TL;DR
This paper performs the first large-scale analysis of HTTP inclusion in WebViews across 189,779 Google Play apps and identifies high-profile apps with 10M+ installations vulnerable to attacks ranging from phishing to full app takeover.
Push notification services are widely used in mobile apps to deliver time-sensitive content. In the fragmented Android ecosystem, however, no single push service works reliably across all devices and markets, leading developers to integrate multiple push SDKs from device manufacturers and third-party providers. Despite...
This work presents TENET, a purpose-built auditing tool whose design decisions are grounded in the structural properties of the secrets targeted and empirically validated against a ground-truth dataset, and proposes mitigation measures and best practices for both Telegram platform developers and third-party Mini App cr...
Whether off-the-shelf Large Language Models (LLMs) can effectively reason about taint flows in Android apps is investigated, and preliminary findings suggest that LLM reasoning may effectively complement traditional static taint analysis.
Mobile apps frequently embed sensitive secrets, such as API keys, access tokens, client secrets, and private keys that support internal functionality or enable integration with external systems and third-party services. Developers frequently embed these secrets into Android apps, which allows attackers to extract them...
Android lite apps are intended for resource-constrained environments and are commonly assumed to be safer because they expose less functionality than full-featured apps. However, recurring reports of crashes, broken features, and excessive advertising suggest that this assumption may be false. We present the first syst...
We use cookies to run the site and, with your consent, for analytics and to show ads. See our Cookie Policy.
