Androsia: A step ahead in securing in-memory Android application data
summary
Androsia is a static analyzer that finds each object’s last use and instruments Dalvik bytecode to wipe sensitive contents (StringBuilder and destroyable java.security. classes) immediately after that point. It runs a summary-based interprocedural data-flow on Jimple (via Soot), uses FlowDroid* to seed Android call graphs, handles locals, static and instance fields, loops and recursion, and emits a patched APK. Demo shows a heap dump losing the static password after instrumentation; code and CI integration are work in progress for a forthcoming GitHub release.
AI-written summary · about
chapters (36)
- 0:00Introduction
- 1:31Who am I
- 2:05Outline
- 4:58Dataflow Analysis
- 7:09Motivation
- 7:57Garbage Collector
- 9:35String Builder
- 10:07Destroy API
- 10:54Demo
- 11:52Suit
- 14:52FlowDroid
- 17:49Variable scopes
- 19:34Static stringbuilder fields
- 21:31Static secret
- 21:57Static field
- 22:36Output
- 24:04Uncommenting loops
- 24:50Labeling loops
- 25:49Instrumented code
- 26:35Remove static field
- 27:40The gist
- 28:09Mathematical formulations
- 30:30Definition of live variable analysis
- 31:47Definition of DEF set
- 32:35Flow of LV exit and entry sets
- 34:06Mathematical notation
- 34:54Running example
- 35:48Last usage point
- 38:36Live variable analysis
- 40:34Summary
- 41:01Last Use Case
- 41:41Reset Method
- 43:49Demo Code
- 44:52Wrapper Class
- 48:09Reset Methods
- 49:19Reset sb
related talks
38mAndrosia: A tool for securing in memory sensitive data
34mSecuring Android: Tackling Advanced Threats and Enhancing App Security
47mAttacking Android Applications
49mAll Your Code Belongs To Us (Dismantling Android Secrets With CodeInspect)
01h 07mHow to attack (and secure) an Android app: an introduction
50mAndrobugs Framework: An Android Application Security Vilnerability Scanner
21mAndromeda- GUI based Dynamic Instrumentation Toolkit powered by Frida
15mInvestigating Internals With Stoic