WO2021232279A1 - 文件泄露漏洞的检测方法、装置、电子设备及存储介质 - Google Patents

文件泄露漏洞的检测方法、装置、电子设备及存储介质 Download PDF

Info

Publication number
WO2021232279A1
WO2021232279A1 PCT/CN2020/091246 CN2020091246W WO2021232279A1 WO 2021232279 A1 WO2021232279 A1 WO 2021232279A1 CN 2020091246 W CN2020091246 W CN 2020091246W WO 2021232279 A1 WO2021232279 A1 WO 2021232279A1
Authority
WO
WIPO (PCT)
Prior art keywords
taint
designated
stain
function
propagation
Prior art date
Application number
PCT/CN2020/091246
Other languages
English (en)
French (fr)
Inventor
刘波
Original Assignee
深圳市欢太科技有限公司
Oppo广东移动通信有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 深圳市欢太科技有限公司, Oppo广东移动通信有限公司 filed Critical 深圳市欢太科技有限公司
Priority to CN202080095238.0A priority Critical patent/CN115039099A/zh
Priority to PCT/CN2020/091246 priority patent/WO2021232279A1/zh
Publication of WO2021232279A1 publication Critical patent/WO2021232279A1/zh

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/55—Detecting local intrusion or implementing counter-measures
    • G06F21/56—Computer malware detection or handling, e.g. anti-virus arrangements

