Access control for plugins in cordova-based hybrid applications

Naoki Kudo, Toshihiro Yamauchi, Thomas H. Austin

Research output: Chapter in Book/Report/Conference proceedingConference contribution

7 Citations (Scopus)

Abstract

Hybrid application frameworks such as Cordovaallow mobile application (app) developers to create platformindependent apps. The code is written in JavaScript, with special APIs to access device resources in a platform-agnostic way. In this paper, we present a novel app-repackaging attack that repackages hybrid apps with malicious code, this code can exploit Cordova's plugin interface to tamper with device resources. We further demonstrate a defense against this attack through the use of a novel runtime access control mechanism that restricts access based on the mobile user's judgement. Our mechanism is easy to introduce to existing Cordova apps, and allows developers to produce apps that are resistant to app-repackaging attacks.

Original languageEnglish
Title of host publicationProceedings - 31st IEEE International Conference on Advanced Information Networking and Applications, AINA 2017
EditorsTomoya Enokido, Hui-Huang Hsu, Chi-Yi Lin, Makoto Takizawa, Leonard Barolli
PublisherInstitute of Electrical and Electronics Engineers Inc.
Pages1063-1069
Number of pages7
ISBN (Electronic)9781509060283
DOIs
Publication statusPublished - May 5 2017
Event31st IEEE International Conference on Advanced Information Networking and Applications, AINA 2017 - Taipei, Taiwan, Province of China
Duration: Mar 27 2017Mar 29 2017

Publication series

NameProceedings - International Conference on Advanced Information Networking and Applications, AINA
ISSN (Print)1550-445X

Other

Other31st IEEE International Conference on Advanced Information Networking and Applications, AINA 2017
Country/TerritoryTaiwan, Province of China
CityTaipei
Period3/27/173/29/17

Keywords

  • Access Control
  • Android
  • Hybrid Applications

ASJC Scopus subject areas

  • General Engineering

Fingerprint

Dive into the research topics of 'Access control for plugins in cordova-based hybrid applications'. Together they form a unique fingerprint.

Cite this