关键词: 中间人攻击, 下载劫持, 应用程序安装包, 流量分析, 拦截过滤

Abstract: During the distributing and downloading of Android application packages, it is always be vulnerable to download hijacking attacks. Traffic analysis could be used by sites to detect if they are under this kind of regular download hijacking attacks. But the stealth download hijacking attacks cannot be discovered by using such a method. Based on the discovery and analysis of an actual case, a vulnerability of Android application package stealth download hijacking was proposed. Attackers exploited this vulnerability to implement a stealth download hijacking through deploying bypass devices between the downloaders and the publishers. And the victim sites can hardly notice it by using current methods. The cause, influence and mechanism of the vulnerability were discussed, and a solution was tried to put forward in respects of distributed detection, centralized analysis and active prevention.

Key words: man-in-the-middle attack, download hijacking, application package, traffic analysis, intercepting filter