Definitions

  • This application relates to the field of information technology, and more specifically, to a method, device, electronic device, and storage medium for detecting file leakage vulnerabilities.
  • this application proposes a method, device, electronic equipment and storage medium for detecting file leakage vulnerabilities.
  • an embodiment of the present application provides a method for detecting file leakage vulnerabilities.
  • the method includes scanning for a designated taint source and a designated taint convergence point in a component of a target application, the designated taint source and the designated taint convergence point Set according to the application’s private file leak vulnerability; when there are taint sources and taint convergence points in the component, according to the first taint propagation function in the designated taint analysis tool, and the first taint marking function in the designated taint analysis tool , The pre-added second taint propagation function and the pre-added second taint marking function perform taint propagation; according to the taint propagation result, it is determined whether the target application has a vulnerability of private file leakage.
  • an embodiment of the present application provides a device for detecting file leakage vulnerabilities.
  • the device includes: a function scanning module, a taint propagation module, and a vulnerability determination module.
  • the function scanning module is used to scan components of a target application.
  • the designated taint source and the designated taint convergence point in, the designated taint source and the designated taint convergence point are set according to the application's private file leakage vulnerability; the taint propagation module is used for the presence of the stain source and the taint convergence point in the component When, according to the first stain propagation function in the specified stain analysis tool, the first stain mark function in the specified stain analysis tool, the second stain propagation function added in advance, and the second stain mark function added in advance, perform stain propagation
  • the vulnerability determination module is used to determine whether the target application has a vulnerability of private file leakage according to the result of the taint propagation.
  • an embodiment of the present application provides an electronic device, including: one or more processors; a memory; one or more application programs, wherein the one or more application programs are stored in the memory and It is configured to be executed by the one or more processors, and the one or more programs are configured to execute the method for detecting file leakage vulnerabilities provided in the above-mentioned first aspect.
  • an embodiment of the present application provides a computer-readable storage medium.
  • the computer-readable storage medium stores program code, and the program code can be called by a processor to execute the file provided in the first aspect. Detection methods for leaked vulnerabilities.
  • the solution provided by this application scans the designated taint source and the designated taint convergence point in the components of the target application.
  • the designated taint source and the designated taint convergence point are set according to the application’s private file disclosure vulnerability and exist in the target application’s component
  • taint source and taint converge, according to the first taint propagation function in the designated taint analysis tool, the first taint marking function in the designated taint analysis tool, the second taint propagation function added in advance, and the second taint marking function added in advance , Carry out taint propagation, and finally determine whether the target application has private file leakage vulnerabilities based on the results of the taint propagation, so as to detect the leakage vulnerabilities of private files of the application, so as to repair the vulnerabilities in time, ensure the security of the application, and protect The user's privacy is safe.
  • Fig. 1 shows a flow chart of a method for detecting file leakage vulnerabilities according to an embodiment of the present application.
  • Fig. 2 shows a flow chart of a method for detecting file leakage vulnerabilities according to another embodiment of the present application.
  • Fig. 3 shows a flow chart of a method for detecting file leakage vulnerabilities according to another embodiment of the present application.
  • Fig. 4 shows a block diagram of a device for detecting file leakage vulnerabilities according to an embodiment of the present application.
  • Fig. 5 is a block diagram of an electronic device for executing the method for detecting file leakage vulnerabilities according to an embodiment of the present application.
  • Fig. 6 is a storage unit for storing or carrying the program code that implements the method for detecting file leakage vulnerabilities according to the embodiment of the present application.
  • Private files of the applications are stored in a private directory of the system, and some sensitive data of users or applications, such as user login credentials, chat records, etc., are usually stored. Under normal circumstances, only the application itself can access private files. If the private files of an application can be read by other applications in a certain way, it means that the application has a private file leakage vulnerability, which may lead to the theft of sensitive information of the user or application.
  • the traditional detection of application security usually includes dynamic analysis and static analysis.
  • static analysis will decompile application installation package (APK, Android application package) files to analyze the permissions, components, sensitive functions and other information therein, which can make up for behaviors that are missed in dynamic analysis because malicious behaviors are not triggered.
  • Dynamic analysis is mainly performed by running Android software on the emulator, and then performing some operations on the software to trigger as many malicious behaviors as possible, and then output to the log, and then analyze the log through a script.
  • taint propagation analysis technology has also been derived. The taint propagation analysis is the current research focus in the field of taint analysis.
  • the taint propagation analysis can be divided into static taint analysis and dynamic taint analysis.
  • the inventor proposes the method, device, electronic device, and storage medium for detecting file leakage vulnerabilities provided by the embodiments of the present application.
  • taint sources and taints set according to the application By scanning application components, taint sources and taints set according to the application’s private file leakage vulnerabilities
  • the taint propagation function is also added according to the additional taint propagation function and taint marking function, and finally, according to the result of the taint propagation, it is determined whether there is a private application.
  • the file leakage vulnerability can effectively realize the leakage vulnerability detection of the private file of the application, improve the efficiency of application security testing, and enhance the security of the application.
  • the specific method for detecting file leakage vulnerabilities will be described in detail in the subsequent embodiments.
  • Step S110 Scan the designated taint source and the designated taint convergence point in the components of the target application, and the designated taint source and the designated taint convergence point are set according to the application's private file leakage vulnerability.
  • the electronic device when it is necessary to detect the leak vulnerability of the private file of the target application, can scan the designated taint source and the designated taint convergence point in the components of the target application.
  • the electronic device can be a device used to test the application before the application leaves the factory, or it can be the mobile terminal installed on the user after the application leaves the factory. It is the detection before the application leaves the factory, or the detection of the leak vulnerabilities of the private files of the application after the user installs the application.
  • Source is the source of taint, which means that untrusted data or confidential data is directly introduced into the system; sink is the taint convergence point, which means that security-sensitive operations are directly generated (violating data integrity) or private data is leaked to the outside world (violating data confidentiality) .
  • the electronic device may obtain the installation package file of the target application whose private file is to be leaked, that is, the APK file.
  • the electronic device can extract information such as manifest, dex, resource file, etc., and then analyze according to the extracted file information, and determine whether the component contains the set specified stain source and the specified stain convergence point, In this way, the scanning of the designated taint source and the designated taint convergence point in the component of the target application is completed.
  • components can include activity (activity), service (service), content provider (content provider), broadcast receive (broadcast receiving), etc. It is understandable that components such as activity, service, content provider, broadcast receive, etc.
  • the above designated taint source and the designated taint convergence point are preset according to the application's private file leakage vulnerability.
  • the designated taint source and the designated taint convergence point can be based on a private file disclosure vulnerability model, which can be a pre-established model for private file disclosure vulnerabilities.
  • the model may include existing private file disclosure vulnerabilities and corresponding vulnerabilities.
  • Stain source and taint convergence point Through this model, all taint sources and taint convergence points related to the leak of private files can be extracted. These extracted taint sources and stain convergence points can be used as designated taint sources and designated taint convergence points in advance. storage.
  • the designated taint source and the designated taint convergence point can also be preset stain sources and taint convergence points after the tester analyzes the private file leakage vulnerability.
  • the designated taint source may include: ⁇ android.app.Activity:android.content.Intent getIntent()> function, ⁇ android.app.Activity:void onNewIntent(android.content.Intent)> function, ⁇ android. app.IntentService: void onHandleIntent(android.content.Intent)> function;
  • the designated taint convergence point can include: ⁇ java.io.OutputStream:void write(byte[],int,int)> function, ⁇ java.io.OutputStream:void write(byte[])> function, ⁇ java.io.
  • Step S120 When there are stain sources and stain convergence points in the component, according to the first stain propagation function in the designated stain analysis tool, the first stain marking function in the designated stain analysis tool, and the pre-added second stain The spread function and the pre-added second stain mark function perform stain spread.
  • the electronic device scans the specified stain source and the specified stain convergence point in the components of the target application, it can determine whether the specified stain source and the specified stain convergence point exist in the components of the target application.
  • the taint can be further propagated to detect the leaking vulnerabilities of private files;
  • the target application does not have the risk of leaking private files, so the detection of the leaking vulnerabilities of the private files of the target application can be ended.
  • the electronic device when it determines that there is a stain source and a stain convergence point in a component of the target application, it can be based on the first stain propagation function and the first stain mark function in the designated stain analysis tool, and also based on the pre-added The second stain propagation function and the pre-added second stain marking function perform the propagation of stain data.
  • the taint propagation function is used to mark the output value of the tainted data as tainted data when the tainted data is propagated to the function, so that the tainted data can continue to be propagated;
  • the taint marking function is used to transfer its parameters when the tainted data is propagated to the function The object is marked as tainted, so that taint propagation continues.
  • the second stain propagation function and the second stain marking function are additionally added, so that when performing stain propagation , There are more propagation paths, which can improve the accuracy of the vulnerability detection of private file leaks.
  • the second taint propagation function and the second taint marking function can be related to private file leak vulnerabilities. That is to say, when performing taint propagation analysis, in addition to specifying the conventional propagation function and marking function in the taint analysis tool, there are also The propagation function and marking function related to private file leakage vulnerabilities enable taint propagation to be closely related to the detection of private file leakage vulnerabilities, and improve the accuracy of the vulnerability detection of private file leakage.
  • Step S130 Determine whether the target application has a leak of a private file according to the result of the taint propagation.
  • the electronic device after the electronic device conducts the spread of the taint, it can analyze the spread result according to the result of the spread of the taint to determine whether the target application has a vulnerability of private file leakage.
  • the electronic device can determine whether there is a propagation path from the specified stain source to the specified stain convergence point in the stain propagation result according to the stain propagation result, and if there is a propagation path from the specified stain source to the specified stain convergence point, then It can be determined that the target application has the vulnerability of private file leakage; if there is no propagation path from the specified taint source to the specified taint convergence point, it is determined that the target application does not have the vulnerability of private file leakage.
  • the method for detecting file leakage vulnerabilities provided in the embodiments of this application scans the taint sources and taint convergence points set according to the application’s private file leakage vulnerabilities in the components of the application, and then uses the existing taint propagation functions and taints in the taint analysis tool On the basis of the marking function, the taint propagation function is also added according to the additional taint propagation function and the taint marking function. Finally, according to the result of the taint propagation, it is determined whether there is a vulnerability of the application's private file leakage, which can effectively realize the application of the private file Leak vulnerability detection, improve the efficiency of application security testing, and improve application security.
  • FIG. 2 shows a schematic flowchart of a method for detecting file leakage vulnerabilities according to another embodiment of the present application.
  • the method for detecting file leakage vulnerabilities can be applied to the above-mentioned electronic devices. The process shown in FIG. 2 will be described in detail below.
  • the method for detecting file leakage vulnerabilities may specifically include the following steps:
  • Step S210 Obtain a decompiled file corresponding to the installation package file of the target application through the designated stain analysis tool.
  • the designated taint analysis tool may be used to implement the method for detecting file leakage vulnerabilities provided in the embodiment of the present application.
  • the designated stain analysis tool may include: FlowDroid stain analysis tool.
  • FlowDroid taint analysis tool is a high-precision taint analysis tool for Android applications. It can analyze APK files, scan taint sources and taint convergence points, generate control flow graphs, and conduct taint propagation analysis.
  • the decompiled file corresponding to the installation package file of the target application can be obtained.
  • the designated taint analysis tool can decompile the APK file of the target application, so as to obtain the decompiled file obtained after decompilation.
  • decompilation refers to the reverse analysis and research of target programs (such as executable programs) to derive design elements such as ideas, principles, structures, algorithms, processing procedures, and operating methods used by others’ software products.
  • the source code may be derived under certain circumstances.
  • Step S220 Obtain the component file of the target application according to the decompiled file.
  • the component file of the target application can be obtained according to the decompiled file.
  • the component file may include component files corresponding to components such as activity, service, content provider, and broadcast receive that are locally exposed in the target application.
  • components such as activity, service, content provider, and broadcast receive are locally exposed components, as they are exposed components, private files may be leaked.
  • scanning of all components can be avoided, thereby reducing the time for vulnerability detection and improving the efficiency of application testing.
  • Step S230 Parse the component file to obtain a designated stain source and a designated stain convergence point corresponding to the target application.
  • the component file after obtaining the component file according to the decompiled file corresponding to the APK file of the target application, the component file can be parsed to obtain the designated taint source and the designated taint convergence point corresponding to the target application.
  • the designated taint analysis tool can realize the analysis of the component file, and the designated taint analysis tool can determine whether the specified taint source and the designated taint convergence point exist in the component file according to the preset designated taint source and designated taint convergence point, and Output the designated taint source and the designated taint convergence point.
  • the designated taint analysis tool when the designated taint analysis tool parses the component file in the decompiled file, it can also parse and obtain the entry node corresponding to the target application.
  • Step S240 Obtain a control flow graph corresponding to the target application.
  • a designated stain analysis tool when performing stain propagation analysis, may be used to obtain a control flow graph corresponding to the target application.
  • the Android application contains multiple entry nodes, and its methods are implicitly called by the Android framework.
  • the Android operating system defines a complete life cycle for each component in the application. These components can include activity (activity) and service (service). , Content provider (content provider), broadcast receive (broadcast receiving), these components need to be configured in the application configuration file AndroidManifest.xml, when constructing the control flow graph, the designated taint analysis tool cannot detect the predefined main method The function starts, and each component in the Android application has a function to reflect the life cycle of the component. Therefore, a designated taint analysis tool can construct a dummy MainMethod() method to simulate the life cycle.
  • obtaining the control flow graph of the target application according to the installation package file of the target application by specifying the taint analysis tool may include: obtaining the life cycle of the target application and the list of callback functions according to the decompiled file; According to the life cycle and the callback function list, the control flow graph is generated.
  • the designated stain analysis tool can directly use the decompiled file obtained in step S210, and analyze the AndroidMainfest.xml file, classes.dex file, and layout file in the layout according to the decompiled file, and obtain life by parsing these files List of cycles and callback functions. Then, the designated taint analysis tool generates a dummy MainMethod() through the life cycle and the callback function list.
  • the Dexpler plug-in in the designated taint analysis tool can convert the .dex file in the APK file to the intermediate representation of the Jimple of the soot framework. Used to generate the control flow graph of the target application.
  • Step S250 Using the control flow graph, and according to the first taint propagation function in the designated taint analysis tool, the first taint marking function in the designated taint analysis tool, the pre-added second taint propagation function, and the pre-added The second taint marking function performs taint propagation.
  • the control flow graph can be used, based on the first stain propagation function and the first stain marking function in the designated stain analysis tool, and also based on the pre-added second stain propagation function.
  • Function and pre-added second taint marking function to spread tainted data.
  • the control flow graph may include multiple paths, according to these paths, and the prescribed stain propagation function and stain marking function, that is, the above first stain marking function, second stain marking function, first stain propagation function, and first stain propagation function.
  • Two taint propagation function which can carry out the propagation of tainted data.
  • the data generated by the specified taint source can be marked as taint data, and then the path corresponding to the taint source can be specified in the control flow graph, and the first taint propagation is based on the above.
  • Function, the first stain mark function, the pre-added second stain propagation function, and the pre-added second stain mark function to propagate the stain data.
  • the path corresponding to the specified stain source in the control flow diagram is used to propagate the stain data; if it is propagated to the first stain marking function or the second stain marking function, the current The first parameter object of the called function is marked as tainted data, and the spread of tainted data is continued; if it is transmitted to the first tainted propagation function or the second tainted propagation function, the return value of the currently called function is marked as tainted data , And continue to spread.
  • the taint propagation function is used to mark its output value as tainted data, so that the tainted data can continue to spread; the taint marking function is used to spread the tainted data to the function.
  • the parameter object is marked as a taint, so that the taint propagation continues.
  • the tainted data is propagated.
  • the data generated by the specified taint source can be obtained by assigning the function corresponding to the specified taint source. Understandably, assigning the function corresponding to the taint source can make the function corresponding to the taint source generate data, so that the taint source can be generated
  • the data is marked as tainted data for the dissemination of tainted data.
  • a function corresponding to a designated taint source can also be called to obtain data generated by the designated taint source, so that the data generated by the tainted source can be marked as tainted data to spread the tainted data.
  • the corresponding to each specified taint source can be obtained
  • the result of the spread of the taint is the result of the spread of the entire taint spreading process.
  • Step S260 Determine whether the target application has a leak of private files according to the result of the taint propagation.
