Measuring the Insecurity of Mobile Deep Links of Android
summary
Analysis of 160,000+ Android apps (2014, 2016) and 1M web pages extracts deep links and shows concrete failures: only 194 apps (2.2% of 8,878 with App Links) correctly pass Android link verification, App Links introduce a new flaw that allows malicious apps to intercept arbitrary HTTPS URLs via the App Links preference, and web-exposed App Links are hijacked far more often than legacy scheme URLs (authors find ~300× more hijacked App Link instances on crawled pages). A prototype attack demonstrates stealthy interception with a ~0.75s bounce before returning the user. Intent URLs see negligible web adoption.
AI-written summary · about
chapters (18)
- 0:00Intro
- 1:16Apps vs. Mobile Websites
- 2:13Web-App Communication via Deep Links
- 3:32Hijacking Risks of Deep Links
- 6:25Deep Link v2.0 Prevents Link Hijacking
- 8:55Outline
- 9:31Datasets
- 10:26Deep Link Usage in Apps
- 12:56App Link Verification in Practice
- 14:40App Link Vulnerability: Over-permission
- 17:37Identifying Potential Hijacking Apps Link collision multiple apps that registered the same Link
- 18:17Classifying Link Collisions
- 19:34Classifying Per-App Hijacking
- 20:58Hijacking Case Studies
- 21:52Case Studies (Cont.)
- 23:10Deep Links on Alexa Top IM Websites
- 23:46"Hijacked" Deep Links on the Web
- 25:45Countermeasures
related talks
38mMyths about the Deep Links
42mDangers on Android: Vulnerabilities and Defenses
41mOverview of common Android app vulnerabilities
53mDeep Android Integrations
33mBest Practices for Mobile App Security Testing
34mCovert web-to-app tracking via localhost on Android
21mSecuring the Unseen: Advanced Threats, Best Practices & Challenges in Mobile App Security
44mDeep Android Integration