0 ls0 ws0">]. Google has now</div><div class="t m5 x13 h6 yef ff2 fs4 fc0 sc0 ls0 ws0">xed these attacks by implementing the “hide overlays” defense</div><div class="t m0 x13 h6 yf0 ff2 fs4 fc0 sc0 ls0 ws0">mechanism.</div><div class="t m22 x1e h6 yf1 ff2 fs4 fc0 sc0 ls0 ws0">Another related work [</div><div class="t m0 x44 h6 yf1 ff2 fs4 fc0 sc0 ls0 ws0">29</div><div class="t m22 x45 h6 yf1 ff2 fs4 fc0 sc0 ls0 ws0">] has shown how clickjacking can be</div><div class="t m11 x13 h6 yf2 ff2 fs4 fc0 sc0 ls0 ws0">used to bypass several permissions, such as capturing images and</div><div class="t mc x13 h6 yf3 ff2 fs4 fc0 sc0 ls0 ws0">videos (Target App (TA): Camera app), getting access to contacts</div><div class="t m5 x13 h6 yf4 ff2 fs4 fc0 sc0 ls0 ws0">(TA: Contact app), record sound (TA: SoundRecorder), send text</div><div class="t m9 x13 h6 yf5 ff2 fs4 fc0 sc0 ls0 ws0">messages (TA: Messaging app), or even installing and uninstalling</div><div class="t m5 x13 h6 yf6 ff2 fs4 fc0 sc0 ls0 ws0">third-party apps (TA: Package Installer). Among these, attacks</div><div class="t m5 x13 h6 yf7 ff2 fs4 fc0 sc0 ls0 ws0">against the Package Installer are now protected via the obscured</div><div class="t m5 x13 h6 yf8 ff2 fs4 fc0 sc0 ls0 ws0">ag mechanism. However, even this last case is still vulnerable</div><div class="t m5 x13 h6 yf9 ff2 fs4 fc0 sc0 ls0 ws0">to the context-hiding attack. According to our tests, all the other</div><div class="t m5 x13 h6 yfa ff2 fs4 fc0 sc0 ls0 ws0">attack venues are still practical on the latest version of Android.</div><div class="t m1e x13 h6 yfb ff2 fs4 fc0 sc0 ls0 ws0">This is particularly worrisome when considering that this related</div><div class="t m0 x13 h6 yfc ff2 fs4 fc0 sc0 ls0 ws0">work has been published two years ago, in mid 2016.</div><div class="t m5 x1e h6 yfd ff2 fs4 fc0 sc0 ls0 ws0">In this paper we explore additional attack scenarios, and our</div><div class="t m0 x13 h6 yfe ff2 fs4 fc0 sc0 ls0 ws0">ndings are alarming.</div><div class="t m0 x13 he yff ff3 fs4 fc0 sc0 ls0 ws0">Google Play Store app.</div><div class="t m5 x46 h6 yff ff2 fs4 fc0 sc0 ls0 ws0">We found that even Google’s own Play</div><div class="t m7 x13 h6 y100 ff2 fs4 fc0 sc0 ls0 ws0">Store app is completely vulnerable even to traditional clickjacking</div><div class="t mb x13 h6 y101 ff2 fs4 fc0 sc0 ls0 ws0">attacks. In fact, it is not even protected by the obscured ag mech-</div><div class="t m5 x13 h6 y102 ff2 fs4 fc0 sc0 ls0 ws0">anism, making its exploitation trivial. This is problematic since</div><div class="t m26 x13 h6 y103 ff2 fs4 fc0 sc0 ls0 ws0">this app has the capability of installing, uninstalling, and opening</div><div class="t m0 x13 h6 y104 ff2 fs4 fc0 sc0 ls0 ws0">arbitrary apps installed from the Play Store.</div><div class="t m3 x1e h6 y105 ff2 fs4 fc0 sc0 ls0 ws0">An attacker can cause the Play Store app to open and “browse” to</div><div class="t m3 x13 h6 y106 ff2 fs4 fc0 sc0 ls0 ws0">an attacker-chosen app by sending an ACTION_VIEW Intent and a</div><div class="t m3 x13 h6 y107 ff2 fs4 fc0 sc0 ls0 ws0">URI with the</div><div class="t m0 x47 h11 y107 ff9 fs4 fc0 sc0 ls0 ws0">market://</div><div class="t m3 x48 h6 y107 ff2 fs4 fc0 sc0 ls0 ws0">scheme (e.g.,</div><div class="t m0 x49 h11 y107 ff9 fs4 fc0 sc0 ls0 ws0">market://details?id=mal-</div><div class="t m0 x13 h11 y108 ff9 fs4 fc0 sc0 ls0 ws0">icious.com</div><div class="t m5 x14 h6 y108 ff2 fs4 fc0 sc0 ls0 ws0">). If the app is not installed, the Play Store will show,</div><div class="t m13 x13 h6 y109 ff2 fs4 fc0 sc0 ls0 ws0">in its rst activity, the “Install App” button, making it possible to</div><div class="t m11 x13 h6 y10a ff2 fs4 fc0 sc0 ls0 ws0">install an arbitrary app from the Play Store by hijacking one click.