  • the electronic device can determine whether there is a propagation path from the specified stain source to the specified stain convergence point in the stain propagation result according to the stain propagation result, and if there is a propagation path from the specified stain source to the specified stain convergence point, It can be determined that the target application has a vulnerability of private file leakage; if there is no propagation path from the specified taint source to the specified taint convergence point, it is determined that the target application does not have a vulnerability of private file leakage.
  • the designated stain source, the designated stain convergence point, the second stain propagation function, and the second stain mark function can be configured in the code corresponding to the stain analysis tool , So that the designated stain analysis tool can be used to achieve the above steps.
  • the decompiled file is obtained by a designated taint analysis tool, and then the decompiled file is used to determine the taint source and taint aggregation set according to the application’s private file leakage vulnerability in the components of the target application based on the decompiled file Point, and generate a control flow graph, and then use the control flow graph, based on the existing stain propagation function and stain mark function of the stain analysis tool, and also perform stain propagation according to the additional stain propagation function and stain mark function, Finally, it is determined whether there is a leak of private files of the application according to the result of the taint propagation. In this way, it is possible to realize the leak detection of the application's private files through the taint analysis tool, which is convenient and quick. In addition, it can also improve the efficiency of application security testing and improve the security of the application.
  • FIG. 3 shows a schematic flowchart of a method for detecting file leakage vulnerabilities according to another embodiment of the present application.
  • the method for detecting file leakage vulnerabilities can be applied to the above-mentioned electronic devices. The process shown in FIG. 3 will be described in detail below.
  • the method for detecting file leakage vulnerabilities may specifically include the following steps:
  • Step S310 Extract the taint source function in all functions corresponding to the application as the designated taint source according to the private file leakage vulnerability model of the application, and extract the function corresponding to the taint convergence point in all the functions corresponding to the application as the designated taint convergence point.
  • the designated taint source and the designated taint convergence point can be based on a private file disclosure vulnerability model, which may be a pre-established model for private file disclosure vulnerabilities, and the model may include existing private file disclosure vulnerabilities and vulnerabilities corresponding The source of the stain and the convergence point of the stain.
  • a private file disclosure vulnerability model which may be a pre-established model for private file disclosure vulnerabilities, and the model may include existing private file disclosure vulnerabilities and vulnerabilities corresponding The source of the stain and the convergence point of the stain.
  • the private file leakage vulnerability model can be a model that can output the taint sources and taint convergence points corresponding to different types of vulnerabilities, and can use a large number of vulnerability samples and the taint sources and taint sources that are marked on the vulnerability samples. Stain convergence points are obtained by training. By inputting the vulnerability samples of private file leak vulnerabilities into the model, the designated taint source and designated taint convergence points can be obtained. Since the designated taint source and the designated taint convergence point are related to the private file leak vulnerability, the taint propagation analysis used to detect the private file leak vulnerability can be realized.
  • Step S320 According to the application’s private file leakage vulnerability model, extract the taint marking function from all functions corresponding to the application except the first taint marking function, and use it as the second taint marking function, and extract all functions corresponding to the application except The taint propagation function other than the first taint propagation function is used as the second taint propagation function.
  • the second taint propagation function and the second taint marking function may also be extracted according to the above private file leakage vulnerability model.
  • the model can include the propagation function and marking function on the propagation path corresponding to the existing private file leakage vulnerability.
  • the second taint propagation function and the second taint marking function you can set them, for example, set them in the designated taint analysis tool, so that subsequent taint propagation can be realized, except for the first taint propagation in the designated taint analysis tool Function and the first taint marking function, and also according to the pre-added second taint propagation function and the pre-added second taint marking function, the taint data is propagated, so that when the taint is propagated, there are more propagation paths, thereby Can improve the accuracy of the vulnerability detection of private file leaks.
  • the second taint propagation function includes:
  • the second stain marking function includes:
  • Step S330 Scan the designated taint source and the designated taint convergence point in the components of the target application, and the designated taint source and the designated taint convergence point are set according to the application's private file leakage vulnerability.
  • Step S340 When there are stain sources and stain convergence points in the component, according to the first stain propagation function in the designated stain analysis tool, the first stain marking function in the designated stain analysis tool, and the pre-added second stain The spread function and the pre-added second stain mark function perform stain spread.
  • step S330 and step S340 can refer to the content of the foregoing embodiment, and will not be repeated here.
  • Step S350 According to the taint propagation result, if there is a propagation path from any of the designated taint sources to any of the designated taint convergence points, it is determined that the target application has a vulnerability of private file leakage.
  • the taint propagation result after obtaining the taint propagation result, it can be determined whether there is a propagation path from any designated taint source to any of the designated taint convergence points. Specifically, according to the results of the spread of taint data for each taint source, it can be determined whether the taint data of any designated taint source can be transmitted to any designated taint convergence point, and if any taint data of any designated taint source can be transmitted To any designated taint convergence point, it means that there is a propagation path from any designated taint source to any of the designated taint convergence points; if no stain data from any designated taint source can be transmitted to any designated taint convergence point, then It means that there is no propagation path from any designated taint source to any of the designated taint convergence points.
  • the target application when there is a propagation path from any designated taint source to any designated taint convergence point, it can be determined that the target application has a vulnerability of private file leakage; when there is no designated taint source to any designated taint convergence point It can be determined that the target application does not have the vulnerability of private file leakage.
  • some special propagation paths may be caused by normal functions. For example, when an associated application performs account interoperability login, it needs to obtain the account data of another application, so as to realize the login of the account in the application. Therefore, you can also set a preset whitelist and add these propagation paths to the preset whitelist. If there is a propagation path from any specified taint source to any specified taint convergence point, you can determine whether the propagation path is in the preset white list.
  • the propagation path is not in the preset whitelist, it means that the propagation path is not the propagation path corresponding to the normal function, so it can be determined that the target application has the vulnerability of private file leakage; if it is in the preset whitelist, it means the propagation The path is the propagation path corresponding to the normal function, so it can be determined that the target application does not have the vulnerability of private file leakage.
  • Step S360 According to the taint propagation result, if there is no propagation path from the designated taint source to the designated taint convergence point, it is determined that the target application does not have a leak of private files.
  • prompt information and a corresponding propagation path are output, and the prompt information is used to prompt the target application that there is a vulnerability of private file leakage.
  • the target application has a private file leak vulnerability, it means that the application has a security problem, so the user can be prompted and the transmission path of the tainted data corresponding to the vulnerability can be output, so that the target application can be subsequently improved and solved
  • the leak of private files of the target application improves the security of the target application.
  • the form of the promotion information output may not be a limitation, for example, it may be a pop-up prompt.
  • the electronic device can also output the detection result in the form of a detection report, so that the user can intuitively see the detection result of the leakage vulnerability of the private file of the target application.
  • the method for detecting file leakage vulnerabilities also discloses the acquisition of the designated taint source and the designated taint convergence point, as well as the second taint propagation function and the second taint marking function.
  • the point, the second taint propagation function, and the second taint marking function are related to the leak vulnerabilities of private files, so that the taint propagation analysis can realize the leak detection of the private files of the application, improve the efficiency of application security testing, and improve the application Security.
  • FIG. 4 shows a structural block diagram of an apparatus 400 for detecting file leakage vulnerabilities according to an embodiment of the present application.
  • the device 400 for detecting file leakage vulnerabilities applies the above-mentioned electronic equipment, and the device 400 for detecting file leakage vulnerabilities includes: a function scanning module 410, a taint propagation module 420, and a vulnerability determining module 430.
  • the function scanning module 410 is used to scan the designated taint source and the designated taint convergence point in the components of the target application, the designated taint source and the designated taint convergence point are set according to the application's private file leakage vulnerability; the taint spread The module 420 is used to, when there are stain sources and stain convergence points in the component, according to the first stain propagation function in the designated stain analysis tool, the first stain marking function in the designated stain analysis tool, and the second pre-added second stain The taint propagation function and the pre-added second taint marking function perform taint propagation; the vulnerability determination module 430 is used to determine whether the target application has a leak of private files according to the taint propagation result.
  • the taint propagation module 420 may include: a control flow graph acquisition unit and a propagation execution unit. Wherein, the control flow graph acquisition unit is used for; the propagation execution unit is used for using the control flow graph and based on the first stain propagation function in the designated stain analysis tool, the first stain mark function in the designated stain analysis tool, The pre-added second stain propagation function and the pre-added second stain marking function perform stain propagation.
  • the propagation execution unit may be specifically configured to: mark the data generated by the specified taint source as taint data, use the path corresponding to the specified taint source in the control flow graph, and use the specified taint analysis tool
  • the propagation execution unit may include: a first execution sub-unit, a second execution sub-unit, and a third execution sub-unit.
  • the first execution subunit is configured to use the path corresponding to the designated stain source in the control flow graph to propagate the stain data
  • the second execution subunit is configured to propagate the stain data to the first stain marking function Or when the second taint marking function, mark the first parameter object of the currently called function as tainted data, and continue to spread the tainted data
  • the third execution sub-unit is used to spread to the first tainted When the function or the second taint propagation function is used, the return value of the currently called function is marked as tainted data, and the propagation is continued.
  • the propagation execution unit may also be used to: before the marking the data generated by the specified taint source as tainted data, assign a value to the function corresponding to the specified taint source to obtain the specified taint source.
  • the data may also be used to: before the marking the data generated by the specified taint source as tainted data, assign a value to the function corresponding to the specified taint source to obtain the specified taint source.
  • the propagation execution unit may also be used to: before the marking the data generated by the specified taint source as tainted data, call the function corresponding to the specified taint source to obtain the data generated by the specified taint source. data.
  • the taint propagation module 420 may further include: a propagation termination unit.
  • the propagation termination unit is configured to obtain a stain propagation result corresponding to each specified stain source after stain propagation is performed on all specified stain sources existing in the component of the target application.
  • control flow graph obtaining unit may be specifically configured to obtain the control flow graph corresponding to the target application through the designated stain analysis tool and according to the installation package file of the target application.
  • control flow graph obtaining unit may include: a first obtaining subunit, a second obtaining subunit, and a third obtaining subunit.
  • the first obtaining subunit is used to obtain the decompiled file corresponding to the installation package file of the target application through the designated taint analysis tool;
  • the second obtaining subunit is used to obtain the target according to the decompiled file The life cycle of the application and the list of callback functions;
  • the third acquiring subunit is used to generate the control flow graph according to the life cycle and the list of callback functions.
  • the function scanning module 410 may include: a decompiled file obtaining unit, a component file obtaining unit, and a component file analyzing unit.
  • the decompiled file obtaining unit is used to obtain the decompiled file corresponding to the installation package file of the target application through the designated taint analysis tool;
  • the component file obtaining unit is used to obtain the target application according to the decompiled file The component file of the component file;
  • the component file parsing unit is used to parse the component file to obtain the designated taint source and the designated taint convergence point corresponding to the target application.
  • the device 400 for detecting file leakage vulnerabilities may further include: a first function acquisition module.
  • the first function acquisition module is used to extract the taint source function in all functions corresponding to the application as the designated taint before the specified taint source and the specified taint convergence point in the components of the scan target application, according to the application’s private file leak vulnerability model Source, and extract the function corresponding to the stain convergence point in all the functions corresponding to the application as the designated stain convergence point.
  • the device 400 for detecting file leakage vulnerabilities may further include: a second function acquisition module.
  • the second function acquisition module is used to extract all functions corresponding to the application before the specified taint source and the specified taint convergence point in the components of the target application, according to the application’s private file leakage vulnerability model, except for the first taint
  • the stain marking function other than the marking function is used as the second stain marking function
  • the stain propagation function other than the first stain propagation function among all functions corresponding to the application is extracted and used as the second stain propagation function.
  • the vulnerability determination module 430 may include: a first determination unit and a second determination unit.
  • the first determining unit is configured to determine, based on the result of the taint propagation, that there is a propagation path from any one of the designated taint sources to any one of the designated taint convergence points, to determine that the target application has a leak of a private file; a second determination The unit is used for determining that the target application does not have a leak of private files if there is no propagation path from the designated taint source to the designated taint convergence point.
  • the first determining unit may be specifically configured to: if there is a propagation path from any one of the designated taint sources to any one of the designated taint convergence points, determine whether the propagation path is in a preset whitelist; if If it is not in the preset whitelist, it is determined that the target application has a vulnerability of private file leakage.
  • the vulnerability determination module 430 may further include: a third determination unit.
  • the third determining unit may be configured to: if it is in the preset whitelist, determine that the target application does not have a leak of private files.
  • the device 400 for detecting file leakage vulnerabilities may further include: a result output module.
  • the result output module is used to output prompt information and the propagation path when it is determined that the target application has a vulnerability of private file leakage, and the prompt information is used to prompt that the target application has a vulnerability of private file leakage.
  • the designated stain analysis tool includes the FlowDroid stain analysis tool.
  • the coupling between the modules may be electrical, mechanical or other forms of coupling.
  • the functional modules in the various embodiments of the present application may be integrated into one processing module, or each module may exist alone physically, or two or more modules may be integrated into one module.
  • the above-mentioned integrated modules can be implemented in the form of hardware or software functional modules.
  • the solution provided by this application scans the specified taint source and the specified taint convergence point in the components of the target application.
  • the specified taint source and the specified taint convergence point are set according to the application’s private file leakage vulnerability.
  • the first stain propagation function in the specified stain analysis tool the first stain mark function in the specified stain analysis tool, the pre-added second stain propagation function, and the pre-added
  • the second taint marking function carries out taint propagation.
  • the electronic device 100 may be an electronic device capable of running application programs, such as a smart phone, a tablet computer, or a test device.
  • the electronic device 100 in this application may include one or more of the following components: a processor 110, a memory 120, and one or more application programs, where one or more application programs may be stored in the memory 120 and configured to be composed of one Or multiple processors 110 execute, and one or more programs are configured to execute the method described in the foregoing method embodiment.
  • the processor 110 may include one or more processing cores.
  • the processor 110 uses various interfaces and lines to connect various parts of the entire electronic device 100, and executes by running or executing instructions, programs, code sets, or instruction sets stored in the memory 120, and calling data stored in the memory 120.
  • Various functions and processing data of the electronic device 100 may adopt at least one of Digital Signal Processing (DSP), Field-Programmable Gate Array (FPGA), and Programmable Logic Array (PLA).
  • DSP Digital Signal Processing
  • FPGA Field-Programmable Gate Array
  • PDA Programmable Logic Array
  • the processor 110 may be integrated with one or a combination of a central processing unit (CPU), a graphics processing unit (GPU), a modem, and the like.
  • the CPU mainly processes the operating system, user interface, and application programs; the GPU is used for rendering and drawing of display content; the modem is used for processing wireless communication. It can be understood that the above-mentioned modem may not be integrated into the processor 110, but may be implemented by a communication chip alone.
  • the memory 120 may include random access memory (RAM) or read-only memory (Read-Only Memory).
  • the memory 120 may be used to store instructions, programs, codes, code sets or instruction sets.
  • the memory 120 may include a program storage area and a data storage area, where the program storage area may store instructions for implementing the operating system and instructions for implementing at least one function (such as touch function, sound playback function, image playback function, etc.) , Instructions used to implement the following various method embodiments, etc.
  • the storage data area can also store data (such as phone book, audio and video data, chat record data) created by the electronic device 100 during use.
  • FIG. 6 shows a structural block diagram of a computer-readable storage medium provided by an embodiment of the present application.
  • the computer-readable medium 800 stores program code, and the program code can be invoked by a processor to execute the method described in the foregoing method embodiment.
  • the computer-readable storage medium 800 may be an electronic memory such as flash memory, EEPROM (Electrically Erasable Programmable Read Only Memory), EPROM, hard disk, or ROM.
  • the computer-readable storage medium 800 includes a non-transitory computer-readable storage medium.
  • the computer-readable storage medium 800 has storage space for the program code 810 for executing any method steps in the above-mentioned methods. These program codes can be read from or written into one or more computer program products.
  • the program code 810 may be compressed in a suitable form, for example.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Software Systems (AREA)
  • Computer Hardware Design (AREA)
  • General Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Virology (AREA)
  • Health & Medical Sciences (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • General Health & Medical Sciences (AREA)
  • Stored Programmes (AREA)
  • Debugging And Monitoring (AREA)

