安卓云备份模块的代码安全问题分析

梁蛟; 刘武; 韩伟力; 王晓阳; 甘似禹; 沈烁

doi:10.11959/j.issn.2096-109x.2017.00132

您当前的位置：

首页 >

文章列表页 >

安卓云备份模块的代码安全问题分析

学术论文 | 更新时间：2024-06-03

- 安卓云备份模块的代码安全问题分析
- Code security of mobile backup modules on the Android platform
- 网络与信息安全学报 2017年3卷第1期页码：68-78
- 作者机构：
  
  1. 上海市数据科学重点实验室（复旦大学），上海 201203
  2. 上海市信息投资股份有限公司，上海 200120
  3. 中国科学院计算机网络信息中心，北京 100190
- 作者简介：
  
  [ "梁蛟（1993-），女，山西忻州人，复旦大学硕士生，主要研究方向为云备份系统安全、访问控制。" ]
  [ "刘武（1992-），男，湖南湘潭人，复旦大学硕士生，主要研究方向为云备份系统安全、访问控制。" ]
  [ "韩伟力（1975-），男，浙江绍兴人，博士，复旦大学副教授，主要研究方向为访问控制、数字身份安全、网络与系统安全。" ]
  [ "王晓阳（1960-），男，上海人，博士，复旦大学特聘教授、博士生导师，主要研究方向为数据库、并行式数据分析和信息安全。" ]
  [ "甘似禹（1966-），男，江西抚州人，上海市信息投资股份有限公司大数据研究院高级工程师，主要研究方向为电子数据交换、数据质量和系统安全。" ]
  [ "沈烁（1977-），男，辽宁阜新人，博士，中国科学院计算机网络信息中心物联网中心副主任、副研究员，主要研究方向为物联网标准体系、信息安全。" ]
- 基金信息：
  
  上海市科技创新行动计划基金资助项目;The Shanghai Innovation Action Project(16DZ1100200);上海市科技创新行动计划基金资助项目;The Shanghai Innovation Action Project(15511101500)
- DOI：10.11959/j.issn.2096-109x.2017.00132
  中图分类号： TP309
- 网络首发：2017-01，
  
  纸质出版：2017-01-15
- 稿件说明：
移动端阅览
梁蛟, 刘武, 韩伟力, 等. 安卓云备份模块的代码安全问题分析[J]. 网络与信息安全学报, 2017,3(1):68-78.

Jiao LIANG, Wu LIU, Wei-li HAN, et al. Code security of mobile backup modules on the Android platform[J]. Journal of network and information security, 2017, 3(1): 68-78.
梁蛟, 刘武, 韩伟力, 等. 安卓云备份模块的代码安全问题分析[J]. 网络与信息安全学报, 2017,3(1):68-78. DOI： 10.11959/j.issn.2096-109x.2017.00132.

Jiao LIANG, Wu LIU, Wei-li HAN, et al. Code security of mobile backup modules on the Android platform[J]. Journal of network and information security, 2017, 3(1): 68-78. DOI： 10.11959/j.issn.2096-109x.2017.00132.

摘要

随着移动端云备份服务的日益普及，为保障用户隐私数据不被泄露，研究第三方应用调用云备份软件开发工具包（SDK

software development kit）的安全问题变得尤为重要。通过对目前国内外安卓应用市场中调用云备份服务的普遍性进行调研，总结出4个当前主流的安卓云备份SDK。分析其SDK实现代码和官方文档，对比使用情况、协议和接口功能，总结和发现了第三方应用错误调用SDK以及云备份SDK自身存在的代码安全问题，同时向第三方开发者提供了相应的解决方案。

Abstract

Since more and more third-party Android applications integrate backup services

the security issues of mobile backup modules are critical. By studying how widely these backup services were being used in the Android applications

the differences of code security about four mainstream Android backup SDK were investigated. After analyzing and comparing the usages

protocols and API functions of these SDK. Based on the above findings and three reported security issues of mobile backup services

the countermeasures for third-party application developers were suggested to securely call the SDK of mobile backup services.

关键词

Keywords

references

BUYYA R , YEO S , VENUGOPAL S , et al . Cloud computing and emerging IT platforms: vision, hype, and reality for delivering computing as the 5th utility [J ] . Future Generation Computer Sys-tems , 2009 , 25 ( 6 ): 599 - 616 .

[EB/OL ] . https://www.dropbox.com/ https://www.dropbox.com/ .

[EB/OL ] . https://www.google.com/drive/ https://www.google.com/drive/ .

[EB/OL ] . https://onedrive.live.com/ https://onedrive.live.com/ .

[EB/OL ] . https://yun.baidu.com/ https://yun.baidu.com/ .

