Access control for plugins in cordova-based hybrid applications

Naoki Kudo, Toshihiro Yamauchi, Thomas H. Austin

Research output: Chapter in Book/Report/Conference proceedingConference contribution

6 Citations (Scopus)

Abstract

Hybrid application frameworks such as Cordovaallow mobile application (app) developers to create platformindependent apps. The code is written in JavaScript, with special APIs to access device resources in a platform-agnostic way. In this paper, we present a novel app-repackaging attack that repackages hybrid apps with malicious code, this code can exploit Cordova's plugin interface to tamper with device resources. We further demonstrate a defense against this attack through the use of a novel runtime access control mechanism that restricts access based on the mobile user's judgement. Our mechanism is easy to introduce to existing Cordova apps, and allows developers to produce apps that are resistant to app-repackaging attacks.

Original languageEnglish
Title of host publicationProceedings - 31st IEEE International Conference on Advanced Information Networking and Applications, AINA 2017
PublisherInstitute of Electrical and Electronics Engineers Inc.
Pages1063-1069
Number of pages7
ISBN (Electronic)9781509060283
DOIs
Publication statusPublished - May 5 2017
Event31st IEEE International Conference on Advanced Information Networking and Applications, AINA 2017 - Taipei, Taiwan, Province of China
Duration: Mar 27 2017Mar 29 2017

Other

Other31st IEEE International Conference on Advanced Information Networking and Applications, AINA 2017
CountryTaiwan, Province of China
CityTaipei
Period3/27/173/29/17

Keywords

  • Access Control
  • Android
  • Hybrid Applications

ASJC Scopus subject areas

  • Engineering(all)

Fingerprint Dive into the research topics of 'Access control for plugins in cordova-based hybrid applications'. Together they form a unique fingerprint.

Cite this