</div><div class="t m5 x13 h6 y10b ff2 fs4 fc0 sc0 ls0 ws0">After the app is installed, the malicious app can send the same</div><div class="t m23 x13 h6 y10c ff2 fs4 fc0 sc0 ls0 ws0">Intent: this time, since the app is already installed, the Play Store</div><div class="t m20 x13 h6 y10d ff2 fs4 fc0 sc0 ls0 ws0">app will show an “open app” button. Thus, by hijacking two clicks</div><div class="t m3 x13 h6 y10e ff2 fs4 fc0 sc0 ls0 ws0">only, an attacker can install and open an arbitrary app from the Play</div><div class="t m5 x13 h6 y10f ff2 fs4 fc0 sc0 ls0 ws0">Store. To make things worse, we have found that if the attacker-</div><div class="t m10 x13 h6 y110 ff2 fs4 fc0 sc0 ls0 ws0">chosen app targets an old Android SDK, the full list of permission</div><div class="t m3 x13 h6 y111 ff2 fs4 fc0 sc0 ls0 ws0">is shown to the user at install-time (in contrast to the current grant</div><div class="t m1f x13 h6 y112 ff2 fs4 fc0 sc0 ls0 ws0">at run-time permission model). Unfortunately, we have found that</div><div class="t m5 x13 h6 y113 ff2 fs4 fc0 sc0 ls0 ws0">the “OK” button to conrm these permissions is also vulnerable</div><div class="t m26 x13 h6 y114 ff2 fs4 fc0 sc0 ls0 ws0">to clickjacking. In summary, by hijacking three clicks, an attacker</div><div class="t m5 x13 h6 y115 ff2 fs4 fc0 sc0 ls0 ws0">can lure the user to install an arbitrary app from the store with</div><div class="t m0 x13 h6 y116 ff2 fs4 fc0 sc0 ls0 ws0">arbitrary permissions.</div><div class="c x11 y46 w2 hc"><div class="t m0 x0 hd y47 ff7 fs7 fc0 sc0 ls0 ws0">Session 6B: Mobile 1</div></div><div class="c x2e y46 w3 hc"><div class="t m0 x0 hd y47 ff7 fs7 fc0 sc0 ls0 ws0">CCS’18, October 15-19, 2018, Toronto, ON, Canada</div></div><div class="c x2f y48 w5 hc"><div class="t m0 x0 hd y47 ff7 fs7 fc0 sc0 ls0 ws0">1122</div></div><a class="l" rel='nofollow' onclick='return false;'><div class="d m14"></div></a><a class="l" rel='nofollow' onclick='return false;'><div class="d m14"></div></a><a class="l" rel='nofollow' onclick='return false;'><div class="d m14"></div></a><a class="l" rel='nofollow' onclick='return false;'><div class="d m14"></div></a><a class="l" rel='nofollow' onclick='return false;'><div class="d m14"></div></a><a class="l" rel='nofollow' onclick='return false;'><div class="d m14"></div></a><a class="l" rel='nofollow' onclick='return false;'><div class="d m14"></div></a></div><div class="pi" data-data='{"ctm":[1.568627,0.000000,0.000000,1.568627,0.000000,0.000000]}'></div></div>

<div id="pf4" class="pf w0 h0" data-page-no="4"><div class="pc pc4 w0 h0"><img class="bi x0 y0 w1 h1" alt="" src="https://csdnimg.cn/release/download_crawler_static/12728047/bg4.jpg"><div class="t m0 x11 he y49 ff3 fs4 fc0 sc0 ls0 ws0">Chrome Browser.</div><div class="t m17 x2 h6 y49 ff2 fs4 fc0 sc0 ls0 ws0">The mobile version of Chrome Browser is vul-</div><div class="t m3 x11 h6 y4a ff2 fs4 fc0 sc0 ls0 ws0">nerable as well. An attacker can simply open an arbitrary webpage</div><div class="t m3 x11 h6 y80 ff2 fs4 fc0 sc0 ls0 ws0">by sending an ACTION_VIEW specifying the target webpage’s URL</div><div class="t m3 x11 h6 y81 ff2 fs4 fc0 sc0 ls0 ws0">as data. If the user is logged in to the target site, the attacker can use</div><div class="t m3 x11 h6 y82 ff2 fs4 fc0 sc0 ls0 ws0">clickjacking to implement traditional web clickjacking attacks (e.g.,</div><div class="t m5 x11 h6 y83 ff2 fs4 fc0 sc0 ls0 ws0">to click on Facebook’s likes), bypassing all modern web-related</div><div class="t m0 x11 h6 y84 ff2 fs4 fc0 sc0 ls0 ws0">defense mechanisms (such as frame busting).</div><div class="t m0 x11 he y117 ff3 fs4 fc0 sc0 ls0 ws0">Gmail.</div><div class="t m3 x4a h6 y117 ff2 fs4 fc0 sc0 ls0 ws0">Google’s Gmail app is vulnerable. By using an ACTION_SEND</div><div class="t m2 x11 h6 y118 ff2 fs4 fc0 sc0 ls0 ws0">Intent, by setting</div><div class="t m0 x4b h11 y118 ff9 fs4 fc0 sc0 ls0 ws0">com.google.android.gm</div><div class="t m2 x4c h6 y118 ff2 fs4 fc0 sc0 ls0 ws0">as target package, and</div><div class="t m3 x11 h6 y119 ff2 fs4 fc0 sc0 ls0 ws0">by setting the EXTRA_EMAIL, EXTRA_SUBJECT, and EXTRA_TEXT</div><div class="t mb x11 h6 y11a ff2 fs4 fc0 sc0 ls0 ws0">extra elds, an attacker can spawn the Gmail app with a pre-lled</div><div class="t m5 x11 h6 y11b ff2 fs4 fc0 sc0 ls0 ws0">email (including the To:, Subject:, and content of the email). The</div><div class="t m8 x11 h6 y11c ff2 fs4 fc0 sc0 ls0 ws0">attacker can then hijack a click to the “Send” button, with the net</div><div class="t m5 x11 h6 y11d ff2 fs4 fc0 sc0 ls0 ws0">eect of being able to send emails on behalf of the victim, which</div><div class="t m0 x11 h6 y11e ff2 fs4 fc0 sc0 ls0 ws0">could be useful to mount social engineering and targeted attacks.