Toward discovering and exploiting private server-side web APIs

Jia Chen; Xingmin Cui; Ziming Zhao; Jie Liang; Shanqing Guo

doi:10.1109/ICWS.2016.61

Toward discovering and exploiting private server-side web APIs

Jia Chen
, Xingmin Cui
, Ziming Zhao
, Jie Liang
, Shanqing Guo

Department of Computer Science and Engineering

Shandong University
The University of Hong Kong
China Information Technology Security Evaluation Center

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › peer-review

3 Scopus citations

Abstract

Many service providers including large enterprises have released their own applications (apps) that incorporate HTTP clients to facilitate the communications with their servers. The workflows of and APIs used by a web app and its corresponding mobile app are not always the same. We call the APIs found in apps private web APIs in that they are only supposed to be invoked by apps that developed by the service providers themselves. However, checking the origin of an HTTP request is very difficult, and private web APIs can be easily invoked by other entities. Hence, it is imperative to study if private web APIs provide the same level of security checks and validations as their public counterparts. To automatically discover the undocumented private APIs in Android apps, we design a system that uses static analysis to find the activities that invoke web APIs. Our system then runs the discovered activities on a customized Android system to monitor its HTTP requests and responses. We evaluated our system on 76 popular apps on the Google Play market. Our system successfully run 48 apps and discovered many private server-side APIs from more than 30 apps. Further manual investigation discovered that 9 of the apps have vulnerabilities that would enable API misuse and session hijacking.

Original language	English
Title of host publication	Proceedings - 2016 IEEE International Conference on Web Services, ICWS 2016
Editors	Stephan Reiff-Marganiec
Publisher	Institute of Electrical and Electronics Engineers Inc.
Pages	420-427
Number of pages	8
ISBN (Electronic)	9781509026753
DOIs	https://doi.org/10.1109/ICWS.2016.61
State	Published - Aug 31 2016
Event	23rd IEEE International Conference on Web Services, ICWS 2016 - San Francisco, United States Duration: Jun 27 2016 → Jul 2 2016

Publication series

Name	Proceedings - 2016 IEEE International Conference on Web Services, ICWS 2016

Conference

Conference	23rd IEEE International Conference on Web Services, ICWS 2016
Country/Territory	United States
City	San Francisco
Period	06/27/16 → 07/2/16

Keywords

Android apps
Dynamic analysis
Static analysis
Web APIs

Access to Document

10.1109/ICWS.2016.61

Cite this

Chen, J., Cui, X., Zhao, Z., Liang, J., & Guo, S. (2016). Toward discovering and exploiting private server-side web APIs. In S. Reiff-Marganiec (Ed.), Proceedings - 2016 IEEE International Conference on Web Services, ICWS 2016 (pp. 420-427). Article 7558030 (Proceedings - 2016 IEEE International Conference on Web Services, ICWS 2016). Institute of Electrical and Electronics Engineers Inc.. https://doi.org/10.1109/ICWS.2016.61

Chen, Jia ; Cui, Xingmin ; Zhao, Ziming et al. / Toward discovering and exploiting private server-side web APIs. Proceedings - 2016 IEEE International Conference on Web Services, ICWS 2016. editor / Stephan Reiff-Marganiec. Institute of Electrical and Electronics Engineers Inc., 2016. pp. 420-427 (Proceedings - 2016 IEEE International Conference on Web Services, ICWS 2016).

@inproceedings{99638c7087f64151b651e77962cde0ad,

title = "Toward discovering and exploiting private server-side web APIs",

abstract = "Many service providers including large enterprises have released their own applications (apps) that incorporate HTTP clients to facilitate the communications with their servers. The workflows of and APIs used by a web app and its corresponding mobile app are not always the same. We call the APIs found in apps private web APIs in that they are only supposed to be invoked by apps that developed by the service providers themselves. However, checking the origin of an HTTP request is very difficult, and private web APIs can be easily invoked by other entities. Hence, it is imperative to study if private web APIs provide the same level of security checks and validations as their public counterparts. To automatically discover the undocumented private APIs in Android apps, we design a system that uses static analysis to find the activities that invoke web APIs. Our system then runs the discovered activities on a customized Android system to monitor its HTTP requests and responses. We evaluated our system on 76 popular apps on the Google Play market. Our system successfully run 48 apps and discovered many private server-side APIs from more than 30 apps. Further manual investigation discovered that 9 of the apps have vulnerabilities that would enable API misuse and session hijacking.",

keywords = "Android apps, Dynamic analysis, Static analysis, Web APIs",

author = "Jia Chen and Xingmin Cui and Ziming Zhao and Jie Liang and Shanqing Guo",

note = "Publisher Copyright: {\textcopyright} 2016 IEEE.; 23rd IEEE International Conference on Web Services, ICWS 2016 ; Conference date: 27-06-2016 Through 02-07-2016",

year = "2016",

month = aug,

day = "31",

doi = "10.1109/ICWS.2016.61",

language = "English",

series = "Proceedings - 2016 IEEE International Conference on Web Services, ICWS 2016",

