Security Threats Caused by Public Event Callback in Android Application

Abstract

The feature of event-driven acts as a key role that makes Android application differentiate from traditional PC software. Since many of those events are hardly predicted and could not be observed by other applications, attackers are similarly impossible to engage corresponding attacks by finding the vulnerabilities of such an event-driven mechanism. However, of various kinds of events offered by either user or system, there are still events that can be received by more than one application and further, which could offer important basic resources to predict specific behaviours of targeted application. In this paper, we aim to analyse potential security threats inside them and demonstrate typical kinds of proof-of-concept attack examples. Apart from that, the critical mechanism-public event callback (PEC) that may cause the threat is firstly modelled and studied, where its four main parts are introduced in detail.