</div><div class="t m0 x3a he y11f ff3 fs4 fc0 sc0 ls0 ws0">WhatsApp and Signal.</div><div class="t m3 x4d h6 y11f ff2 fs4 fc0 sc0 ls0 ws0">These applications are very popular among</div><div class="t m3 x11 h6 y120 ff2 fs4 fc0 sc0 ls0 ws0">the Instant Messaging (IM) apps: WhatsApp is one of the most used</div><div class="t me x11 h6 y121 ff2 fs4 fc0 sc0 ls0 ws0">messaging application across Android users while Signal is consid-</div><div class="t m3 x11 h6 y122 ff2 fs4 fc0 sc0 ls0 ws0">ered the de-facto standard for secure messaging. Both allow the user</div><div class="t m0 x11 h6 y123 ff2 fs4 fc0 sc0 ls0 ws0">to perform end-to-end encrypted communications. Unfortunately,</div><div class="t m0 x11 h6 y124 ff2 fs4 fc0 sc0 ls0 ws0">these sensitive apps are also vulnerable to clickjacking.</div><div class="t m1f x12 h6 y125 ff2 fs4 fc0 sc0 ls0 ws0">For what concerns WhatsApp, an attacker can send one crafted</div><div class="t m5 x11 h6 y126 ff2 fs4 fc0 sc0 ls0 ws0">Intent so to pre-ll the content and the recipient of a message</div><div class="t m5 x11 h6 y127 ff2 fs4 fc0 sc0 ls0 ws0">to be sent: by hijacking just one click, such message will be sent</div><div class="t m5 x11 h6 y128 ff2 fs4 fc0 sc0 ls0 ws0">on behalf of the victim. This technique can be abused to leak the</div><div class="t m5 x11 h6 y129 ff2 fs4 fc0 sc0 ls0 ws0">victim’s telephone number by sending a message to an attacker-</div><div class="t m5 x11 h6 y12a ff2 fs4 fc0 sc0 ls0 ws0">controlled number; the attacker could also use this attack vector</div><div class="t m16 x11 h6 y12b ff2 fs4 fc0 sc0 ls0 ws0">to impersonate the victim to perform social engineering attacks or</div><div class="t m0 x11 h6 y12c ff2 fs4 fc0 sc0 ls0 ws0">spam-related activities.</div><div class="t m5 x12 h6 y12d ff2 fs4 fc0 sc0 ls0 ws0">Signal is vulnerable to this attack as well, but only if it is con-</div><div class="t m5 x11 h6 y12e ff2 fs4 fc0 sc0 ls0 ws0">gured to be the default app for handling SMS: in case it is not,</div><div class="t m5 x11 h6 y12f ff2 fs4 fc0 sc0 ls0 ws0">Signal does not allow the creation of a pre-lled message with</div><div class="t m5 x11 h6 y130 ff2 fs4 fc0 sc0 ls0 ws0">an arbitrary, attacker-controlled recipient, making the one-click</div><div class="t m5 x11 h6 y131 ff2 fs4 fc0 sc0 ls0 ws0">attack not possible. We note, however, that a clickjacking-based</div><div class="t m5 x11 h6 y132 ff2 fs4 fc0 sc0 ls0 ws0">attack against Signal is possible even in its default IM mode, but</div><div class="t md x11 h6 y133 ff2 fs4 fc0 sc0 ls0 ws0">it becomes more complicated. In particular, a malicious app could</div><div class="t m3 x11 h6 y134 ff2 fs4 fc0 sc0 ls0 ws0">ask the WRITE_CONTACT permission to add the attacker’s phone</div><div class="t m20 x11 h6 y135 ff2 fs4 fc0 sc0 ls0 ws0">number to the victim’s contact list multiple times, and it could use</div><div class="t m28 x11 h6 y136 ff2 fs4 fc0 sc0 ls0 ws0">a specially crafted name so to reach the top of the contact list (like</div><div class="t m3 x11 h6 y137 ff2 fs4 fc0 sc0 ls0 ws0">in a spraying attack): then, by hijacking two clicks—the rst one to</div><div class="t md x11 h6 y138 ff2 fs4 fc0 sc0 ls0 ws0">select the attacker-controlled recipient (which is now on top) and</div><div class="t m3 x11 h6 y139 ff2 fs4 fc0 sc0 ls0 ws0">the second one to actually send the message—the attacker can once</div><div class="t ma x11 h6 y13a ff2 fs4 fc0 sc0 ls0 ws0">again leak the victim’s telephone number. The attacker could then</div><div class="t m0 x11 h6 y13b ff2 fs4 fc0 sc0 ls0 ws0">clean up the contact list just after the attack is over.</div><div class="t m0 x11 he y13c ff3 fs4 fc0 sc0 ls0 ws0">Google Authenticator.