Abstract

一种文件泄露漏洞的检测方法、装置、电子设备及存储介质，该文件泄露漏洞的检测方法包括：扫描目标应用的组件中的指定污点源以及指定污点汇聚点，所述指定污点源以及指定污点汇聚点根据应用的私有文件泄露漏洞设定（S110）；在所述组件中存在污点源以及污点汇聚点时，根据指定污点分析工具中的第一污点传播函数、所述指定污点分析工具中的第一污点标记函数、预先添加的第二污点传播函数以及预先添加的第二污点标记函数，进行污点传播（S120）；根据污点传播结果，确定所述目标应用是否存在私有文件泄露的漏洞（S130）。本方法可以实现准确的检测应用的私有文件的泄露漏洞，保护用户的隐私安全。

Description

文件泄露漏洞的检测方法、装置、电子设备及存储介质 技术领域
本申请涉及信息技术领域，更具体地，涉及一种文件泄露漏洞的检测方法、装置、电子设备及存储介质。
背景技术
随着科技水平和生活水平的快速发展，电子设备(例如智能手机、平板电脑等)已经在生活中普及。并且随着人们的需求也越来越高，电子设备上安装的应用也越来越多，但随着应用的增多，应用的私有文件的安全性问题也越来越需要被重视。
发明内容
鉴于上述问题，本申请提出了一种文件泄露漏洞的检测方法、装置、电子设备及存储介质。
第一方面，本申请实施例提供了一种文件泄露漏洞的检测方法，所述方法包括：扫描目标应用的组件中的指定污点源以及指定污点汇聚点，所述指定污点源以及指定污点汇聚点根据应用的私有文件泄露漏洞设定；在所述组件中存在污点源以及污点汇聚点时，根据指定污点分析工具中的第一污点传播函数、所述指定污点分析工具中的第一污点标记函数、预先添加的第二污点传播函数以及预先添加的第二污点标记函数，进行污点传播；根据污点传播结果，确定所述目标应用是否存在私有文件泄露的漏洞。
第二方面，本申请实施例提供了一种文件泄露漏洞的检测装置，所述装置包括：函数扫描模块、污点传播模块以及漏洞确定模块，其中，所述函数扫描模块用于扫描目标应用的组件中的指定污点源以及指定污点汇聚点，所述指定污点源以及指定污点汇聚点根据应用的私有文件泄露漏洞设定；所述污点传播模块用于在所述组件中存在污点源以及污点汇聚点时，根据指定污点分析工具中的第一污点传播函数、所述指定污点分析工具中的第一污点标记函数、预先添加的第二污点传播函数以及预先添加的第二污点标记函数，进行污点传播；所述漏洞确定模块用于根据污点传播结果，确定所述目标应用是否存在私有文件泄露的漏洞。
第三方面，本申请实施例提供了一种电子设备，包括：一个或多个处理器；存储器；一个或多个应用程序，其中所述一个或多个应用程序被存储在所述存储器中并被配置为由所述一个或多个处理器执行，所述一个或多个程序配置用于执行上述第一方 面提供的文件泄露漏洞的检测方法。
第四方面，本申请实施例提供了一种计算机可读取存储介质，所述计算机可读取存储介质中存储有程序代码，所述程序代码可被处理器调用执行上述第一方面提供的文件泄露漏洞的检测方法。
本申请提供的方案，通过扫描目标应用的组件中的指定污点源以及指定污点汇聚点，该指定污点源以及指定污点汇聚点根据应用的私有文件泄露漏洞设定，在该目标应用的组件中存在污点源以及污点汇聚点时，根据指定污点分析工具中的第一污点传播函数、指定污点分析工具中的第一污点标记函数、预先添加的第二污点传播函数以及预先添加的第二污点标记函数，进行污点传播，最后根据污点传播结果，确定目标应用是否存在私有文件泄露的漏洞，从而可以实现对应用的私有文件的泄露漏洞的检测，以便及时的修复漏洞，保证应用的安全性，进而保护用户的隐私安全。
附图说明
为了更清楚地说明本申请实施例中的技术方案，下面将对实施例描述中所需要使用的附图作简单地介绍，显而易见地，下面描述中的附图仅仅是本申请的一些实施例，对于本领域技术人员来讲，在不付出创造性劳动的前提下，还可以根据这些附图获得其他的附图。
图1示出了根据本申请一个实施例的文件泄露漏洞的检测方法流程图。
图2示出了根据本申请另一个实施例的文件泄露漏洞的检测方法流程图。
图3示出了根据本申请又一个实施例的文件泄露漏洞的检测方法流程图。
图4示出了根据本申请一个实施例的文件泄露漏洞的检测装置的一种框图。
图5是本申请实施例的用于执行根据本申请实施例的文件泄露漏洞的检测方法的电子设备的框图。
图6是本申请实施例的用于保存或者携带实现根据本申请实施例的文件泄露漏洞的检测方法的程序代码的存储单元。
具体实施方式
为了使本技术领域的人员更好地理解本申请方案，下面将结合本申请实施例中的附图，对本申请实施例中的技术方案进行清楚、完整地描述。
目前的电子设备通常安装有各种各样的应用，应用的私有文件存放在***私有目录下，通常存放着用户或应用的一些敏感数据，比如用户登录凭证、聊天记录等。正常情况下只有应用本身可以访问私有文件，如果应用的私有文件可以被其他应用通过某种方法读取，则说明该应用存在私有文件泄露漏洞，可能导致用户或应用的敏感信 息被窃取。
对于安卓(Android)***而言，传统的对应用的安全性方面的检测，通常存在动态分析和静态分析两种方式。其中，静态分析会通过反编译应用程序安装包(APK，Android application package)文件，分析其中的权限、组件、敏感函数等信息，这些可以弥补动态分析中因未触发恶意行为而漏掉的行为。动态分析主要通过在模拟器运行Android软件，然后再对软件进行一些操作以触发尽可能多的恶意行为，接着输出到log中，再通过脚本对日志进行分析。另外，随着测试技术的发展，还衍生出了污点传播分析技术，污点传播分析是当前污点分析领域的研究重点，与应用程序的分析技术相结合,可以获得更加高效、精确的污点分析结果，进而实现漏洞的检测。根据分析过程中是否需要运行程序,可以将污点传播分析分为静态污点分析和动态污点分析。
发明人经过长期研究发现，在传统的应用的漏洞检测的技术中，通常仅是对组件的intent通信造成的隐私泄露漏洞、本地跨域漏洞检测等，而未对应用的私有文件的泄露漏洞进行有效地检测。
针对上述问题，发明人提出了本申请实施例提供的文件泄露漏洞的检测方法、装置、电子设备以及存储介质，通过扫描应用的组件中的根据应用的私有文件泄露漏洞设定的污点源和污点汇聚点，再在污点分析工具已有的污点传播函数和污点标记函数的基础上，还根据额外添加的污点传播函数和污点标记函数，进行污点传播，最后根据污点传播结果确定是否存在应用的私有文件泄露的漏洞，进而可以有效地实现对应用的私有文件的泄露漏洞检测，提升应用的安全性测试的效率，以及提升应用的安全性。其中，具体的文件泄露漏洞的检测方法在后续的实施例中进行详细的说明。
请参阅图1，图1示出了本申请一个实施例提供的文件泄露漏洞的检测方法的流程示意图。在具体的实施例中，所述文件泄露漏洞的检测方法应用于如图4所示的文件泄露漏洞的检测装置400以及配置有所述文件泄露漏洞的检测装置400的电子设备100(图5)。下面将以电子设备为例，电子设备中可以安装有安卓操作***，说明本实施例的具体流程，当然，可以理解的，本实施例所应用的电子设备可以为智能手机、平板电脑、测试设备等，在此不做限定。下面将针对图1所示的流程进行详细的阐述，所述文件泄露漏洞的检测方法具体可以包括以下步骤：
步骤S110：扫描目标应用的组件中的指定污点源以及指定污点汇聚点，所述指定污点源以及指定污点汇聚点根据应用的私有文件泄露漏洞设定。
在本申请实施例中，在需要对目标应用的私有文件的泄露漏洞进行检测时，电子设备可以扫描目标应用的组件中的指定污点源以及指定污点汇聚点。其中，电子设备 可以为用于在应用出厂前对应用进行测试的设备，也可以为应用出厂后应用所安装于用户的移动终端，也就是说，对应用的私有文件的泄露漏洞的检测，可以是应用出厂前进行检测，也可以是用户安装应用后对应用的私有文件的泄露漏洞进行检测。Source即污点源，表示直接引入不受信任的数据或者机密数据到***中；sink即污点汇聚点,表示直接产生安全敏感操作(违反数据完整性)或者泄露隐私数据到外界(违反数据保密性)。
在一些实施方式中，电子设备可以获取待进行私有文件的泄露漏洞的目标应用的安装包文件，即APK文件。电子设备根据目标应用的安装包文件，可以提取manifest、dex、资源文件等信息，然后根据提取到的这些文件信息进行解析，并且确定组件中是否包含设定的指定污点源以及指定污点汇聚点，从而完成对目标应用的组件中的指定污点源和指定污点汇聚点的扫描。其中，组件可以包括activity(活动)、service(服务)、content provider(内容提供者)、broadcast receive(广播接收)等，可以理解的，activity、service、content provider、broadcast receive等组件为本地暴露的组件，由于为暴露的组件，因此可能导致私有文件的泄露。通过确定这些组件中的污点源和污点汇聚点，可以避免对所有组件进行扫描，进而可以减少漏洞检测的时间，提升应用测试的效率。
在本申请实施例中，以上指定污点源以及指定污点汇聚点为根据应用的私有文件泄露漏洞预先设定。作为一种实施方式，指定污点源以及指定污点汇聚点可以根据私有文件泄露漏洞模型，该模型可以为私有文件泄露漏洞预先建立的模型，该模型可以包括已有的私有文件泄露漏洞以及漏洞对应的污点源和污点汇聚点，通过该模型，可以提取出所有与私有文件泄露漏洞相关的污点源和污点汇聚点，这些提取到的污点源和污点汇聚点可以作为指定污点源和指定污点汇聚点预先存储。作为另一种实施方式，指定污点源以及指定污点汇聚点也可以为测试人员对私有文件泄露漏洞进行分析后，预先设置的污点源和污点汇聚点。
示例性地，指定污点源可以包括：<android.app.Activity:android.content.Intent getIntent()>函数、<android.app.Activity:void onNewIntent(android.content.Intent)>函数、<android.app.IntentService:void onHandleIntent(android.content.Intent)>函数；
指定污点汇聚点可以包括：<java.io.OutputStream:void write(byte[],int,int)>函数，<java.io.OutputStream:void write(byte[])>函数，<java.io.OutputStream:void write(int)>函数，<java.io.Writer:void write(java.lang.String)>函数，<java.io.Writer:void write(java.lang.String,int,int)>函数，<java.io.Writer:void write(char[],int,int)>函数， <java.io.Writer:void write(char[])>函数，<java.io.Writer:void write(int)>函数。
当然，以上与私有文件泄露漏洞相关的指定污点源以及指定污点汇聚点仅为示例，并不代表对具体的指定污点源以及指定污点汇聚点的限定。
步骤S120：在所述组件中存在污点源以及污点汇聚点时，根据指定污点分析工具中的第一污点传播函数、所述指定污点分析工具中的第一污点标记函数、预先添加的第二污点传播函数以及预先添加的第二污点标记函数，进行污点传播。
在本申请实施例中，电子设备在对目标应用的组件中的指定污点源以及指定污点汇聚点进行扫描之后，则可以确定目标应用的组件中是否存在指定污点源以及指定污点汇聚点。当目标应用的组件中存在指定污点源以及指定污点汇聚点时，表示该目标应用可能存在私有文件的泄露的风险，因此可以进一步地进行污点传播，以检测私有文件的泄露漏洞；当目标应用的组件中不存在指定污点源以及指定污点汇聚时，表示该目标应用不存在私有文件的泄露风险，因此可以结束本次对目标应用的私有文件的泄露漏洞的检测。
在一些实施方式中，电子设备在确定出目标应用的组件中存在污点源以及污点汇聚点时，可以根据指定污点分析工具中的第一污点传播函数以及第一污点标记函数，还根据预先添加的第二污点传播函数以及预先添加的第二污点标记函数，进行污点数据的传播。其中，污点传播函数用于污点数据传播到该函数时，将其输出的值标记为污点数据，从而使得污点数据能够继续传播；污点标记函数用于在污点数据传播至该函数时，将其参数对象标记为污点，从而继续进行污点传播。
在该实施方式中，通过在指定污点分析工具中的第一污点传播函数以及第一污点标记函数的基础上，额外添加了第二污点传播函数以及第二污点标记函数，使得在进行污点传播时，能够进行传播的路径更多，从而可以提升私有文件泄露的漏洞检测的准确性。
另外，第二污点传播函数以及第二污点标记函数可以为与私有文件泄露漏洞相关，也就是说，在进行污点传播分析时，除了指定污点分析工具中常规的传播函数和标记函数，还有与私有文件泄露漏洞相关的传播函数和标记函数，使污点传播能够与私有文件泄露漏洞的检测紧密相关，提升私有文件泄露的漏洞检测的准确性。
步骤S130：根据污点传播结果，确定所述目标应用是否存在私有文件泄露的漏洞。
在本申请实施例中，电子设备在进行污点传播后，则可以根据污点传播结果，进行传播结果的分析，以确定目标应用是否存在私有文件泄露的漏洞。
在一些实施方式中，电子设备根据污点传播结果，可以确定污点传播结果中是否 存在由指定污点源到指定污点汇聚点的传播路径，如果存在由指定污点源到指定污点汇聚点的传播路径，则可以确定目标应用存在私有文件泄露的漏洞；如果不存在由指定污点源到指定污点汇聚点的传播路径，则确定目标应用不存在私有文件泄露的漏洞。
