TY - GEN
T1 - A First look at Android Apps’ third-party resources loading
AU - Qayyum, Hina
AU - Salman, Muhammad
AU - Nguyen, Duc Linh Giang
AU - Sentana, I Wayan Budi
AU - Ikram, Muhammad
AU - Tyson, Gareth
AU - Kaafar, Mohamed Ali
PY - 2022
Y1 - 2022
N2 - Like websites, mobile apps import a range of external resources from various third-party domains. In succession, the third-party domains can further load resources hosted on other domains. For each mobile app, this creates a dependency chain underpinned by a form of implicit trust between the app and transitively connected third-parties. Hence, a such implicit trust may leave apps’ developers unaware of what resources are loaded within their apps. In this work, we perform a large-scale study of dependency chains in 7,048 free Android mobile apps. We characterize the third-party resources used by apps and explore the presence of potentially malicious resources loaded via implicit trust. We find that around 94% of apps (with a number of installs greater than 500K) load resources from implicitly trusted parties. We find several different types of resources, most notably JavaScript codes, which may open the way to a range of exploits. These JavaScript codes are implicitly loaded by 92.3% of Android apps. Using VirusTotal, we classify 1.18% of third-party resources as suspicious. Our observations raise concerns for how apps are currently developed, and suggest that more rigorous vetting of in-app third-party resource loading is required.
AB - Like websites, mobile apps import a range of external resources from various third-party domains. In succession, the third-party domains can further load resources hosted on other domains. For each mobile app, this creates a dependency chain underpinned by a form of implicit trust between the app and transitively connected third-parties. Hence, a such implicit trust may leave apps’ developers unaware of what resources are loaded within their apps. In this work, we perform a large-scale study of dependency chains in 7,048 free Android mobile apps. We characterize the third-party resources used by apps and explore the presence of potentially malicious resources loaded via implicit trust. We find that around 94% of apps (with a number of installs greater than 500K) load resources from implicitly trusted parties. We find several different types of resources, most notably JavaScript codes, which may open the way to a range of exploits. These JavaScript codes are implicitly loaded by 92.3% of Android apps. Using VirusTotal, we classify 1.18% of third-party resources as suspicious. Our observations raise concerns for how apps are currently developed, and suggest that more rigorous vetting of in-app third-party resource loading is required.
UR - http://www.scopus.com/inward/record.url?scp=85145019532&partnerID=8YFLogxK
U2 - 10.1007/978-3-031-23020-2_11
DO - 10.1007/978-3-031-23020-2_11
M3 - Conference proceeding contribution
AN - SCOPUS:85145019532
SN - 9783031230196
T3 - Lecture Notes in Computer Science
SP - 193
EP - 213
BT - Network and System Security
A2 - Yuan, Xingliang
A2 - Bai, Guangdong
A2 - Alcaraz, Cristina
A2 - Majumdar, Suryadipta
PB - Springer, Springer Nature
CY - Cham
T2 - 16th International Conference on Network and System Security, NSS 2022
Y2 - 9 December 2022 through 12 December 2022
ER -