</div><div class="t m5 x4e h6 y13c ff2 fs4 fc0 sc0 ls0 ws0">Google Authenticator is also vulnerable</div><div class="t m5 x11 h6 y13d ff2 fs4 fc0 sc0 ls0 ws0">to clickjacking, but in a dierent way. For this app, there is no</div><div class="t m3 x11 h6 y13e ff2 fs4 fc0 sc0 ls0 ws0">sensitive button to be clicked, but it contains sensitive information,</div><div class="t m5 x11 h6 y13f ff2 fs4 fc0 sc0 ls0 ws0">such as two-factor authentication tokens. We have developed a</div><div class="t m0 x11 h6 y140 ff2 fs4 fc0 sc0 ls0 ws0">clickjacking-based technique through which the attacker can leak</div><div class="t m5 x11 h6 y141 ff2 fs4 fc0 sc0 ls0 ws0">this data. By luring the user to perform a “long click” action on</div><div class="t m5 x11 h6 y142 ff2 fs4 fc0 sc0 ls0 ws0">one of the tokens, the Google Auth app will copy this token to the</div><div class="t m1d x11 hf y143 ff4 fs4 fc0 sc0 ls0 ws0">clipboard, which is freely accessible by any third-party app without</div><div class="t m3 x11 h6 y144 ff4 fs4 fc0 sc0 ls0 ws0">requesting any additional permission. We were able to quickly write</div><div class="t m12 x11 h6 y145 ff2 fs4 fc0 sc0 ls0 ws0">a prototype that, by just hijacking one click, obtains the relevant</div><div class="t m3 x11 h6 y146 ff2 fs4 fc0 sc0 ls0 ws0">token from the clipboard. To the best of our knowledge, this is rst</div><div class="t m5 x11 h6 y147 ff2 fs4 fc0 sc0 ls0 ws0">known example of combining hijacking of long clicks and leaks</div><div class="t m22 x13 h6 y49 ff2 fs4 fc0 sc0 ls0 ws0">via clipboard. We note that this technique is generic, and that we</div><div class="t m5 x13 h6 y4a ff2 fs4 fc0 sc0 ls0 ws0">focused on Google Auth only as an explanatory example. In fact,</div><div class="t m28 x13 h6 y80 ff2 fs4 fc0 sc0 ls0 ws0">our tests show it is also possible, for example, to attack the Google</div><div class="t m1d x13 h6 y81 ff2 fs4 fc0 sc0 ls0 ws0">Drive app and lure the user to click on “share by link” for a given</div><div class="t m25 x13 h6 y82 ff2 fs4 fc0 sc0 ls0 ws0">item or folder, after which the item is shared and the link is copied</div><div class="t m0 x13 h6 y83 ff2 fs4 fc0 sc0 ls0 ws0">to the clipboard (and thus leaked to the attacker).</div><div class="t m0 x13 he y148 ff3 fs4 fc0 sc0 ls0 ws0">Facebook and Twitter.</div><div class="t m5 x4f h6 y148 ff2 fs4 fc0 sc0 ls0 ws0">These apps are completely unprotected,</div><div class="t m19 x13 h6 y149 ff2 fs4 fc0 sc0 ls0 ws0">and it is thus easy for an attacker to “like” or share messages and</div><div class="t m5 x13 h6 y14a ff2 fs4 fc0 sc0 ls0 ws0">tweets, with techniques similar to what described above. For ex-</div><div class="t m5 x13 h6 y14b ff2 fs4 fc0 sc0 ls0 ws0">ample, it is possible to spawn the Twitter app to show a specic</div><div class="t m22 x13 h6 y14c ff2 fs4 fc0 sc0 ls0 ws0">tweet (URLs that contain twitter.com are treated in a special way</div><div class="t m19 x13 h6 y14d ff2 fs4 fc0 sc0 ls0 ws0">and delivered to the Twitter app), and it is thus trivial to perform</div><div class="t m0 x13 h6 y14e ff2 fs4 fc0 sc0 ls0 ws0">like-jacking or similar attacks.</div><div class="t m0 x13 he y14f ff3 fs4 fc0 sc0 ls0 ws0">Lookout Mobile Security.</div><div class="t m5 x45 h6 y14f ff2 fs4 fc0 sc0 ls0 ws0">As a last representative example, we</div><div class="t md x13 h6 y150 ff2 fs4 fc0 sc0 ls0 ws0">investigated how the leading anti-virus app for mobile is resilient</div><div class="t m5 x13 h6 y151 ff2 fs4 fc0 sc0 ls0 ws0">to these attacks. To our surprise, we found that all widgets were</div><div class="t mf x13 h6 y152 ff2 fs4 fc0 sc0 ls0 ws0">vulnerable to clickjacking: by hijacking three clicks, it is possible</div><div class="t m0 x13 h6 y153 ff2 fs4 fc0 sc0 ls0 ws0">to silently disable the security checks.</div><div class="t m0 x13 he y154 ff3 fs4 fc0 sc0 ls0 ws0">Discussion.</div><div class="t m3 x50 h6 y154 ff2 fs4 fc0 sc0 ls0 ws0">The intent behind this section is to highlight the extent</div><div class="t m24 x13 h6 y155 ff2 fs4 fc0 sc0 ls0 ws0">and wide attack surface that even fully updated devices are subject</div><div class="t m3 x13 h6 y156 ff2 fs4 fc0 sc0 ls0 ws0">to. The practicality of these attacks varies depending on the number</div><div class="t m22 x13 h6 y157 ff2 fs4 fc0 sc0 ls0 ws0">of clicks to be hijacked. However, we note that the most complex</div><div class="t m27 x13 h6 y158 ff2 fs4 fc0 sc0 ls0 ws0">example above is attacking Signal, which requires four clicks, but</div><div class="t m5 x13 h6 y159 ff2 fs4 fc0 sc0 ls0 ws0">that previous work has shown through a user study that these</div><div class="t m0 x13 h6 y15a ff2 fs4 fc0 sc0 ls0 ws0">multi-step clickjacking attacks are very practical [10].