本申请实施例提供的文件泄露漏洞的检测方法，通过扫描应用的组件中的根据应用的私有文件泄露漏洞设定的污点源和污点汇聚点，再在污点分析工具已有的污点传播函数和污点标记函数的基础上，还根据额外添加的污点传播函数和污点标记函数，进行污点传播，最后根据污点传播结果确定是否存在应用的私有文件泄露的漏洞，进而可以有效地实现对应用的私有文件的泄露漏洞检测，提升应用的安全性测试的效率，以及提升应用的安全性。
请参阅图2，图2示出了本申请另一个实施例提供的文件泄露漏洞的检测方法的流程示意图。该文件泄露漏洞的检测方法可应用于上述电子设备，下面将针对图2所示的流程进行详细的阐述，所述文件泄露漏洞的检测方法具体可以包括以下步骤：
步骤S210：通过所述指定污点分析工具，获取所述目标应用的安装包文件对应的反编译文件。
在本申请实施例中，可以利用指定污点分析工具实现本申请实施例提供的文件泄露漏洞的检测方法。其中，指定污点分析工具可以包括：FlowDroid污点分析工具。FlowDroid污点分析工具一个高精度的安卓的应用程序的污点分析工具，能够分析APK文件，扫描污点源和污点汇聚点，还可以生成控制流图，并且还可以进行污点传播分析。
在一些实施方式中，通过指定污点分析工具，可以获取目标应用的安装包文件对应的反编译文件。具体地，指定污点分析工具可以对目标应用的APK文件进行反编译，从而获得反编译后得到的反编译文件。其中，反编译是指通过对目标程序(比如可执行程序)进行逆向分析、研究，以推导出他人的软件产品所使用的思路、原理、结构、算法、处理过程、运行方法等设计要素，某些特定情况下可能推导出源代码。
步骤S220：根据所述反编译文件，获取所述目标应用的组件文件。
在本申请实施例中，在获得目标应用的APK文件对应的反编译文件之后，则可以根据反编译文件，可以获取目标应用的组件文件。组件文件可以包括目标应用的本地暴露的activity、service、content provider、broadcast receive等组件对应的组件文件。其中，由于activity、service、content provider、broadcast receive等组件为本地暴露的组件，由于为暴露的组件，因此可能导致私有文件的泄露。通过确定这些组件中的污点源和污点汇聚点，可以避免对所有组件进行扫描，进而可以减少漏洞检测的时间， 提升应用测试的效率。
步骤S230：解析所述组件文件，获得所述目标应用对应的指定污点源以及指定污点汇聚点。
在本申请实施例中，在根据目标应用的APK文件对应的反编译文件，获取到组件文件之后，则可以解析组件文件，从而获得到目标应用对应的指定污点源以及指定污点汇聚点。其中，指定污点分析工具可以实现对组件文件的解析，并且指定污点分析工具根据预先设置的指定污点源以及指定污点汇聚点，可以确定出组件文件中是否存在指定污点源以及指定污点汇聚点，并将其存在的指定污点源以及指定污点汇聚点进行输出。
在一些实施方式中，指定污点分析工具在解析反编译文件中的组件文件时，还可以解析得到目标应用对应的入口节点等。
步骤S240：获取所述目标应用对应的控制流图。
在本申请实施例中，在进行污点传播分析时，可以通过指定污点分析工具获取目标应用对应的控制流图。其中，安卓应用包含多个入口节点，它的方法隐含的被安卓框架调用，安卓操作***对应用中每个组件定义了完整的生命周期，这些组件可以包括activity(活动)、service(服务)、content provider(内容提供者)、broadcast receive(广播接收)，这组件都需要在应用配置文件AndroidManifest.xml中进行配置，在构建控制流图时，指定污点分析工具不能通过检测预定义的主方法函数开始，并且安卓应用中每个组件都有函数来反映该组件的生命周期，因此，指定污点分析工具可以构建一个虚拟的主方法函数dummyMainMethod()方法来模拟生命周期。
在一些实施方式中，通过指定污点分析工具，根据目标应用的安装包文件，获取目标应用的控制流图可以包括：根据所述反编译文件，获取所述目标应用的生命周期以及回调函数列表；根据所述生命周期以及回调函数列表，生成所述控制流图。在该实施方式中，指定污点分析工具可以直接利用步骤S210中获得的反编译文件，根据反编译文件，分析AndroidMainfest.xml文件、classes.dex文件和layout中的布局文件，通过解析这些文件获得生命周期和回调函数列表。然后，指定污点分析工具通过生命周期和回调函数列表产生虚拟的主方法函数dummyMainMethod()，指定污点分析工具中的Dexpler插件可以将APK文件中的.dex文件转为soot框架的Jimple中间表示，被用来产生目标应用的控制流图。
步骤S250：利用所述控制流图，并根据指定污点分析工具中的第一污点传播函数、所述指定污点分析工具中的第一污点标记函数、预先添加的第二污点传播函数以及预 先添加的第二污点标记函数，进行污点传播。
在本申请实施例中，在获得控制流图之后，则可以利用控制流图，并根据指定污点分析工具中的第一污点传播函数以及第一污点标记函数，还根据预先添加的第二污点传播函数以及预先添加的第二污点标记函数，进行污点数据的传播。可以理解的，控制流图中可以包括多个路径，根据这些路径，以及规定的污点传播函数和污点标记函数，即以上第一污点标记函数、第二污点标记函数、第一污点传播函数以及第二污点传播函数，可以进行污点数据的传播。
在一些实施方式中，在通过指定污点分析工具进行污点传播时，可以将指定污点源产生的数据标记为污点数据，然后利用控制流图中指定污点源对应的路径，并根据以上第一污点传播函数、第一污点标记函数、预先添加的第二污点传播函数以及预先添加的第二污点标记函数，对污点数据进行传播。其中，为了确定是否有能够从指定污点源传播至指定污点汇聚点的传播路径，可以在进行污点传播时，从指定污点源，并根据其对应的路径进行传播，而不必在其他位置进行传播，从而可以节省污点传播过程的时间，进而提升私有文件泄露漏洞的检测效率。可以理解的，控制流图中，如果从指定污点源有到其他位置的路径，则可以按照该路径进行传播，在传播过程中，根据污点标记函数后以及污点传播函数的作用，在遇到污点标记函数后以及污点传播函数时可以在路径上继续传播，而在路径上未遇到污点标记函数后以及污点传播函数时，则结束传播。
具体地，在通过指定污点分析工具进行污点传播时，利用控制流图中指定污点源对应的路径，对污点数据进行传播；如果传播至第一污点标记函数或第二污点标记函数时，将当前调用的函数的第一个参数对象标记为污点数据，并继续进行污点数据的传播；如果传播至第一污点传播函数或第二污点传播函数时，将当前调用的函数的返回值标记为污点数据，并继续进行传播。可以理解的，污点传播函数用于污点数据传播到该函数时，将其输出的值标记为污点数据，从而使得污点数据能够继续传播；污点标记函数用于在污点数据传播至该函数时，将其参数对象标记为污点，从而继续进行污点传播。从而在对各个指定污点源进行污点传播时，根据其对应的控制流图上的路径，在遇到污点标记函数后以及污点传播函数时可以在路径上继续传播，而在路径上未遇到污点标记函数后以及污点传播函数时，则结束对该指定污点源的污点传播。
在一些实施方式中，为了使污点源产生数据，以进行污点数据的传播。可以通过对指定污点源对应的函数进行赋值，获得指定污点源产生的数据，可以理解的，对污点源对应的函数进行赋值，可以使污点源对应的函数产生数据，从而可以将污点源产 生的数据标记为污点数据，以进行污点数据的传播。在另一些实施方式中，也可以调用指定污点源对应的函数，获得所述指定污点源产生的数据，从而可以将污点源产生的数据标记为污点数据，以进行污点数据的传播。
在一些实施方式中，在对目标应用的组件中存在的所有指定污点源进行污点传播后，即对存在的每个指定污点源，按照以上方式进行污点传播后，可以获得每个指定污点源对应的污点传播结果，获得的污点传播结果即为整个污点传播过程的传播结果。
步骤S260：根据污点传播结果，确定所述目标应用是否存在私有文件泄露的漏洞。
在本申请实施例中，电子设备根据污点传播结果，可以确定污点传播结果中是否存在由指定污点源到指定污点汇聚点的传播路径，如果存在由指定污点源到指定污点汇聚点的传播路径，则可以确定目标应用存在私有文件泄露的漏洞；如果不存在由指定污点源到指定污点汇聚点的传播路径，则确定目标应用不存在私有文件泄露的漏洞。
在一些实施方式中，在利用指定污点分析工具实现以上步骤时，可以将指定污点源、指定污点汇聚点、第二污点传播函数以及第二污点标记函数，在污点分析工具对应的代码中进行配置，从而指定污点分析工具可以用于实现以上步骤。
本申请实施例提供的文件泄露漏洞的检测方法，通过指定污点分析工具获取反编译文件，然后根据反编译文件确定目标应用的组件中的根据应用的私有文件泄露漏洞设定的污点源和污点汇聚点，以及生成控制流图，再利用该控制流图，在污点分析工具已有的污点传播函数和污点标记函数的基础上，还根据额外添加的污点传播函数和污点标记函数，进行污点传播，最后根据污点传播结果确定是否存在应用的私有文件泄露的漏洞。从而可以实现通过污点分析工具即可实现对应用的私有文件的泄露漏洞检测，方便快捷，另外也可以提升应用的安全性测试的效率，以及提升应用的安全性。
请参阅图3，图3示出了本申请又一个实施例提供的文件泄露漏洞的检测方法的流程示意图。该文件泄露漏洞的检测方法可应用于上述电子设备，下面将针对图3所示的流程进行详细的阐述，所述文件泄露漏洞的检测方法具体可以包括以下步骤：
步骤S310：根据应用的私有文件泄露漏洞模型，提取应用对应的所有函数中的污点源函数作为指定污点源，以及提取应用对应的所有函数中的污点汇聚点对应的函数作为指定污点汇聚点。
在本申请实施例中，指定污点源以及指定污点汇聚点可以根据私有文件泄露漏洞模型，该模型可以为私有文件泄露漏洞预先建立的模型，该模型可以包括已有的私有文件泄露漏洞以及漏洞对应的污点源和污点汇聚点。通过该模型，可以提取出所有与私有文件泄露漏洞相关的污点源和污点汇聚点，这些提取到的污点源和污点汇聚点可 以作为指定污点源和指定污点汇聚点预先存储。在一种可能的实施方式中，该私有文件泄露漏洞模型可以为能够输出不同类型的漏洞所对应的污点源和污点汇聚点的模型，可以利用大量的漏洞样本以及对漏洞样本标注的污点源和污点汇聚点训练获得，通过将私有文件泄露漏洞的漏洞样本输入至该模型后，即可获得指定污点源和指定污点汇聚点。由于指定污点源和指定污点汇聚点与私有文件泄露漏洞相关，因此，可以实现用于检测私有文件泄露漏洞时的污点传播分析。
步骤S320：根据应用的私有文件泄露漏洞模型，提取应用对应的所有函数中除所述第一污点标记函数以外的污点标记函数，并作为第二污点标记函数，以及提取应用对应的所有函数中除所述第一污点传播函数以外的污点传播函数，并作为第二污点传播函数。
在本申请实施例中，第二污点传播函数以及第二污点标记函数，也可以是根据以上私有文件泄露漏洞模型提取获得。该模型可以包括已有的私有文件泄露漏洞对应的传播路径上的传播函数和标记函数，通过在这些函数中获取除指定污点分析工具中已有的函数，即可得到第二污点传播函数和第二污点标记函数。在获得第二污点传播函数以及第二污点标记函数之后，可以将其进行设置，例如设置于指定污点分析工具中，从而可以实现后续污点传播时，除了根据指定污点分析工具中的第一污点传播函数以及第一污点标记函数，还根据预先添加的第二污点传播函数以及预先添加的第二污点标记函数，进行污点数据的传播，使得在进行污点传播时，能够进行传播的路径更多，从而可以提升私有文件泄露的漏洞检测的准确性。
示例性地，第二污点传播函数包括：
<android.content.ContentResolver:android.os.ParcelFileDescriptor openFileDescriptor(android.net.Uri,java.lang.String)>函数；
<android.os.ParcelFileDescriptor:java.io.FileDescriptor getFileDescriptor()>函数；
<java.io.FileInputStream:void<init>(java.io.FileDescriptor)>函数；
<java.io.BufferedInputStream:void<init>(java.io.InputStream)>函数；
<java.io.InputStreamReader:void<init>(java.io.InputStream)>函数；
<java.io.InputStreamReader:void<init>(java.io.InputStream,java.nio.charset.Charset)>函数；
<java.io.BufferedReader:void<init>(java.io.Reader)>函数；
<java.io.BufferedReader:String readLine()>函数；
第二污点标记函数包括：
<java.io.InputStream:int read(byte[],int,int)>函数；
<java.io.InputStream:int read(byte[])>函数；
<java.io.Reader:int read(char[],int,int)>函数；
<java.io.Reader:int read(char[])>函数；
