Systems and methods for automated detection of application vulnerabilities

Patent metadata

Field	Value
Publication number	US-9977904-B2
Application number	US-201514629876-A
Country	US
Kind code	B2
Filing date	Feb 24, 2015
Priority date	Feb 25, 2014
Publication date	May 22, 2018
Grant date	May 22, 2018

Abstract

Disclosed are systems and methods for performing automatic, large-scale analysis mobile applications to determine and analyze application vulnerability. The disclosed systems and methods include identifying potentially vulnerable applications, identifying the application entry points that lead to vulnerable behavior, and generating smart input for text fields. Thus, a fully automated framework is implemented to run in parallel on multiple emulators, while collecting vital information.

First claim

Therefore, the following is claimed:

1. A non-transitory computer-readable medium embodying at least one program that, when executed by at least one computing device, causes the at least one computing device to at least:
obtain a plurality of mobile applications from a source entity;
generate a plurality of method call graphs individually corresponding to a respective one of the plurality of mobile applications;
identify an entry point corresponding to a potential vulnerability in the mobile applications based at least in part on the plurality of method call graphs and at least one overridden interface from an SSL library;
generate a simulated user input for an element of a user interface associated with the entry point based at least in part on an input type associated with the element of the user interface;
install and initiate execution of each of the mobile applications in a plurality of emulated mobile computing devices;
provide the simulated user input to each of the mobile applications in response to determining that a state of each of the mobile applications corresponds to the entry point; and
determine that a communication interception obtained from a proxy corresponds to one of the mobile applications in response to obtaining the communication interception from the proxy, wherein the communication interception indicates the proxy successfully intercepted traffic from the corresponding one of the mobile applications.

2. The non-transitory computer-readable medium of claim 1 , wherein the at least one program further causes the at least one computing device to at least determine whether the entry point of the one of the mobile applications is vulnerable in response to analyzing the communication interception obtained from the proxy.

3. The non-transitory computer-readable medium of claim 2 , wherein the at least one program further causes the at least one computing device to at least report performance of the one of the mobile applications to the source entity in response to determining that the one of the mobile applications is vulnerable.

4. The non-transitory computer-readable medium of claim 1 , wherein the at least one program further causes the at least one computing device to at least disassemble each of the mobile applications to a human readable format to identify the entry point corresponding to the potential vulnerability in the mobile applications.

5. The non-transitory computer-readable medium of claim 1 , wherein the at least one program further causes the at least one computing device to at least generate a schedule for emulating the mobile computing devices, the schedule defining a timing for obtaining the emulated mobile computing devices to install and execute each of the mobile applications on a respective emulated mobile computing device, and wherein installing and executing each of the mobile applications in the emulated mobile computing devices is executed according to the schedule.

6. The non-transitory computer-readable medium of claim 1 , wherein the proxy is configured to intercept and record network traffic data between the mobile applications executed by the emulated mobile computing devices and a target domain, and wherein the communication interception corresponds to a portion of the network traffic data associated with the potential vulnerability of the one of the mobile applications.

7. The non-transitory computer-readable medium of claim 6 , wherein the network traffic data comprises logging success data and logging failure data.

8. A system, comprising:
a data store; and
at least one computing device in communication with the data store, the at least one computing device being configured to at least:
identify a plurality of mobile applications that are associated with a potential vulnerability;
generate a plurality of method call graphs individually corresponding to a respective one of the plurality of mobile applications;
identify an entry point corresponding to the potential vulnerability in the mobile applications based at least in part on the plurality of method call graphs and at least one overridden interface from an SSL library;
install and initiate execution of the mobile applications in a plurality of emulated mobile computing devices;
provide a simulated user input for an element of a user interface associated with the entry point for each of the mobile applications, the simulated user input configured to test the potential vulnerability of each of the mobile applications; and
determine that a proxy intercepted communications from at least one of the mobile applications in response to analyzing network traffic data associated with the entry point and the mobile applications.

9. The system of claim 8 , wherein the at least one computing device is further configured to at least:
disassemble each of the mobiles applications to a human readable format; and
determine whether each of the mobile applications use a modified implementation of a pre-defined security protocol.

10. The system of claim 8 , wherein the at least one computing device is further configured to at least manage the installation and execution of each of the mobile applications on the emulated mobile computing devices according to a schedule.

11. The system of claim 8 , wherein the at least one computing device is further configured to at least record a state change that occurred during execution of at least one of the mobile applications in response to determining that the state change occurred during execution of the at least one of the mobile applications.

12. The system of claim 8 , wherein the network traffic data comprises logging success data associated with each of the mobile applications, wherein the logging success data corresponds to at least one successful access to a target domain using the simulated user input provided via the element of the user interface.

13. The system of claim 12 , wherein the at least one computing device is further configured to at least determine that the at least one of the mobile applications improperly granted the at least one successful access to the target domain to determine whether the at least one of the mobile applications is vulnerable.

14. A method comprising:
identifying, by at least one computing device, a plurality of applications that are associated with a potential vulnerability;
generating, by the at least one computing device, a plurality of method call graphs individually corresponding to a respective one of the plurality of applications;
identifying, by the at least one computing device, an entry point corresponding to the potential vulnerability in the plurality of applications based at least in part on the plurality of method call graphs and at least one overridden interface from an SSL library;
installing and initiating execution of the applications, by the at least one computing device, in a plurality of emulated mobile computing devices;
providing, by the at least one computing device, a simulated user input for an element of a user interface associated with the entry point for each of the applications; and
determining, by the at least one computing device, at least one of the applications is vulnerable in response to determining that a proxy successfully intercepted traffic from the at least one of the applications by processing network traffic data associated with the entry point of each of the applications.

15. The method of claim 14 , wherein the network traffic data is obtained from the proxy that successfully intercepted traffic from the at least one of the applications, and the network traffic data comprises logging s

Assignees

• Univ Texas
• Univ Texas

Inventors

• Khan Latifur
• Lin Zhiqiang
• Thuraisingham Bhavani
• Sahs Justin
• Sounthiraraj David
• Greenwood Garrett

Classifications

• G06F2221/033

  Test or assess software · CPC title

• G06F21/577 Primary

  Assessing vulnerabilities and evaluating computer system security · CPC title

• H04W88/02

  Terminal devices · CPC title

• H04L63/1433

  Vulnerability analysis · CPC title