</div><div class="t md x1e h6 y15b ff2 fs4 fc0 sc0 ls0 ws0">This is a list of interesting ndings, but we would like to stress</div><div class="t m1a x13 h6 y15c ff2 fs4 fc0 sc0 ls0 ws0">that it is far from being complete. However, we nd it worrisome</div><div class="t m5 x13 h6 y15d ff2 fs4 fc0 sc0 ls0 ws0">that, among the apps we have tested, we have not found a single</div><div class="t m29 x13 h6 y15e ff4 fs4 fc0 sc0 ls0 ws0">one that was protected by at least the obscured ag mechanism. On</div><div class="t m3 x13 h6 y15f ff2 fs4 fc0 sc0 ls0 ws0">the one hand, it is surprising that all these apps are still vulnerable,</div><div class="t m3 x13 h6 y160 ff2 fs4 fc0 sc0 ls0 ws0">especially since clickjacking for mobile has been known for several</div><div class="t mb x13 h6 y161 ff2 fs4 fc0 sc0 ls0 ws0">years. On the other hand, we believe that this lack of protection is</div><div class="t mf x13 h6 y162 ff2 fs4 fc0 sc0 ls0 ws0">not due to simple oversights, but it is due to fear of public outcry</div><div class="t m3 x13 h6 y163 ff2 fs4 fc0 sc0 ls0 ws0">caused by these backward compatibility concerns [</div><div class="t m0 x51 h6 y163 ff2 fs4 fc0 sc0 ls0 ws0">27</div><div class="t m3 x52 h6 y163 ff2 fs4 fc0 sc0 ls0 ws0">]. For example,</div><div class="t m3 x13 h6 y164 ff2 fs4 fc0 sc0 ls0 ws0">we have notied Google about the attacks against the Play Store in</div><div class="t m0 x13 h6 y165 ff2 fs4 fc0 sc0 ls0 ws0">August 2017, but, unfortunately, they are still practical.</div><div class="t m0 x13 h5 y166 ff3 fs3 fc0 sc0 ls0 ws0">5 HOW APPS USE THE USER INTERFACE</div><div class="t m5 x41 h6 y167 ff2 fs4 fc0 sc0 ls0 ws0">We have conducted a survey to determine how real-world apps</div><div class="t m5 x13 h6 y168 ff2 fs4 fc0 sc0 ls0 ws0">use the user interface. We have tailored our survey to study two</div><div class="t m1c x13 h6 y169 ff2 fs4 fc0 sc0 ls0 ws0">specic aspects: 1) how benign apps convey to the user the needed</div><div class="t m1f x13 h6 y16a ff2 fs4 fc0 sc0 ls0 ws0">contextual information concerning sensitive and security-relevant</div><div class="t m25 x13 h6 y16b ff2 fs4 fc0 sc0 ls0 ws0">actions; 2) how benign apps use the “draw on top” permission, and</div><div class="t m0 x13 h6 y16c ff2 fs4 fc0 sc0 ls0 ws0">which functionality they aim at implementing.</div><div class="t m0 x13 h5 y16d ff3 fs3 fc0 sc0 ls0 ws0">5.1 Conveying Contextual Information</div><div class="t m5 x41 h6 y16e ff2 fs4 fc0 sc0 ls0 ws0">We wanted to study how apps make use of the user interface to</div><div class="t m3 x13 h6 y16f ff2 fs4 fc0 sc0 ls0 ws0">convey relevant contextual information for a user to take informed</div><div class="t m25 x13 h6 y170 ff2 fs4 fc0 sc0 ls0 ws0">decision. Note that with the term contextual information we do not</div><div class="t m23 x13 h6 y171 ff2 fs4 fc0 sc0 ls0 ws0">only refer to security-related information displayed, for example,</div><div class="t m3 x13 h6 y172 ff2 fs4 fc0 sc0 ls0 ws0">in a popup: with it, we consider all information that the user needs</div><div class="t m24 x13 h6 y173 ff2 fs4 fc0 sc0 ls0 ws0">to be aware of to determine what the eect of one of her click on a</div><div class="t m3 x13 h6 y174 ff2 fs4 fc0 sc0 ls0 ws0">button would be (e.g., a click on the bottom-right part of the Gmail</div><div class="t m0 x13 h6 y175 ff2 fs4 fc0 sc0 ls0 ws0">app triggers a “send email” action).</div><div class="c x11 y46 w2 hc"><div class="t m0 x0 hd y47 ff7 fs7 fc0 sc0 ls0 ws0">Session 6B: Mobile 1</div></div><div class="c x2e y46 w3 hc"><div class="t m0 x0 hd y47 ff7 fs7 fc0 sc0 ls0 ws0">CCS’18, October 15-19, 2018, Toronto, ON, Canada</div></div><div class="c x2f y48 w4 hc"><div class="t m0 x0 hd y47 ff7 fs7 fc0 sc0 ls0 ws0">1123</div></div><a class="l" rel='nofollow' onclick='return false;'><div class="d m14"></div></a><a class="l" rel='nofollow' onclick='return false;'><div class="d m14"></div></a></div><div class="pi" data-data='{"ctm":[1.568627,0.000000,0.000000,1.568627,0.000000,0.000000]}'></div></div>

