Vetting and Analyzing Network Services of iOS Apps
Published in Usenix Security Symposium, 2020
Recommended citation: Zhushou Tang, Ke Tang, Minhui Xue, Yuan Tian, Sen Chen, Muhammad Ikram, Tielei Wang, Haojin Zhu, "iOS, Your OS, Everybodys OS: Vetting and Analyzing Network Services of iOS Apps", Usenix Security, 2020. https://www.usenix.org/conference/usenixsecurity20/presentation/tang
Abstract: Smartphone applications that listen for network connections introduce significant security and privacy threats for users. In this paper, we focus on vetting and analyzing the security of iOS apps’ network services. To this end, we develop an efficient and scalable iOS app collection tool to download 168,951 iOS apps in the wild. We investigate a set of 1,300 apps to understand the characteristics of network service vulnerabilities, confirming 11 vulnerabilities in popular apps, such as Waze, Now, and QQBrowser. From these vulnerabilities, we create signatures for a large-scale analysis of 168,951 iOS apps, which shows that the use of certain third-party libraries listening for remote connections is a common source of vulnerable network services in 92 apps. These vulnerabilities open up the iOS device to a host of possible attacks, including data leakage, remote command execution, and denial-of-service attacks. We have disclosed identified vulnerabilities and received acknowledgments from vendors.
Recommended citation: ‘Zhushou Tang, Ke Tang, Minhui Xue, Yuan Tian, Sen Chen, Muhammad Ikram, Tielei Wang, Haojin Zhu, "iOS, Your OS, Everybodys OS: Vetting and Analyzing Network Services of iOS Apps", Usenix Security, 2020.’