An Empirical Study of Web Resource Manipulation in Real-world Mobile Apps...
summary
An automated static tool XPMChecker scans 80,694 Google Play apps and finds that 49.2% of detected web-resource manipulations are cross-principal manipulation; 4.8% of apps exhibit XPM, over 63% of XPMs originate from 88 third‑party libraries, and more than 70% target top sites (Google, Facebook, YouTube). The tool analyzes ~95% of apps at ~10s/app with ~99% precision and uncovers 21 apps with malicious XPM (up to 130M installs) that steal cookies, credentials, or impersonate sites.
AI-written summary · about
chapters (20)
- 0:00Start
- 0:31Background
- 1:05Web-App Integration Security Risks
- 2:24Web Resource Manipulation APIs
- 3:18Motivating Example
- 4:28Definitions
- 5:20Methodology
- 5:59Identify App Principals
- 7:35Determine P
- 9:08XPMChecker Design & Implementation
- 10:15XPMChecker Evaluation
- 11:08Finding: XPM Prevalence
- 11:44Finding: XPM Location
- 12:23Finding: XPM Intents
- 13:28Malicious XPM Intents
- 14:33Impersonating relying party in OAuth
- 15:14Stealing user credentials
- 15:37Stealing and abusing Cookies
- 16:21Finding: XPM Targets and Their Awareness
- 17:38Conclusion
related talks
42mMUwS, PHA, vulnerabilities: A walk through on what not to do
42mIf 6,000 Mobile Malware Applications Could Talk! Ow, They Do, And A Lot!
24mRecent Mobile App Security Incidents from Real-World Cases
21mSecuring the Unseen: Advanced Threats, Best Practices & Challenges in Mobile App Security
25mMobile App Security: Threat Landscape
28mProtecting Mobile Games Against Hackers, Crackers & Copycatters
40mSecurity: The Hidden Cost of Android Stalkerware
27mBypassing Browser Security Policies for Fun and Profit