<div id="pf5" class="pf w0 h0" data-page-no="5"><div class="pc pc5 w0 h0"><img class="bi x0 y0 w1 h1" alt="" src="https://csdnimg.cn/release/download_crawler_static/12728047/bg5.jpg"><div class="t m0 x53 h7 y176 ff3 fs5 fc0 sc0 ls0 ws0">(a) (b)</div><div class="t m0 x11 he y177 ff3 fs4 fc0 sc0 ls0 ws0">Figure 1: (a) An example of “widget” implemented as an on-</div><div class="t m0 x11 he y178 ff3 fs4 fc0 sc0 ls0 ws0">top overlay by Facebook Messenger. (b) Twilight app in ac-</div><div class="t m0 x11 he y179 ff3 fs4 fc0 sc0 ls0 ws0">tion, an example of screen lter. The red shade is imple-</div><div class="t m0 x11 he y17a ff3 fs4 fc0 sc0 ls0 ws0">mented as a persistent, on-top, semi-transparent overlay.</div><div class="t m22 x12 h6 y17b ff2 fs4 fc0 sc0 ls0 ws0">To this end, we have compiled a cumulative list of 67 sensitive</div><div class="t m3 x11 h6 y17c ff2 fs4 fc0 sc0 ls0 ws0">views used by dierent types of apps. This list includes views from</div><div class="t m5 x11 h6 y17d ff2 fs4 fc0 sc0 ls0 ws0">the Android settings app (and its sub-menus, 11 entries in total),</div><div class="t m9 x11 h6 y17e ff2 fs4 fc0 sc0 ls0 ws0">Google-owned apps (Gmail, Google Drive, etc., 11 views), and sev-</div><div class="t m1f x11 h6 y17f ff2 fs4 fc0 sc0 ls0 ws0">eral representative sensitive views belonging to banking apps (15),</div><div class="t md x11 h6 y180 ff2 fs4 fc0 sc0 ls0 ws0">social networks like Twitter and Facebook (8), messaging apps in-</div><div class="t m3 x11 h6 y181 ff2 fs4 fc0 sc0 ls0 ws0">cluding Telegram, Signal and WhatsApp (8), and security apps such</div><div class="t m12 x11 h6 y182 ff2 fs4 fc0 sc0 ls0 ws0">as mobile antivirus (14). In all cases, the relevant contextual infor-</div><div class="t m5 x11 h6 y183 ff4 fs4 fc0 sc0 ls0 ws0">mation is prominently shown in the center. We note that none of</div><div class="t m5 x11 h6 y184 ff2 fs4 fc0 sc0 ls0 ws0">the known and just-presented attacks discussed above would be</div><div class="t m6 x11 h6 y185 ff2 fs4 fc0 sc0 ls0 ws0">possible without covering the central part of the screen. Thus, we</div><div class="t m5 x11 h6 y186 ff2 fs4 fc0 sc0 ls0 ws0">conclude that, at least for the apps we have inspected, as long as</div><div class="t m3 x11 h6 y187 ff2 fs4 fc0 sc0 ls0 ws0">the central portion of the screen is not covered, clickjacking attacks</div><div class="t m0 x11 h6 y188 ff2 fs4 fc0 sc0 ls0 ws0">are not possible.</div><div class="t m0 x11 h5 y189 ff3 fs3 fc0 sc0 ls0 ws0">5.2 How and Why Apps Create Overlays</div><div class="t m3 x11 h6 y18a ff2 fs4 fc0 sc0 ls0 ws0">One of the concerns when developing a security mechanisms relates</div><div class="t m4 x11 h6 y18b ff2 fs4 fc0 sc0 ls0 ws0">to backward compatibility. As we aim to design a mechanism that</div><div class="t m5 x11 h6 y18c ff2 fs4 fc0 sc0 ls0 ws0">is not aected by these concerns, we have performed a survey</div><div class="t me x11 h6 y18d ff2 fs4 fc0 sc0 ls0 ws0">over a number of real-world apps to study how they use the “draw</div><div class="t m5 x11 h6 y18e ff2 fs4 fc0 sc0 ls0 ws0">on top” permission, and which purpose they want to achieve by</div><div class="t m5 x11 h6 y18f ff2 fs4 fc0 sc0 ls0 ws0">drawing overlays. We built three dierent datasets, which aim</div><div class="t m5 x11 h6 y190 ff2 fs4 fc0 sc0 ls0 ws0">at covering potentially problematic categories of apps (for what</div><div class="t m0 x11 h6 y191 ff2 fs4 fc0 sc0 ls0 ws0">concerns clickjacking protection mechanisms).</div><div class="t m5 x12 h6 y192 ff2 fs4 fc0 sc0 ls0 ws0">The rst dataset is composed by popular apps hosted on the</div><div class="t m29 x11 h6 y193 ff2 fs4 fc0 sc0 ls0 ws0">ocial Google Play Store. This dataset is constituted by 454 apps,</div><div class="t m21 x11 h6 y194 ff2 fs4 fc0 sc0 ls0 ws0">and they all require the SYSTEM_ALERT_WINDOW permission.