当然以上第二污点传播函数以及第二污点标记函数仅为举例，并不代表对具体地第二污点传播函数以及第二污点标记函数的限定。
步骤S330：扫描目标应用的组件中的指定污点源以及指定污点汇聚点，所述指定污点源以及指定污点汇聚点根据应用的私有文件泄露漏洞设定。
步骤S340：在所述组件中存在污点源以及污点汇聚点时，根据指定污点分析工具中的第一污点传播函数、所述指定污点分析工具中的第一污点标记函数、预先添加的第二污点传播函数以及预先添加的第二污点标记函数，进行污点传播。
在本申请实施例中，步骤S330以及步骤S340可以参阅前述实施例的内容，在此不再赘述。
步骤S350：根据污点传播结果，如果存在任一所述指定污点源至任一所述指定污点汇聚点的传播路径，则确定所述目标应用存在私用文件泄露的漏洞。
在本申请实施例中，在获得污点传播结果后，可以确定是否存在任一指定污点源至任一所述指定污点汇聚点的传播路径。具体地，可以根据每个污点源进行污点数据的传播的结果，确定是否有任意一个指定污点源的污点数据能够传输至任意一个指定污点汇聚点，如果有任意一个指定污点源的污点数据能够传输至任意一个指定污点汇聚点，则表示存在任一指定污点源至任一所述指定污点汇聚点的传播路径；如果没有任意一个指定污点源的污点数据能够传输至任意一个指定污点汇聚点，则表示不存在任一指定污点源至任一所述指定污点汇聚点的传播路径。
进一步地，当存在任一指定污点源至任一指定污点汇聚点的传播路径时，则可以确定该目标应用存在私有文件泄露的漏洞；当不存在任一指定污点源至任一指定污点汇聚点的传播路径时，则可以确定该目标应用不存在私有文件泄露的漏洞。
在一些实施方式中，考虑到一些特殊的传播路径可能是正常的功能导致，例如，关联的应用在进行账号互通的登录时，需要获取另一应用的账号数据，从而实现应用中账号的登录，因此还可以设置预设白名单，将这些传播路径添加于预设白名单中，如果存在任一指定污点源至任一指定污点汇聚点的传播路径时，可以判断该传播路径是否处于预设白名单；如果该传播路径不处于预设白名单，表示该传播路径并不是正常功能对应的传播路径，因此可以确定该目标应用存在私用文件泄露的漏洞；如果处 于预设白名单，表示该传播路径是正常功能对应的传播路径，因此可以确定该目标应用不存在私用文件泄露的漏洞。
步骤S360：根据污点传播结果，如果不存在所述指定污点源至所述指定污点汇聚点的传播路径，则确定所述目标应用不存在私用文件泄露的漏洞。
在一些实施方式中，当确定目标应用存在私用文件泄露的漏洞时，输出提示信息以及对应的传播路径，提示信息用于提示目标应用存在私用文件泄露的漏洞。可以理解的，当目标应用存在私有文件泄露的漏洞时，表示该应用存在安全性问题，因此可以提示用户，并输出该漏洞对应的污点数据的传播路径，以便后续对目标应用进行改善，进而解决目标应用的私有文件泄露的漏洞问题，提升该目标应用的安全性。其中，提升信息输出的形式可以不作为限定，例如可以为弹框提示等。
当然，电子设备也还可以检测结果以检测报告的形式输出，使用户可以直观地看到该目标应用的私有文件的泄露漏洞的检测结果。
本申请实施例提供的文件泄露漏洞的检测方法，还公开了对指定污点源和指定污点汇聚点，以及第二污点传播函数以及第二污点标记函数的获取，并且由于指定污点源、指定污点汇聚点、第二污点传播函数以及第二污点标记函数与私有文件的泄露漏洞有关，从而进行污点传播分析可以实现对应用的私有文件的泄露漏洞检测，提升应用的安全性测试的效率，以及提升应用的安全性。
请参阅图4，其示出了本申请实施例提供的一种文件泄露漏洞的检测装置400的结构框图。该文件泄露漏洞的检测装置400应用上述的电子设备，该文件泄露漏洞的检测装置400包括：函数扫描模块410、污点传播模块420以及漏洞确定模块430。其中，所述函数扫描模块410用于扫描目标应用的组件中的指定污点源以及指定污点汇聚点，所述指定污点源以及指定污点汇聚点根据应用的私有文件泄露漏洞设定；所述污点传播模块420用于在所述组件中存在污点源以及污点汇聚点时，根据指定污点分析工具中的第一污点传播函数、所述指定污点分析工具中的第一污点标记函数、预先添加的第二污点传播函数以及预先添加的第二污点标记函数，进行污点传播；所述漏洞确定模块430用于根据污点传播结果，确定所述目标应用是否存在私有文件泄露的漏洞。
在一些实施方式中，污点传播模块420可以包括：控制流图获取单元以及传播执行单元。其中，控制流图获取单元用于；传播执行单元应用于利用所述控制流图，并根据指定污点分析工具中的第一污点传播函数、所述指定污点分析工具中的第一污点标记函数、预先添加的第二污点传播函数以及预先添加的第二污点标记函数，进行污点传播。
在该实施方式中，传播执行单元可以具体用于：将所述指定污点源产生的数据标记为污点数据，利用所述控制流图中所述指定污点源对应的路径，并根据指定污点分析工具中的第一污点传播函数、所述指定污点分析工具中的第一污点标记函数、预先添加的第二污点传播函数以及预先添加的第二污点标记函数，对所述污点数据进行传播。
进一步地，传播执行单元可以包括：第一执行子单元、第二执行子单元以及第三执行子单元。其中，第一执行子单元用于利用所述控制流图中所述指定污点源对应的路径，对所述污点数据进行传播；第二执行子单元用于如果传播至所述第一污点标记函数或所述第二污点标记函数时，将当前调用的函数的第一个参数对象标记为污点数据，并继续进行污点数据的传播；第三执行子单元用于如果传播至所述第一污点传播函数或所述第二污点传播函数时，将当前调用的函数的返回值标记为污点数据，并继续进行传播。
在一些方式中，传播执行单元还可以用于：在所述将所述指定污点源产生的数据标记为污点数据之前，对所述指定污点源对应的函数进行赋值，获得所述指定污点源产生的数据。
在另一些方式中，传播执行单元还可以用于：在所述将所述指定污点源产生的数据标记为污点数据之前，调用所述指定污点源对应的函数，获得所述指定污点源产生的数据。
在该实施方式中，污点传播模块420还可以包括：传播终止单元。传播终止单元用于在对所述目标应用的组件中存在的所有指定污点源进行污点传播后，获得每个指定污点源对应的污点传播结果。
在一些实施方式中，控制流图获取单元可以具体用于：通过所述指定污点分析工具，并根据所述目标应用的安装包文件，获取所述目标应用对应的控制流图。
在该实施方式中，控制流图获取单元可以包括：第一获取子单元、第二获取子单元以及第三获取子单元。其中，第一获取子单元用于通过所述指定污点分析工具，获取所述目标应用的安装包文件对应的反编译文件；第二获取子单元用于根据所述反编译文件，获取所述目标应用的生命周期以及回调函数列表；第三获取子单元用于根据所述生命周期以及回调函数列表，生成所述控制流图。
在一些实施方式中，函数扫描模块410可以包括：反编译文件获取单元、组件文件获取单元以及组件文件解析单元。其中，反编译文件获取单元用于通过所述指定污点分析工具，获取所述目标应用的安装包文件对应的反编译文件；组件文件获取单元 用于根据所述反编译文件，获取所述目标应用的组件文件；组件文件解析单元用于解析所述组件文件，获得所述目标应用对应的指定污点源以及指定污点汇聚点。
在一些实施方式中，该文件泄露漏洞的检测装置400还可以包括：第一函数获取模块。第一函数获取模块用于在所述扫描目标应用的组件中的指定污点源以及指定污点汇聚点之前，根据应用的私有文件泄露漏洞模型，提取应用对应的所有函数中的污点源函数作为指定污点源，以及提取应用对应的所有函数中的污点汇聚点对应的函数作为指定污点汇聚点。
在一些实施方式中，该文件泄露漏洞的检测装置400还可以包括：第二函数获取模块。第二函数获取模块用于，在所述扫描目标应用的组件中的指定污点源以及指定污点汇聚点之前，根据应用的私有文件泄露漏洞模型，提取应用对应的所有函数中除所述第一污点标记函数以外的污点标记函数，并作为第二污点标记函数，以及提取应用对应的所有函数中除所述第一污点传播函数以外的污点传播函数，并作为第二污点传播函数。
在一些实施方式中，漏洞确定模块430可以包括：第一确定单元以及第二确定单元。第一确定单元用于根据污点传播结果，如果存在任一所述指定污点源至任一所述指定污点汇聚点的传播路径，则确定所述目标应用存在私用文件泄露的漏洞；第二确定单元用于如果不存在所述指定污点源至所述指定污点汇聚点的传播路径，则确定所述目标应用不存在私用文件泄露的漏洞。
在该实施方式中，第一确定单元可以具体用于：如果存在任一所述指定污点源至任一所述指定污点汇聚点的传播路径，判断所述传播路径是否处于预设白名单；如果不处于预设白名单，则确定所述目标应用存在私用文件泄露的漏洞。
进一步地，漏洞确定模块430还可以包括：第三确定单元。第三确定单元可以用于：如果处于预设白名单，则确定所述目标应用不存在私用文件泄露的漏洞。
在一些实施方式中，该文件泄露漏洞的检测装置400还可以包括：结果输出模块。结果输出模块用于当确定所述目标应用存在私用文件泄露的漏洞时，输出提示信息以及所述传播路径，所述提示信息用于提示所述目标应用存在私用文件泄露的漏洞。
在一些实施方式中，所述指定污点分析工具包括FlowDroid污点分析工具。
所属领域的技术人员可以清楚地了解到，为描述的方便和简洁，上述描述装置和模块的具体工作过程，可以参考前述方法实施例中的对应过程，在此不再赘述。
在本申请所提供的几个实施例中，模块相互之间的耦合可以是电性，机械或其它形式的耦合。
另外，在本申请各个实施例中的各功能模块可以集成在一个处理模块中，也可以是各个模块单独物理存在，也可以两个或两个以上模块集成在一个模块中。上述集成的模块既可以采用硬件的形式实现，也可以采用软件功能模块的形式实现。
综上所述，本申请提供的方案，通过扫描目标应用的组件中的指定污点源以及指定污点汇聚点，该指定污点源以及指定污点汇聚点根据应用的私有文件泄露漏洞设定，在该目标应用的组件中存在污点源以及污点汇聚点时，根据指定污点分析工具中的第一污点传播函数、指定污点分析工具中的第一污点标记函数、预先添加的第二污点传播函数以及预先添加的第二污点标记函数，进行污点传播，最后根据污点传播结果，确定目标应用是否存在私有文件泄露的漏洞，从而可以实现对应用的私有文件的泄露漏洞的检测，以便及时的修复漏洞，保证应用的安全性，进而保护用户的隐私安全。
请参考图5，其示出了本申请实施例提供的一种电子设备的结构框图。该电子设备100可以是智能手机、平板电脑、测试设备等能够运行应用程序的电子设备。本申请中的电子设备100可以包括一个或多个如下部件：处理器110、存储器120以及一个或多个应用程序，其中一个或多个应用程序可以被存储在存储器120中并被配置为由一个或多个处理器110执行，一个或多个程序配置用于执行如前述方法实施例所描述的方法。
处理器110可以包括一个或者多个处理核。处理器110利用各种接口和线路连接整个电子设备100内的各个部分，通过运行或执行存储在存储器120内的指令、程序、代码集或指令集，以及调用存储在存储器120内的数据，执行电子设备100的各种功能和处理数据。可选地，处理器110可以采用数字信号处理(Digital Signal Processing，DSP)、现场可编程门阵列(Field－Programmable Gate Array，FPGA)、可编程逻辑阵列(Programmable Logic Array，PLA)中的至少一种硬件形式来实现。处理器110可集成中央处理器(Central Processing Unit，CPU)、图像处理器(Graphics Processing Unit，GPU)和调制解调器等中的一种或几种的组合。其中，CPU主要处理操作***、用户界面和应用程序等；GPU用于负责显示内容的渲染和绘制；调制解调器用于处理无线通信。可以理解的是，上述调制解调器也可以不集成到处理器110中，单独通过一块通信芯片进行实现。
存储器120可以包括随机存储器(Random Access Memory，RAM)，也可以包括只读存储器(Read-Only Memory)。存储器120可用于存储指令、程序、代码、代码集或指令集。存储器120可包括存储程序区和存储数据区，其中，存储程序区可存储用于实现操作***的指令、用于实现至少一个功能的指令(比如触控功能、声音播放 功能、图像播放功能等)、用于实现下述各个方法实施例的指令等。存储数据区还可以存储电子设备100在使用中所创建的数据(比如电话本、音视频数据、聊天记录数据)等。
请参考图6，其示出了本申请实施例提供的一种计算机可读存储介质的结构框图。该计算机可读介质800中存储有程序代码，所述程序代码可被处理器调用执行上述方法实施例中所描述的方法。
计算机可读存储介质800可以是诸如闪存、EEPROM(电可擦除可编程只读存储器)、EPROM、硬盘或者ROM之类的电子存储器。可选地，计算机可读存储介质800包括非易失性计算机可读介质(non-transitory computer-readable storage medium)。计算机可读存储介质800具有执行上述方法中的任何方法步骤的程序代码810的存储空间。这些程序代码可以从一个或者多个计算机程序产品中读出或者写入到这一个或者多个计算机程序产品中。程序代码810可以例如以适当形式进行压缩。
最后应说明的是：以上实施例仅用以说明本申请的技术方案，而非对其限制；尽管参照前述实施例对本申请进行了详细的说明，本领域的普通技术人员当理解：其依然可以对前述各实施例所记载的技术方案进行修改，或者对其中部分技术特征进行等同替换；而这些修改或者替换，并不驱使相应技术方案的本质脱离本申请各实施例技术方案的精神和范围。

