Effective inter-component communication mapping in Android with Epicc: an essential step towards holistic security analysis

Abstract

Many threats present in smartphones are the result of in-teractions between application components, not just ar-tifacts of single components. However, current tech-niques for identifying inter-application communication are ad hoc and do not scale to large numbers of ap-plications. In this paper, we reduce the discovery of inter-component communication (ICC) in smartphones to an instance of the Interprocedural Distributive Envi-ronment (IDE) problem, and develop a sound static anal-ysis technique targeted to the Android platform. We ap-ply this analysis to 1,200 applications selected from the Play store and characterize the locations and substance of their ICC. Experiments show that full specifications for ICC can be identified for over 93 % of ICC locations for the applications studied. Further the analysis scales well; analysis of each application took on average 113 seconds to complete. Epicc, the resulting tool, finds ICC vulnerabilities with far fewer false positives than the next best tool. In this way, we develop a scalable vehicle to extend current security analysis to entire collections of applications as well as the interfaces they export. 1