Composing static analyzers for bug and security vulnerability detection in multilingual android applications

Abstract

Mobile applications (apps) have long invaded the realm of desktop apps. With multiple mobile platforms, each base language is used to develop mobile apps for the specific mobile platform, and developers easily implement mobile apps via a combination of multiple languages for supporting multiple mobile platforms or reusing existing libraries of other languages. However, different languages have different semantics and features, and developing multilingual apps may be vulnerable to programmer errors. Moreover, interoperation semantics among languages are not easily examined by existing analysis tools, and multilingual apps may be vulnerable to various security attacks.In this thesis, we propose two static analyzer composition models for multilingual Android apps analysis: 1) tightly coupled composition and 2) loosely coupled composition. We adopt the tightly coupled analysis model for Android hybrid apps implemented in both Java and JavaScript. Based on the interoperation semantics we investigated, we design and implement a static analysis framework HybriDroid that composites two frontend analysis modules for each language, and bridges the modules using a shared backend analysis module. HybriDroid seamlessly analyzes the interoperation, and it detects bugs and information leaks cross language boundaries. We also propose Adlib, which augments HybriDroid with various analysis models to discover security vulnerabilities in the mobile advertising ecosystem. For an unconstrained composition of analyzers, we design the loosely coupled model in which a static analyzer utilizes the analysis results of another. As a proof of concept, we propose an analysis tool that composes two static analyzers for Java and C to construct call graphs and detect interoperation bugs in JNI programs. Our empirical evaluation shows that the composition approaches are useful to find genuine bugs and security vulnerabilities in real-world multilingual Android apps. We believe that this thesis would be the first step that broadens the scope of static analysis to multilingual programs.