AndroScanner: Automated Backend Vulnerability Detection for Android Applications
TLDR
AndroScanner automates Android backend vulnerability detection using static/dynamic analysis, finding a zero-day in a production app.
Key contributions
- Automated pipeline detects Android app backend vulnerabilities via static and dynamic analysis.
- Extracts backend API calls from APKs using apktool, Androguard, and Frida instrumentation.
- Vets APIs against OWASP API Security Top 10 using APIFuzzer for comprehensive checks.
- Discovered 5 vulnerabilities, including a zero-day Excessive Data Exposure in a production app.
Why it matters
Mobile app backends pose significant security risks that developers often struggle to identify. AndroScanner provides a crucial automated solution, helping prevent serious vulnerabilities like the zero-day found in a widely used production application. This tool empowers developers to proactively secure their applications before deployment.
Original Abstract
Mobile applications rely on complex backends that introduce significant security risks, yet developers often lack the tools to assess these risks effectively. This paper presents AndroScanner, an automated pipeline for detecting vulnerabilities in Android application backends through combined static and dynamic analysis. AndroScanner extracts backend API calls from APK files using apktool, Androguard, and Frida-based dynamic instrumentation, then vets them against the OWASP API Security Top 10 using APIFuzzer. We evaluate AndroScanner on two Android applications: a purposely vulnerable bank application and a production recruitment application with over 50,000 downloads on Google Play Store. Across both applications, AndroScanner extracted 24 APIs and identified 5 vulnerabilities, including a previously unreported zero-day Excessive Data Exposure vulnerability (ranked 3rd in the OWASP API Security Top 10) in the production application. The vulnerability was responsibly disclosed to the development team prior to publication. AndroScanner is available upon request to assist developers in identifying and remediating backend security risks before deployment.
📬 Weekly AI Paper Digest
Get the top 10 AI/ML arXiv papers from the week — summarized, scored, and delivered to your inbox every Monday.