HAY R , PELES O . Remote exploitation of the dropbox SDK for Android [EB/OL ] . https://dl.packetstormsecurity.net/1503-exploits/exploiting-dropboxsdk-android.pdf https://dl.packetstormsecurity.net/1503-exploits/exploiting-dropboxsdk-android.pdf .

[EB/OL ] . https://en.wikipedia.org/wiki/Dropbox_(service) https://en.wikipedia.org/wiki/Dropbox_(service) .

[EB/OL ] . https://en.wikipedia.org/wiki/OneDrive https://en.wikipedia.org/wiki/OneDrive .

[EB/OL ] . https://en.wikipedia.org/wiki/Google_Drive https://en.wikipedia.org/wiki/Google_Drive .

[EB/OL ] . https://en.wikipedia.org/wiki/Baidu_Cloud https://en.wikipedia.org/wiki/Baidu_Cloud .

[EB/OL ] . https://play.google.com/store https://play.google.com/store .

[EB/OL ] . http://www.coolapk.com/ http://www.coolapk.com/ .

[EB/OL ] . https://en.wikipedia.org/wiki/Communications_protocol https://en.wikipedia.org/wiki/Communications_protocol .

VLADIMIROVA T , BANU R , SWEETING M N , et al . On-board security services in small satellites [C ] // IETF RFC . 2000 .

HARNIK D , PINKAS B , SHULMAN-PELEG A . Side channels in cloud services: deduplication in cloud storage [J ] . IEEE Security＆Privacy [C ] . 2010 , 8 ( 6 ): 40 - 47 .

RECORDON D , HARDT D . The OAuth 2.0 authorization frame-work [J ] . Polymer , 2009 , 50 ( 24 ): 5708 - 5712 .

GOLDBERG A , BUFF R , SCHMITT A . A comparison of HTTP and HTTPS performance [J ] . Computer Measurement Group , 1998 .

SUN T , HAWKEY K , BEZNOSOV K . Systematically breaking and fixing OpenID security: formal analysis, semi-automated em-pirical evaluation, and practical countermeasures [J ] . Computers＆Security , 2012 , 31 ( 4 ): 465 - 483 .

DURUMERIC Z , KASTEN J , ADRIAN D , et al . The Matter ofHeartbleed [C ] // Conference on Internet Measurement , 2014 : 475 - 488 .

魏兴国 . HTTP 和 HTTPS 协议安全性分析 [J ] . 程序员， 2007 ( 7 ): 53 - 55 .

WEI X G , Security analysis of HTTP and HTTPS protocol [J ] . The Programmer , 2007 ( 7 ): 53 - 55 .

FAHL S , HARBACH M , MUDERS T , et al . Why eve and mallory love Android: an analysis of Android SSL (in)security [C ] // ACM Conference on Computer and Communications Security . 2012 : 50 - 61 .

FAHL S , HARBACH M , PERL H , et al . Rethinking SSL develop-ment in an appified world [C ] // ACM Sigsac Conference on Com-puter＆Communications Security . 2013 : 49 - 60 .

PATIL M A V , KALE M N D . Survey on secure authorized de-duplication in hybrid cloud [J ] . International Journal on Recent and Innovation Trends in Computing and Communication . 2014 , 2 ( 11 ): 3574 - 3577 .

WANG X , YU H . How to break MD5 and other hash functions [C ] // International Conference on Theory and Applications of Crypto-graphic Techniques . 2005 : 561 - 561 .

PULLS T . (More) Side channels in cloud storage [M ] // Privacy and Identity Management for Life . Berlin Heidelberg: Springer 2011 : 102 - 115 .

BELLARE M , KEELVEEDHI S , RISTENPART T . DupLESS:server-aided encryption for deduplicated storage [C ] // Usenix Con-ference on Security . 2013 : 179 - 194 .

LIU J , ASOKAN N , PINKAS B . Secure deduplication of encrypted data without additional independent servers [C ] // The 22nd ACM SIGSAC Conference on Computer and Communications Security. ACM , 2015 : 874 - 885 .

XU J , CHANG E C , ZHOU J . Weak leakage-resilient client-side deduplication of encrypted data in cloud storage [C ] // The 8th ACM SIGSAC Symposium on Information, Computer and Communica-tions Security . 2013 : 195 - 206 .

张天琪 . OAuth 协议安全性研究 [J ] . 信息网络安全， 2013 , ( 3 ): 68 - 70 .

ZHANG T Q , Study on OAuth protocol security [J ] . Netinfo Secu-rity , 2013 ( 3 ): 68 - 70 .

HAMMER-LAHAV E . Introducing oauth 2.0 [J ] . Hueniverse , 2010 .

PAI S , SHARMA Y , KUMAR S , et al . Formal verification of OAuth 2.0 using alloy framework [C ] // The International Conference on Communication Systems and Network Technologies . 2011 : 655 - 659 .

CHARI S , JUTLA C S , ROY A . Universally composable security analysis of OAuth v2.0. [J ] . Iacr Cryptology Eprint Archive , 2011 .