</div><div class="t m3 x11 h6 y195 ff2 fs4 fc0 sc0 ls0 ws0">This list was kindly provided by the authors of Cloak & Dagger [</div><div class="t m0 x3c h6 y195 ff2 fs4 fc0 sc0 ls0 ws0">10</div><div class="t m3 x3d h6 y195 ff2 fs4 fc0 sc0 ls0 ws0">],</div><div class="t md x11 h6 y196 ff2 fs4 fc0 sc0 ls0 ws0">and it was obtained by ltering for apps requiring the permission</div><div class="t m1b x11 h6 y197 ff2 fs4 fc0 sc0 ls0 ws0">from an initial dataset of 4,455 top apps on the Play Store crawled</div><div class="t m5 x13 h6 y49 ff2 fs4 fc0 sc0 ls0 ws0">across dierent categories. We have considered a subset of (ran-</div><div class="t m8 x13 h6 y4a ff2 fs4 fc0 sc0 ls0 ws0">domly selected) 305 apps for closer inspection. These apps span a</div><div class="t m4 x13 h6 y80 ff2 fs4 fc0 sc0 ls0 ws0">number of categories, including screen lters, messaging, audio &</div><div class="t m3 x13 h6 y81 ff2 fs4 fc0 sc0 ls0 ws0">video players, photo & video editing, custom launchers, VPN & net-</div><div class="t m10 x13 h6 y82 ff2 fs4 fc0 sc0 ls0 ws0">working, productivity & utilities (e.g., status indicators), antivirus,</div><div class="t m0 x13 h6 y83 ff2 fs4 fc0 sc0 ls0 ws0">and screen lockers.</div><div class="t m3 x1e h6 y84 ff2 fs4 fc0 sc0 ls0 ws0">The rst dataset is already quite signicant in size, but we wanted</div><div class="t m3 x13 h6 y85 ff2 fs4 fc0 sc0 ls0 ws0">to include in our analysis 1) apps from dierent sources and 2) apps</div><div class="t m5 x13 h6 yb3 ff2 fs4 fc0 sc0 ls0 ws0">that could be particularly problematic for a defense mechanism.</div><div class="t m5 x13 h6 yb4 ff2 fs4 fc0 sc0 ls0 ws0">To this end, we created a second dataset with apps taken from</div><div class="t m5 x13 h6 yb5 ff2 fs4 fc0 sc0 ls0 ws0">the F-Droid open source apps repository [</div><div class="t m0 x54 h6 yb5 ff2 fs4 fc0 sc0 ls0 ws0">7</div><div class="t m5 x55 h6 yb5 ff2 fs4 fc0 sc0 ls0 ws0">]: we have randomly</div><div class="t m1a x13 h6 yb6 ff2 fs4 fc0 sc0 ls0 ws0">selected the top 20 entries on Google when searching for the “an-</div><div class="t me x13 h6 yb7 ff2 fs4 fc0 sc0 ls0 ws0">droid.permission.SYSTEM_ALERT_WINDOW” permission used in</div><div class="t m19 x13 h6 yb8 ff2 fs4 fc0 sc0 ls0 ws0">webpages belonging to F-Droid apps. Among these, only 15 were</div><div class="t m5 x13 h6 yb9 ff2 fs4 fc0 sc0 ls0 ws0">real apps (the remaining ones were toy samples) and they, once</div><div class="t m3 x13 h6 yba ff2 fs4 fc0 sc0 ls0 ws0">again, belong to a number of dierent categories, such as messaging,</div><div class="t m16 x13 h6 ybb ff2 fs4 fc0 sc0 ls0 ws0">VPN & networking, productivity & utilities, audio & video players,</div><div class="t m1a x13 h6 y198 ff2 fs4 fc0 sc0 ls0 ws0">photo & video editing, and custom launchers. Moreover, we have</div><div class="t m1b x13 h6 y199 ff2 fs4 fc0 sc0 ls0 ws0">also created a third dataset constituted exclusively by screen lter</div><div class="t m5 x13 h6 y19a ff2 fs4 fc0 sc0 ls0 ws0">apps. We chose to focus on this category because their key func-</div><div class="t m5 x13 h6 y19b ff2 fs4 fc0 sc0 ls0 ws0">tionality is well-known to create backward compatibility issues</div><div class="t mf x13 h6 y19c ff2 fs4 fc0 sc0 ls0 ws0">with current protections against clickjacking attacks [</div><div class="t m0 x56 h6 y19c ff2 fs4 fc0 sc0 ls0 ws0">27</div><div class="t mf x57 h6 y19c ff2 fs4 fc0 sc0 ls0 ws0">]. In fact,</div><div class="t m18 x13 h6 y19d ff2 fs4 fc0 sc0 ls0 ws0">this category of apps relies on the creation of persistent fullscreen,</div><div class="t m5 x13 h6 y19e ff2 fs4 fc0 sc0 ls0 ws0">passthrough, on-top overlays: these overlays are all detected as</div><div class="t m1d x13 h6 y19f ff2 fs4 fc0 sc0 ls0 ws0">problematic by the obscured ag mechanism. For this dataset, we</div><div class="t m10 x13 h6 y1a0 ff2 fs4 fc0 sc0 ls0 ws0">have selected the 10 screen lter apps with the highest number of</div><div class="t mf x13 h6 y1a1 ff2 fs4 fc0 sc0 ls0 ws0">installations from the Play Store. We report these apps in Table 1</div><div class="t m0 x13 h6 y1a2 ff2 fs4 fc0 sc0 ls0 ws0">in Appendix B.</div><div class="t m5 x1e h6 y1a3 ff2 fs4 fc0 sc0 ls0 ws0">We have selected for a throughout manual inspection a num-</div><div class="t m5 x13 h6 y1a4 ff2 fs4 fc0 sc0 ls0 ws0">ber of samples (between 3 and 5) for each of the categories that</div><div class="t m1f x13 h6 y1a5 ff2 fs4 fc0 sc0 ls0 ws0">were covered in the rst dataset, and all the samples in the second</div><div class="t m23 x13 h6 y1a6 ff2 fs4 fc0 sc0 ls0 ws0">and third dataset, for a total of 60 samples. The remainder of this</div><div class="t m5 x13 h6 y1a7 ff2 fs4 fc0 sc0 ls0 ws0">section discusses the gathered insights, grouped by the dierent</div><div class="t m0 x13 h6 y1a8 ff2 fs4 fc0 sc0 ls0 ws0">functionality these apps aim at implementing.