Abstract: Concerning the fact that when the receiver of an Intent does not validate empty data and abnormal data, the process will crash and cause denial of service, an automated Android component vulnerability mining framework based on static analysis techniques and fuzzing test techniques was proposed. In this framework, reverse analysis techniques and static data flow analysis techniques were used to extract package name, component, Intent with the data of a traffic and data flow paths from exported component to private component to assist fuzzing test. In addition, more mutation strategy on the attributes of Intent (such as Action, Category, Data and Extra) were added while generating Intent tests and the Accessibility technology was adopted to close the crash windows in order to realize automation. Finally, a tool named DroidRVMS was implemented, and a comparative experiment with Intent Fuzzer was designed to verify the validity of the framework. The experimental results show that DroidRVMS can find denial of service vulnerability resulting from dynamic broadcast receiver and most types of exceptions.

Key words: component communication, denial of service, static analysis, dynamic analysis, vulnerability mining

摘要： 针对Android应用对获取到的数据没有进行空数据和异常数据的安全验证，会发生崩溃导致组件拒绝服务的问题，提出了一种组件拒绝服务漏洞自动化挖掘框架。通过逆向分析和静态数据流分析技术获取安卓应用的包名和组件信息，同时跟踪应用对Intent对象的数据访问，提取Intent对象携带的数据信息，并且识别公开组件启动私有组件的路径信息，辅助动态模糊测试挖掘漏洞。为了增大测试用例的覆盖范围和实现自动化，该框架增加了对Intent的Action、Category、Data和Extra属性的畸变，并且采用Accessibility技术自动关闭应用崩溃弹窗，大幅提高了检测效率。为了验证框架的有效性和实用性，利用所提的框架设计实现了工具——DroidRVMS，并与Intent Fuzzer工具进行了对比。实验结果表明，DroidRVMS能够有效地发现动态广播组件的拒绝服务漏洞和大部分类型异常导致的拒绝服务攻击。

关键词: 组件通信, 拒绝服务, 静态分析, 动态分析, 漏洞挖掘