CRAXDroid: Android 下的自動化攻擊產生系統

CRAXDroid: Crash Analysis for Automatic Exploit Generation on Android System

陳俊諺(Chun-yen Chen)

指導教授 ： 黃世昆 ； 陳穎平

國立交通大學/資訊學院/資訊科學與工程研究所/碩士(2014年)

https://doi.org/10.6842/NCTU.2014.00682

摘要

"The number of mobile-connected devices will exceed the world’s population by
2014.", said Cisco. People live on mobile devices
nowadays literally, and the situation is still getting worse ever since company
starts to embed smart devices into accessories, for example, glasses, watches,
etc. Making life better is wonderful, while losing privacy is bad. The
prevalence of modern smart devices, such as smart phones and tablets, are owed
to enriched third-party applications, or so-called apps. However, most mobile
device users have no idea how their privacy data are potentially exposed by
using or just installing apps that are badly designed. These apps may not be
designed with malicious intention, but may contain software design flaws, or
bugs, which could be exploited and further take over control of the device.
From the moment on, invaders may pry into victims' life without its knowing.
Besides privacy leakage, invaders may take victims' as a gateway or even a
member of a botnet to further attack other victims. As a result, software
quality becomes a critical issue on mobile devices. CRAXDroid is
built as a platform aiming at vulnerability discovering and exploiting of
Android apps.

關鍵字

軟體脅迫 ； 軟體品質 ； 符號執行

並列摘要

"The number of mobile-connected devices will exceed the world’s population by
2014.", said Cisco. People live on mobile devices
nowadays literally, and the situation is still getting worse ever since company
starts to embed smart devices into accessories, for example, glasses, watches,
etc. Making life better is wonderful, while losing privacy is bad. The
prevalence of modern smart devices, such as smart phones and tablets, are owed
to enriched third-party applications, or so-called apps. However, most mobile
device users have no idea how their privacy data are potentially exposed by
using or just installing apps that are badly designed. These apps may not be
designed with malicious intention, but may contain software design flaws, or
bugs, which could be exploited and further take over control of the device.
From the moment on, invaders may pry into victims' life without its knowing.
Besides privacy leakage, invaders may take victims' as a gateway or even a
member of a botnet to further attack other victims. As a result, software
quality becomes a critical issue on mobile devices. CRAXDroid is
built as a platform aiming at vulnerability discovering and exploiting of
Android apps.

並列關鍵字

Android ； Apps ； Exploit ； Symbolic Execution ； Software Quality

參考文獻

[1] Vitaly Chipounov, Volodymyr Kuznetsov, and George Candea. "S2E: A platform for in-

[7] Rafael Fedler, Marcel Kulicke, and Julian Schüe. "Native code execution control for

[12] Sebastian Höbarth and Rene Mayrhofer. "A framework for on-device privilege escala-

vivo multi-path analysis of soware systems". In: ACM SIGARCH Computer Architecture

News 39.1 (2011), pp. 265­278.