</div><div class="t m0 x41 he y1a9 ff3 fs4 fc0 sc0 ls0 ws0">Widgets at the margin.</div><div class="t m1b x46 h6 y1a9 ff2 fs4 fc0 sc0 ls0 ws0">One very frequent use-case for the apps</div><div class="t m5 x13 h6 y1aa ff2 fs4 fc0 sc0 ls0 ws0">in our dataset is to create overlays with the purpose of drawing</div><div class="t m6 x13 h6 y1ab ff2 fs4 fc0 sc0 ls0 ws0">persistent widgets. Depending on the app category, these widgets</div><div class="t m25 x13 h6 y1ac ff2 fs4 fc0 sc0 ls0 ws0">are used to display a number of information, to act as shortcuts, or</div><div class="t m8 x13 h6 y1ad ff2 fs4 fc0 sc0 ls0 ws0">to attract attention from the user. Figure 1a shows a very popular</div><div class="t m11 x13 h6 y1ae ff2 fs4 fc0 sc0 ls0 ws0">example, Facebook Messenger, which draws a rounded overlay to</div><div class="t m3 x13 h6 y1af ff2 fs4 fc0 sc0 ls0 ws0">notify the user of a new message. Other categories of apps that cre-</div><div class="t m0 x13 h6 y1b0 ff2 fs4 fc0 sc0 ls0 ws0">ate this kind of widgets are audio & video players (to show which</div><div class="t m6 x13 h6 y1b1 ff2 fs4 fc0 sc0 ls0 ws0">song is playing, see Figure 7a in Appendix C), VPN & networking</div><div class="t m26 x13 h6 y1b2 ff2 fs4 fc0 sc0 ls0 ws0">(to show the status of the connectivity, strength of the signal, and</div><div class="t m1a x13 h6 y1b3 ff2 fs4 fc0 sc0 ls0 ws0">similar information, Figure 7b), custom launchers (that draw side</div><div class="t m3 x13 h6 y1b4 ff2 fs4 fc0 sc0 ls0 ws0">widgets with shortcuts to various apps, Figure 9a and 9b), status in-</div><div class="t m3 x13 h6 y1b5 ff2 fs4 fc0 sc0 ls0 ws0">dicators (e.g., battery level, Figure 10a), and productivity apps (that</div><div class="t m0 x13 h6 y1b6 ff2 fs4 fc0 sc0 ls0 ws0">create shortcuts to documents, notes, and calendars, Figure 10b).</div><div class="t m3 x1e h6 y1b7 ff2 fs4 fc0 sc0 ls0 ws0">We note that, in all cases, these widgets are drawn opaque, click-</div><div class="t m3 x13 h6 y1b8 ff2 fs4 fc0 sc0 ls0 ws0">able, and they are place at the margin of the screen. This is expected,</div><div class="t m1c x13 h6 y1b9 ff2 fs4 fc0 sc0 ls0 ws0">as users would likely be annoyed by on-top opaque overlays in the</div><div class="t m15 x13 h6 y1ba ff2 fs4 fc0 sc0 ls0 ws0">middle of the screen. We also note that these apps do not conict</div><div class="t m5 x13 h6 y1bb ff2 fs4 fc0 sc0 ls0 ws0">with the obscured ag defense. In fact, this defense kicks in only</div><div class="t m10 x13 h6 y1bc ff2 fs4 fc0 sc0 ls0 ws0">when overlays cover the security-sensitive button itself. However,</div><div class="t m3 x13 h6 y1bd ff2 fs4 fc0 sc0 ls0 ws0">the “hide overlays” defense could cause problems, because the users</div><div class="c x11 y46 w2 hc"><div class="t m0 x0 hd y47 ff7 fs7 fc0 sc0 ls0 ws0">Session 6B: Mobile 1</div></div><div class="c x2e y46 w3 hc"><div class="t m0 x0 hd y47 ff7 fs7 fc0 sc0 ls0 ws0">CCS’18, October 15-19, 2018, Toronto, ON, Canada</div></div><div class="c x2f y48 w4 hc"><div class="t m0 x0 hd y47 ff7 fs7 fc0 sc0 ls0 ws0">1124</div></div><a class="l" rel='nofollow' onclick='return false;'><div class="d m14"></div></a><a class="l" rel='nofollow' onclick='return false;'><div class="d m14"></div></a><a class="l" rel='nofollow' onclick='return false;'><div class="d m14"></div></a><a class="l" rel='nofollow' onclick='return false;'><div class="d m14"></div></a><a class="l" rel='nofollow' onclick='return false;'><div class="d m14"></div></a><a class="l" rel='nofollow' onclick='return false;'><div class="d m14"></div></a><a class="l" rel='nofollow' onclick='return false;'><div class="d m14"></div></a><a class="l" rel='nofollow' onclick='return false;'><div class="d m14"></div></a><a class="l" rel='nofollow' onclick='return false;'><div class="d m14"></div></a><a class="l" rel='nofollow' onclick='return false;'><div class="d m14"></div></a><a class="l" rel='nofollow' onclick='return false;'><div class="d m14"></div></a><a class="l" rel='nofollow' onclick='return false;'><div class="d m14"></div></a><a class="l" rel='nofollow' onclick='return false;'><div class="d m14"></div></a></div><div class="pi" data-data='{"ctm":[1.568627,0.000000,0.000000,1.568627,0.000000,0.000000]}'></div></div>