Claims (20)

  1. 一种文件泄露漏洞的检测方法，其特征在于，所述方法包括：
    扫描目标应用的组件中的指定污点源以及指定污点汇聚点，所述指定污点源以及指定污点汇聚点根据应用的私有文件泄露漏洞设定；
    在所述组件中存在污点源以及污点汇聚点时，根据指定污点分析工具中的第一污点传播函数、所述指定污点分析工具中的第一污点标记函数、预先添加的第二污点传播函数以及预先添加的第二污点标记函数，进行污点传播；
    根据污点传播结果，确定所述目标应用是否存在私有文件泄露的漏洞。
  2. 根据权利要求1所述的方法，其特征在于，所述根据指定污点分析工具中的第一污点传播函数、所述指定污点分析工具中的第一污点标记函数、预先添加的第二污点传播函数以及预先添加的第二污点标记函数，进行污点传播，包括：
    获取所述目标应用对应的控制流图；
    利用所述控制流图，并根据指定污点分析工具中的第一污点传播函数、所述指定污点分析工具中的第一污点标记函数、预先添加的第二污点传播函数以及预先添加的第二污点标记函数，进行污点传播。
  3. 根据权利要求2所述的方法，其特征在于，所述利用所述控制流图，并根据指定污点分析工具中的第一污点传播函数、所述指定污点分析工具中的第一污点标记函数、预先添加的第二污点传播函数以及预先添加的第二污点标记函数，进行污点传播，包括：
    将所述指定污点源产生的数据标记为污点数据，利用所述控制流图中所述指定污点源对应的路径，并根据指定污点分析工具中的第一污点传播函数、所述指定污点分析工具中的第一污点标记函数、预先添加的第二污点传播函数以及预先添加的第二污点标记函数，对所述污点数据进行传播。
  4. 根据权利要求3所述的方法，其特征在于，所述利用所述控制流图中所述指定污点源对应的路径，并根据指定污点分析工具中的第一污点传播函数、所述指定污点分析工具中的第一污点标记函数、预先添加的第二污点传播函数以及预先添加的第二污点标记函数，对所述污点数据进行传播，包括：
    利用所述控制流图中所述指定污点源对应的路径，对所述污点数据进行传播；
    如果传播至所述第一污点标记函数或所述第二污点标记函数时，将当前调用的函 数的第一个参数对象标记为污点数据，并继续进行污点数据的传播；
    如果传播至所述第一污点传播函数或所述第二污点传播函数时，将当前调用的函数的返回值标记为污点数据，并继续进行传播。
  5. 根据权利要求3或4所述的方法，其特征在于，在所述将所述指定污点源产生的数据标记为污点数据之前，所述方法还包括：
    对所述指定污点源对应的函数进行赋值，获得所述指定污点源产生的数据。
  6. 根据权利要求3或4所述的方法，其特征在于，在所述将所述指定污点源产生的数据标记为污点数据之前，所述方法还包括：
    调用所述指定污点源对应的函数，获得所述指定污点源产生的数据。
  7. 根据权利要求4-6任一项所述的方法，其特征在于，所述利用所述控制流图中所述指定污点源对应的路径，并根据指定污点分析工具中的第一污点传播函数、所述指定污点分析工具中的第一污点标记函数、预先添加的第二污点传播函数以及预先添加的第二污点标记函数，对所述污点数据进行传播，还包括：
    在对所述目标应用的组件中存在的所有指定污点源进行污点传播后，获得每个指定污点源对应的污点传播结果。
  8. 根据权利要求2-7任一项所述的方法，其特征在于，所述获取所述目标应用对应的控制流图，包括：
    通过所述指定污点分析工具，并根据所述目标应用的安装包文件，获取所述目标应用对应的控制流图。
  9. 根据权利要求8所述的方法，其特征在于，所述通过所述指定污点分析工具，并根据所述目标应用的安装包文件，获取所述目标应用对应的控制流图，包括：
    通过所述指定污点分析工具，获取所述目标应用的安装包文件对应的反编译文件；
    根据所述反编译文件，获取所述目标应用的生命周期以及回调函数列表；
    根据所述生命周期以及回调函数列表，生成所述控制流图。
  10. 根据权利要求1-9任一项所述的方法，其特征在于，所述扫描目标应用的组件中的指定污点源以及指定污点汇聚点，包括：
    通过所述指定污点分析工具，获取所述目标应用的安装包文件对应的反编译文件；
    根据所述反编译文件，获取所述目标应用的组件文件；
    解析所述组件文件，获得所述目标应用对应的指定污点源以及指定污点汇聚点。
  11. 根据权利要求1-10任一项所述的方法，其特征在于，在所述扫描目标应用的组件中的指定污点源以及指定污点汇聚点之前，所述方法还包括：
    根据应用的私有文件泄露漏洞模型，提取应用对应的所有函数中的污点源函数作为指定污点源，以及提取应用对应的所有函数中的污点汇聚点对应的函数作为指定污点汇聚点。
  12. 根据权利要求1-11任一项所述的方法，其特征在于，在所述扫描目标应用的组件中的指定污点源以及指定污点汇聚点之前，所述方法还包括：
    根据应用的私有文件泄露漏洞模型，提取应用对应的所有函数中除所述第一污点标记函数以外的污点标记函数，并作为第二污点标记函数，以及提取应用对应的所有函数中除所述第一污点传播函数以外的污点传播函数，并作为第二污点传播函数。
  13. 根据权利要求1-12任一项所述的方法，其特征在于，所述根据污点传播结果，确定所述目标应用是否存在私有文件泄露的漏洞，包括：
    根据污点传播结果，如果存在任一所述指定污点源至任一所述指定污点汇聚点的传播路径，则确定所述目标应用存在私用文件泄露的漏洞；
    如果不存在所述指定污点源至所述指定污点汇聚点的传播路径，则确定所述目标应用不存在私用文件泄露的漏洞。
  14. 根据权利要求13所述的方法，其特征在于，所述如果存在任一所述指定污点源至任一所述指定污点汇聚点的传播路径，则确定所述目标应用存在私用文件泄露的漏洞，包括：
    如果存在任一所述指定污点源至任一所述指定污点汇聚点的传播路径，判断所述传播路径是否处于预设白名单；
    如果不处于预设白名单，则确定所述目标应用存在私用文件泄露的漏洞。
  15. 根据权利要求14所述的方法，其特征在于，所述根据污点传播结果，确定所述目标应用是否存在私有文件泄露的漏洞，还包括：
    如果处于预设白名单，则确定所述目标应用不存在私用文件泄露的漏洞。
  16. 根据权利要求13-15任一项所述的方法，其特征在于，所述方法还包括：
    当确定所述目标应用存在私用文件泄露的漏洞时，输出提示信息以及所述传播路径，所述提示信息用于提示所述目标应用存在私用文件泄露的漏洞。
  17. 根据权利要求1-16任一项所述的方法，其特征在于，所述指定污点分析工具包括FlowDroid污点分析工具。
  18. 一种文件泄露漏洞的检测装置，其特征在于，所述装置包括：函数扫描模块、污点传播模块以及漏洞确定模块，其中，
    所述函数扫描模块用于扫描目标应用的组件中的指定污点源以及指定污点汇聚 点，所述指定污点源以及指定污点汇聚点根据应用的私有文件泄露漏洞设定；
    所述污点传播模块用于在所述组件中存在污点源以及污点汇聚点时，根据指定污点分析工具中的第一污点传播函数、所述指定污点分析工具中的第一污点标记函数、预先添加的第二污点传播函数以及预先添加的第二污点标记函数，进行污点传播；
    所述漏洞确定模块用于根据污点传播结果，确定所述目标应用是否存在私有文件泄露的漏洞。
  19. 一种电子设备，其特征在于，包括：
    一个或多个处理器；
    存储器；
    一个或多个应用程序，其中所述一个或多个应用程序被存储在所述存储器中并被配置为由所述一个或多个处理器执行，所述一个或多个程序配置用于执行如权利要求1-17任一项所述的方法。
  20. 一种计算机可读取存储介质，其特征在于，所述计算机可读取存储介质中存储有程序代码，所述程序代码可被处理器调用执行如权利要求1-17任一项所述的方法。
PCT/CN2020/091246 2020-05-20 2020-05-20 文件泄露漏洞的检测方法、装置、电子设备及存储介质 WO2021232279A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
CN202080095238.0A CN115039099A (zh) 2020-05-20 2020-05-20 文件泄露漏洞的检测方法、装置、电子设备及存储介质
PCT/CN2020/091246 WO2021232279A1 (zh) 2020-05-20 2020-05-20 文件泄露漏洞的检测方法、装置、电子设备及存储介质