SLACK Q , FROSTIG R . OAuth 2.0 implicit grant flow analysis using Murphi [J ] .

ALESSANDRI T , BESCHI D , CASCIARO S , et al . The devil is in the (implementation) details: an empirical analysis of OAuth SSO systems [C ] // ACM Conference on Computer and Communications Security . 2012 : 378 - 390 .

MCGLOIN M , HUNT P , OAuth 2.0 Threat model and security considerations [J ] . Internet Engineering Task Force (IETF) RFC , 2013 :

KIANI K . How to secure your oauth implementation [EB/OL ] . KIANI K . How to secure your oauth implementation [EB/OL ] . https://www.mendeley.com/research/four-attacks-oauth-secure-oaut h-implementation/ https://www.mendeley.com/research/four-attacks-oauth-secure-oaut h-implementation/ .

WANG R , ZHOU Y , CHEN S , et al . Explicating SDKS: uncovering assumptions underlying secure authentication and authoriza-tion [C ] // Presented as Part of the 22nd USENIX Security Sympo-sium . 2013 : 399 - 314 .

CHEN E Y , PEI Y , CHEN S , et al . Oauth demystified for mobile application developers [C ] // The 2014 ACM SIGSAC Conference on Computer and Communications Security. ACM . 2014 : 892 - 903 .

WANG H , ZHANG Y , LI J , et al . Vulnerability assessment of oauth implementations in android applications [C ] // The 31st Annual Computer Security Applications Conference. ACM . 2015 : 61 - 70 .

[EB/OL ] . http://www.wooyun.org/ http://www.wooyun.org/ .

[EB/OL ] . http://www.androidheadlines.com/2014/11/50-users-root-phones- order-removebuilt-apps-one.html http://www.androidheadlines.com/2014/11/50-users-root-phones- order-removebuilt-apps-one.html .

FERNANDES D A B , SOARES L F B , GOMES J V , et al . Security issues in cloud environments: a survey [J ] . International Journal of Information Security , 2013 , 13 ( 2 ): 113 - 170 .

SUBASHINI S , KAVITHA V . A survey on security issues in ser-vice delivery models of cloud computing [J ] . Journal of Network＆Computer Applications , 2011 , 35 ( 1 ): 1 - 11 .

CHOW R , GOLLE P , JAKOBSSON M , et al . Controlling data in the cloud: outsourcing computation without outsourcing control [J ] . ACM Workshop on Cloud Computing Security , 2009 : 85 - 90 .

ATENIESE G , BURNS R , CURTMOLA R , et al . Provable data possession at untrusted stores [C ] // ACM Conference on Computer and Communications Security. ACM , 2007 : 598 - 609 .

JUELS A , KALISKI B S . Pors: proofs of retrievability for large files [C ] // ACM Conference on Computer and Communications Se-curity. ACM , 2007 : 584 - 597 .

BOWERS K D , JUELS A , OPREA A . Proofs of retrievability:theory and implementation [C ] // ACM Cloud Computing Security Workshop 2009 : 43 - 54 .

ATENIESE G , PIETRO R D , MANCINI L V , et al . Scalable and effi-cient provable data possession. [C ] // The 4th International Conference on Security and Privacy in Communication Networks . 2008 : 1 - 10 .

ERWAY C C , PAPAMANTHOU C , TAMASSIA R . Dynamic provable data possession [J ] . ACM Transactions on Information＆System Security . 2009 , 17 ( 4 ): 213 - 222 .

QUINLAN S , DORWARD S . Venti: a new approach to archival storage [C ] // The Conference on File and Storage Technologies. USENIX Association . 2002 : 89 - 101 .

DOUCEUR J R , ADYA A , BOLOSKY W J , et al . Reclaiming space from duplicate files in a serverless distributed file system [C ] // The International Conference on Distributed Computing Systems . 2002 : 617 - 624 .

BELLARE M , KEELVEEDHI S . Interactive message-locked en-cryption and secure deduplication [M ] // Public-Key Cryptography-PKC 2015 . Berlin Heidelberg: Springer 2015 : 516 - 538 .

MULAZZANI M , SCHRITTWIESER S , LEITHNER M , et al . Dark clouds on the horizon: using cloud storage as attack vector and online slack space [C ] // USENIX Security . 2011 : 5 .

[EB/OL ] . http://blog.trendmicro.com/trendlabs-security-intelligence/setting-the-record-straight-on-moplus-sdk-and-the-wormhole-vulnerability/ http://blog.trendmicro.com/trendlabs-security-intelligence/setting-the-record-straight-on-moplus-sdk-and-the-wormhole-vulnerability/ .

浏览量

452

下载量

CSCD

文章被引用时，请邮件提醒。

提交

工具集

关联资源

暂无数据