Access control mechanism to mitigate cordova plugin attacks in hybrid applications

Naoki Kudo, Toshihiro Yamauchi, Thomas H. Austin


3 被引用数 (Scopus)


Hybrid application frameworks such as Cordova are more and more popular to create platform-independent applications (apps) because they provide special APIs to access device resources in a platform-agonistic way. By using these APIs, hybrid apps can access device resources through JavaScript. In this paper, we present a novel apprepackaging attack that repackages hybrid apps with malicious code; this code can exploit Cordova’s plugin interface to steal and tamper with device resources. We address this attack and cross-site scripting attacks against hybrid apps. Since these attacks need to use plugins to access device resources, we refer to both of these attacks as Cordova plugin attacks. We further demonstrate a defense against Cordova plugin attacks through the use of a novel runtime access control mechanism that restricts access based on the mobile user’s judgement. Our mechanism is easy to introduce to existing Cordova apps, and allows developers to produce apps that are resistant to Cordova plugin attacks. Moreover, we evaluate the effectiveness and performance of our mechanism.

ジャーナルJournal of Information Processing
出版ステータスPublished - 1月 2018

ASJC Scopus subject areas

  • コンピュータ サイエンス(全般)


「Access control mechanism to mitigate cordova plugin attacks in hybrid applications」の研究トピックを掘り下げます。これらがまとまってユニークなフィンガープリントを構成します。