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/CN2020/091246 WO2021232279A1 (zh) 2020-05-20 2020-05-20 文件泄露漏洞的检测方法、装置、电子设备及存储介质

Publications (1)

Publication Number Publication Date
WO2021232279A1 true WO2021232279A1 (zh) 2021-11-25

Family

ID=78709060

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2020/091246 WO2021232279A1 (zh) 2020-05-20 2020-05-20 文件泄露漏洞的检测方法、装置、电子设备及存储介质

Country Status (2)

Country Link
CN (1) CN115039099A (zh)
WO (1) WO2021232279A1 (zh)

Cited By (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114546561A (zh) * 2022-02-22 2022-05-27 湖南泛联新安信息科技有限公司 一种程序静态分析结果中最佳修复点的展示方法
CN114880673A (zh) * 2022-04-28 2022-08-09 上海交通大学 针对小程序源代码进行隐私数据泄露检测的方法及***
CN115277062A (zh) * 2022-06-13 2022-11-01 深圳开源互联网安全技术有限公司 一种恶意攻击拦截方法、装置、设备及可读存储介质
CN116069675A (zh) * 2023-04-07 2023-05-05 中国工商银行股份有限公司 微服务架构应用的污点分析方法及装置
CN116842531A (zh) * 2023-08-28 2023-10-03 北京安普诺信息技术有限公司 基于代码疫苗的漏洞实时验证方法、装置、设备及介质

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN105550594A (zh) * 2015-12-17 2016-05-04 西安电子科技大学 安卓应用文件的安全性检测方法
CN106203113A (zh) * 2016-07-08 2016-12-07 西安电子科技大学 安卓应用文件的隐私泄露监控方法
CN106940773A (zh) * 2017-01-10 2017-07-11 西安电子科技大学 基于静态污点数据分析的隐私泄漏漏洞检测确认方法
US20200042706A1 (en) * 2018-07-31 2020-02-06 Oracle International Corporation Taint analysis with access paths

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN105550594A (zh) * 2015-12-17 2016-05-04 西安电子科技大学 安卓应用文件的安全性检测方法
CN106203113A (zh) * 2016-07-08 2016-12-07 西安电子科技大学 安卓应用文件的隐私泄露监控方法
CN106940773A (zh) * 2017-01-10 2017-07-11 西安电子科技大学 基于静态污点数据分析的隐私泄漏漏洞检测确认方法
US20200042706A1 (en) * 2018-07-31 2020-02-06 Oracle International Corporation Taint analysis with access paths

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
LI QIAN: "Android Security Threats Analysis Based on Dynamic and Static Taint Flow", INFORMATION & TECHNOLOGY, CHINA MASTER'S THESES FULL-TEXT DATABASE, 15 February 2020 (2020-02-15), XP055873614 *

Cited By (9)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114546561A (zh) * 2022-02-22 2022-05-27 湖南泛联新安信息科技有限公司 一种程序静态分析结果中最佳修复点的展示方法
CN114546561B (zh) * 2022-02-22 2024-05-24 湖南泛联新安信息科技有限公司 一种程序静态分析结果中最佳修复点的展示方法
CN114880673A (zh) * 2022-04-28 2022-08-09 上海交通大学 针对小程序源代码进行隐私数据泄露检测的方法及***
CN114880673B (zh) * 2022-04-28 2024-06-07 上海交通大学 针对小程序源代码进行隐私数据泄露检测的方法及***
CN115277062A (zh) * 2022-06-13 2022-11-01 深圳开源互联网安全技术有限公司 一种恶意攻击拦截方法、装置、设备及可读存储介质
CN116069675A (zh) * 2023-04-07 2023-05-05 中国工商银行股份有限公司 微服务架构应用的污点分析方法及装置
CN116069675B (zh) * 2023-04-07 2024-01-05 中国工商银行股份有限公司 微服务架构应用的污点分析方法及装置
CN116842531A (zh) * 2023-08-28 2023-10-03 北京安普诺信息技术有限公司 基于代码疫苗的漏洞实时验证方法、装置、设备及介质
CN116842531B (zh) * 2023-08-28 2023-11-03 北京安普诺信息技术有限公司 基于代码疫苗的漏洞实时验证方法、装置、设备及介质

Also Published As

Publication number Publication date
CN115039099A (zh) 2022-09-09

Similar Documents

Publication Publication Date Title
WO2021232279A1 (zh) 文件泄露漏洞的检测方法、装置、电子设备及存储介质
Gibler et al. Androidleaks: Automatically detecting potential privacy leaks in android applications on a large scale
Cao et al. EdgeMiner: Automatically Detecting Implicit Control Flow Transitions through the Android Framework.
Sbîrlea et al. Automatic detection of inter-application permission leaks in android applications
US8782792B1 (en) Systems and methods for detecting malware on mobile platforms
Dwivedi et al. Mobile application security
US11176267B2 (en) Fine-grained user control over usages of sensitive system resources having private data with applications in privacy enforcement
Han et al. Comparing mobile privacy protection through cross-platform applications
WO2017008581A1 (zh) 应用程序的测试方法、客户端及***
Tang et al. A novel hybrid method to analyze security vulnerabilities in android applications
US11132436B2 (en) FPGA cloud host development method and system
US8898780B2 (en) Encoding labels in values to capture information flows
KR20110128632A (ko) 스마트폰 응용프로그램의 악성행위 탐지 방법 및 장치
CN104182681B (zh) 基于hook的iOS***关键行为检测装置和方法
WO2016095570A1 (zh) 一种嵌入式***的调试方法及装置、存储介质
CN104036194A (zh) 一种应用程序中泄露隐私数据的漏洞检测方法及装置
CN114189553B (zh) 一种流量回放方法、***及计算设备
Alzaidi et al. DroidRista: a highly precise static data flow analysis framework for android applications
CN112685745A (zh) 一种固件检测方法、装置、设备及存储介质
Tang et al. Ssldetecter: detecting SSL security vulnerabilities of android applications based on a novel automatic traversal method
CN115828256B (zh) 一种越权与未授权逻辑漏洞检测方法
Liu et al. A Graph‐Based Feature Generation Approach in Android Malware Detection with Machine Learning Techniques
Yang et al. Permdroid: automatically testing permission-related behaviour of android applications
Yuan et al. Scalable and obfuscation-resilient android app repackaging detection based on behavior birthmark
Mostafa et al. Netdroid: Summarizing network behavior of android apps for network code maintenance

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 20937021

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

32PN Ep: public notification in the ep bulletin as address of the adressee cannot be established

Free format text: NOTING OF LOSS OF RIGHTS PURSUANT TO RULE 112(1) EPC (EPO FORM 1205N DATED 18/01/2023)

122 Ep: pct application non-entry in european phase

Ref document number: 20937021

Country of ref document: EP

Kind code of ref document: A1