Unveiling Vulnerabilities: A Deep Dive into Android Native Libraries
0:43 Introduction: Researchers Rokhaya Fall and Luca Di Bartolomeo from EPFL embarked on a project to analyze Android apps for outdated and vulnerable native libraries using binary similarity techniques.
3:39 Massive Dataset: An initial script error led to the download of approximately 8 million Android apps (11 terabytes of data) from various app stores, creating a massive dataset for analysis.
6:02 Library Reuse: Among the 8.5 million apps, 12% contained native libraries, with approximately 1 million unique binaries. Notably, the top 5,000 binaries accounted for 77% of all library usage, indicating minimal customization.
6:46 Binary Similarity Approaches: The team explored four binary similarity methods, categorized as "lawful" (machine learning-based) and "chaotic" (experimental, heuristic-based).
7:09 Machine Learning Challenges: Two machine learning models, ASM2Vec (CPU-based) and জেট্রেন (GPU-based), were tested. However, both faced performance issues and high computational costs when applied to the large dataset, with জেট্রেন estimated to take 38 years to process all libraries.
12:39 Chaotic Discoveries: Analysis of library usage patterns revealed a non-smooth distribution, suggesting that developers often directly integrate libraries from sources like Maven without subsequent updates.
14:59 Maven Central Repository: 29% of the libraries in the dataset were directly matched to libraries in the Maven Central repository, simplifying identification and providing ground truth for evaluating machine learning models.
15:45 React Native Case Study: The most popular native library, React Native, had missing versions on Maven due to a history of platform switches (from Maven to npm and back to Maven), highlighting the ecosystem's instability.
19:39 Improved Detection: Integrating the missing React Native versions from npm improved the detection rate to almost 60%.
20:10 Outdated Libraries: Analysis of the GIF library (libpl_droidsonroids.so) revealed that 78% of apps using it were still vulnerable to a 6-year-old CVE, including the pre-installed "Update News for Samsung" app on Samsung devices.
22:18 The "Strings" Approach: A simplistic binary similarity approach based on comparing strings outperformed machine learning models on larger benchmarks, highlighting the need for better benchmarks in the field.
29:58 Conclusion: The study emphasizes the prevalence of outdated native libraries in Android apps, the challenges of applying current binary similarity techniques to large datasets, and the potential of simpler methods for specific tasks.
37:43 Future Work: While the team considered notifying developers of vulnerable libraries, the sheer number of affected apps made it impractical. Future research may involve a more thorough examination of exploitability and impact.