摘要： 针对Android应用程序与WebView交互可能导致隐私泄露的问题,分析WebView的2个隐私泄露主要通道addJavascriptInterface和loadUrl,提出一种扩展TaintDroid的数据流跟踪框架WTD。WTD扩展了Android源码中的addJavascriptInterface和敏感API,在敏感API中利用Java函数栈执行跟踪机制记录系统中的函数调用层次关系,从而判断addJavascriptInterface注册对象是否访问敏感API,同时增加loadUrl加载页面参数的污点检测。实验结果表明,WTD能有效检测WebView引起的隐私数据泄露。

关键词: Android平台, WebView组件, 隐私泄露, 数据流跟踪, 污点检测

Abstract: Interaction between Android application program and WebView will lead to privacy leakage.Aiming at the problem,this paper analyzes two privacy leakage channel of WebView,addJavascriptInterface and loadUrl,and proposes a data flow tracking framework of extended WebView,named WebView Tainted Detection(WTD).WTD extends the addJavascriptInterface and sensitive API in the Android source code.In sensitive API,Java function stack executes trace mechanism to record function hierarchy call relation in the system to detect whether the addJavascriptInterface registering objects accessed Android privacy API.Besides,WTD increases the taint detection of loadUrl loading page parameters.Experimental result shows that WTD can effectively detect the private data leakage from WebView.

Key words: Android platform, WebView component, privacy leakage, data flow tracking, taint detection

中图分类号: 

• TP309.2