publisher = "Institute of Electrical and Electronics Engineers Inc.",

pages = "420--427",

editor = "Stephan Reiff-Marganiec",

booktitle = "Proceedings - 2016 IEEE International Conference on Web Services, ICWS 2016",

address = "United States",

}

Chen, J, Cui, X, Zhao, Z, Liang, J & Guo, S 2016, Toward discovering and exploiting private server-side web APIs. in S Reiff-Marganiec (ed.), Proceedings - 2016 IEEE International Conference on Web Services, ICWS 2016., 7558030, Proceedings - 2016 IEEE International Conference on Web Services, ICWS 2016, Institute of Electrical and Electronics Engineers Inc., pp. 420-427, 23rd IEEE International Conference on Web Services, ICWS 2016, San Francisco, United States, 06/27/16. https://doi.org/10.1109/ICWS.2016.61

Toward discovering and exploiting private server-side web APIs. / Chen, Jia; Cui, Xingmin; Zhao, Ziming et al.
Proceedings - 2016 IEEE International Conference on Web Services, ICWS 2016. ed. / Stephan Reiff-Marganiec. Institute of Electrical and Electronics Engineers Inc., 2016. p. 420-427 7558030 (Proceedings - 2016 IEEE International Conference on Web Services, ICWS 2016).

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › peer-review

TY - GEN

T1 - Toward discovering and exploiting private server-side web APIs

AU - Chen, Jia

AU - Cui, Xingmin

AU - Zhao, Ziming

AU - Liang, Jie

AU - Guo, Shanqing

PY - 2016/8/31

Y1 - 2016/8/31

N2 - Many service providers including large enterprises have released their own applications (apps) that incorporate HTTP clients to facilitate the communications with their servers. The workflows of and APIs used by a web app and its corresponding mobile app are not always the same. We call the APIs found in apps private web APIs in that they are only supposed to be invoked by apps that developed by the service providers themselves. However, checking the origin of an HTTP request is very difficult, and private web APIs can be easily invoked by other entities. Hence, it is imperative to study if private web APIs provide the same level of security checks and validations as their public counterparts. To automatically discover the undocumented private APIs in Android apps, we design a system that uses static analysis to find the activities that invoke web APIs. Our system then runs the discovered activities on a customized Android system to monitor its HTTP requests and responses. We evaluated our system on 76 popular apps on the Google Play market. Our system successfully run 48 apps and discovered many private server-side APIs from more than 30 apps. Further manual investigation discovered that 9 of the apps have vulnerabilities that would enable API misuse and session hijacking.

AB - Many service providers including large enterprises have released their own applications (apps) that incorporate HTTP clients to facilitate the communications with their servers. The workflows of and APIs used by a web app and its corresponding mobile app are not always the same. We call the APIs found in apps private web APIs in that they are only supposed to be invoked by apps that developed by the service providers themselves. However, checking the origin of an HTTP request is very difficult, and private web APIs can be easily invoked by other entities. Hence, it is imperative to study if private web APIs provide the same level of security checks and validations as their public counterparts. To automatically discover the undocumented private APIs in Android apps, we design a system that uses static analysis to find the activities that invoke web APIs. Our system then runs the discovered activities on a customized Android system to monitor its HTTP requests and responses. We evaluated our system on 76 popular apps on the Google Play market. Our system successfully run 48 apps and discovered many private server-side APIs from more than 30 apps. Further manual investigation discovered that 9 of the apps have vulnerabilities that would enable API misuse and session hijacking.

KW - Android apps

KW - Dynamic analysis

KW - Static analysis

KW - Web APIs

UR - https://www.scopus.com/pages/publications/84991020751

U2 - 10.1109/ICWS.2016.61

DO - 10.1109/ICWS.2016.61

M3 - Conference contribution

AN - SCOPUS:84991020751

T3 - Proceedings - 2016 IEEE International Conference on Web Services, ICWS 2016

SP - 420

EP - 427

BT - Proceedings - 2016 IEEE International Conference on Web Services, ICWS 2016

A2 - Reiff-Marganiec, Stephan

PB - Institute of Electrical and Electronics Engineers Inc.

T2 - 23rd IEEE International Conference on Web Services, ICWS 2016

Y2 - 27 June 2016 through 2 July 2016

ER -

Chen J, Cui X, Zhao Z, Liang J, Guo S. Toward discovering and exploiting private server-side web APIs. In Reiff-Marganiec S, editor, Proceedings - 2016 IEEE International Conference on Web Services, ICWS 2016. Institute of Electrical and Electronics Engineers Inc. 2016. p. 420-427. 7558030. (Proceedings - 2016 IEEE International Conference on Web Services, ICWS 2016). doi: 10.1109/ICWS.2016.61

Toward discovering and exploiting private server-side web APIs

Abstract

Publication series

Conference

Keywords

Access to Document

Other files and links

Fingerprint

Cite this