Meng Hao

Beyond Sensitive APIs: Detecting Access Control Flaws at Sensitive Callsites in Android Firmware

Existing studies of vulnerable pre-installed Android apps identify dangerous behavior by checking whether an app invokes an API from a predefined set of security-sensitive APIs. These sets usually exclude generic APIs to avoid false positives; unfortunately, this misses a class of vulnerabilities in which a generic API...