Track papers across labs, topics, and trends.
Search papers, labs, and topics across Lattice.
This paper introduces AndroScanner, an automated pipeline that combines static and dynamic analysis to detect backend vulnerabilities in Android applications. AndroScanner extracts backend API calls from APKs using tools like apktool, Androguard, and Frida, and then assesses them against the OWASP API Security Top 10 using APIFuzzer. Evaluation on a vulnerable banking app and a real-world recruitment app revealed 5 vulnerabilities, including a zero-day Excessive Data Exposure vulnerability in the production app, demonstrating the tool's effectiveness.
A new zero-day vulnerability in a real-world Android app with 50,000+ downloads was uncovered using a novel automated pipeline, highlighting the persistent security risks in mobile application backends.
Mobile applications rely on complex backends that introduce significant security risks, yet developers often lack the tools to assess these risks effectively. This paper presents AndroScanner, an automated pipeline for detecting vulnerabilities in Android application backends through combined static and dynamic analysis. AndroScanner extracts backend API calls from APK files using apktool, Androguard, and Frida-based dynamic instrumentation, then vets them against the OWASP API Security Top 10 using APIFuzzer. We evaluate AndroScanner on two Android applications: a purposely vulnerable bank application and a production recruitment application with over 50,000 downloads on Google Play Store. Across both applications, AndroScanner extracted 24 APIs and identified 5 vulnerabilities, including a previously unreported zero-day Excessive Data Exposure vulnerability (ranked 3rd in the OWASP API Security Top 10) in the production application. The vulnerability was responsibly disclosed to the development team prior to publication. AndroScanner is available upon request to assist developers in identifying and remediating backend security risks before deployment.