基于TaintDroid扩展的WebView隐私泄露检测

Privacy Leakage Detection of WebView Based on Taint Droid Extension

针对Android应用程序与WebView交互可能导致隐私泄露的问题,分析WebView的2个隐私泄露主要通道add Javascript Interface和load Url,提出一种扩展Taint Droid的数据流跟踪框架WTD。WTD扩展了Android源码中的add Javascript Interface和敏感API,在敏感API中利用Java函数栈执行跟踪机制记录系统中的函数调用层次关系,从而判断add Javascript Interface注册对象是否访问敏感API,同时增加load Url加载页面参数的污点检测。实验结果表明,WTD能有效检测Web View引起的隐私数据泄露。

Interaction between Android application program and WebView will lead to privacy leakage. Aiming at the problem, this paper analyzes two privacy leakage channel of WebView, addJavascriptlnterface and loadUrl, and proposes a data flow tracking framework of extended WebView, named WebView Tainted Detection （ WTD）. WTD extends the addJavascriptlnterface and sensitive API in the Android source code. In sensitive API,Java function stack executes trace mechanism to record function hierarchy call relation in the system to detect whether the addJavascriptlnterface registering objects accessed Android privacy API. Besides, WTD increases the taint detection of loadUrl loading page parameters. Experimental result shows that WTD can effectively detect the private data leakage from WebView.