Risk Analysis and Detection on Communication with Intents in Android Applications

In order to detect the security defects caused by the intent communication in Android applications, a detection method was proposed based on the combination of dynamic test and static analysis. In static analysis phase, the internal and external intentioned components in application were detected to estimate the risk of being hijacked according to the designed method. For components requested by the Intent with Extras attribute, sensitive data and privilege leakage were checked by stain tracking analysis at last. In dynamic testing phase, according to the Intents detected in the static analysis phase, the formatted test data were constructed for the Fuzzing test and the test instructions were sent to the application installed on the test platform. And the execution logs were collected and used to determine whether a risk of service denial exists. Experimental results show that, the detection method can detect effectively and comprehensively the Intent-based security defects. © 2017, Editorial Department of Transaction of Beijing Institute of Technology. All right reserved.