Apps on mobile phones might have hidden or harmful behaviours about which end-users know little to nothing, according to Ohio State University researcher Zhiqiang Lin.
For this study, the research team evaluated 150,000 apps: the top 100,000 based on the number of downloads from the Google Play store, the top 20,000 from an alternative market, and 30,000 from pre-installed apps on Android smartphones.
12,706 of those apps, (~8.5%), that can be triggered to do something unknown to the user. They also found that some apps can be remotely accessed through master passwords to reveal data within them, and some apps, they found, had secret access keys that could trigger hidden options, including bypassing payment.
“Both users and developers are all at risk if a bad guy has obtained these backdoor secrets,” Lin said, explaining that attackers could reverse-engineer these apps to find the keys.
“A key reason why mobile apps contain these backdoor secrets is because developers misplaced the trust,” said Zhao. To truly secure their apps, he said, developers need to perform security-relevant user-input validations and push their secrets on the back-end servers.
Another 4,028 apps (~2.7%) were intended to blocked content containing specific keywords subject to censorship, cyber bullying or discrimination. But the way that they did it was surprising: validating locally instead of remotely, said Lin. “On many platforms, user-generated content may be moderated or filtered before it is published,” he said – social media sites including Facebook, Instagram and Tumblr, limit the content users are permitted to publish on those platforms.
“Unfortunately, there might exist problems. For example, users know that certain words are forbidden from a platform’s policy, but they are unaware of examples of words that are considered as banned words and could result in content being blocked without users’ knowledge,” said Zhao. “Therefore, end users may wish to clarify vague platform content policies by seeing examples of banned words.”
In addition, he said, researchers studying censorship may wish to understand what terms are considered sensitive.
The team developed an open source tool, called InputScope, to help developers understand weaknesses in their apps and to demonstrate that the reverse-engineering process can be fully automated.
Source: electronicsweekly
