The Betrayal At Cloud City: An Empirical Analysis Of Cloud-Based Mobile Backends

Authors: 

Omar Alrawi, Georgia Institute of Technology; Chaoshun Zuo, Ohio State University; Ruian Duan and Ranjita Pai Kasturi, Georgia Institute of Technology; Zhiqiang Lin, Ohio State University; Brendan Saltaformaggio, Georgia Institute of Technology

Abstract: 

Cloud backends provide essential features to the mobile app ecosystem, such as content delivery, ad networks, analytics, and more. Unfortunately, app developers often disregard or have no control over prudent security practices when choosing or managing these services. Our preliminary study of the top 5,000 Google Play Store free apps identified 983 instances of N-day and 655 instances of 0-day vulnerabilities spanning across the software layers (OS, software services, communication, and web apps) of cloud backends. The mobile apps using these cloud backends represent between 1M and 500M installs each and can potentially affect hundreds of thousands of users. Further, due to the widespread use of third-party SDKs, app developers are often unaware of the backends affecting their apps and where to report vulnerabilities. This paper presents SkyWalker, a pipeline to automatically vet the backends that mobile apps contact and provide actionable remediation. For an input APK, SkyWalker extracts an enumeration of backend URLs, uses remote vetting techniques to identify software vulnerabilities and responsible parties, and reports mitigation strategies to the app developer. Our findings suggest that developers and cloud providers do not have a clear understanding of responsibilities and liabilities in regards to mobile app backends that leave many vulnerabilities exposed.

USENIX Security '19 Open Access Videos Sponsored by
King Abdullah University of Science and Technology (KAUST)

Open Access Media

USENIX is committed to Open Access to the research presented at our events. Papers and proceedings are freely available to everyone once the event begins. Any video, audio, and/or slides that are posted after the event are also free and open to everyone. Support USENIX and our commitment to Open Access.

BibTeX
@inproceedings {236194,
author = {Omar Alrawi and Chaoshun Zuo and Ruian Duan and Ranjita Pai Kasturi and Zhiqiang Lin and Brendan Saltaformaggio},
title = {The Betrayal At Cloud City: An Empirical Analysis Of {Cloud-Based} Mobile Backends},
booktitle = {28th USENIX Security Symposium (USENIX Security 19)},
year = {2019},
isbn = {978-1-939133-06-9},
address = {Santa Clara, CA},
pages = {551--566},
url = {https://www.usenix.org/conference/usenixsecurity19/presentation/alrawi},
publisher = {USENIX Association},
month = aug
}

Presentation Video