Measuring the Insecurity of Mobile Deep Links of Android Fang Liu, Chun Wang, Andres Pico, Danfeng Yao, and Gang Wang, Virginia Tech https://www.usenix.org/conference/usenixsecurity17/technical-sessions/presentation/liu This paper is included in the Proceedings of the 26th USENIX Security Symposium August 16–18, 2017 • Vancouver, BC, Canada ISBN 978-1-931971-40-9 Open access to the Proceedings of the 26th USENIX Security Symposium is sponsored by USENIX Measuring the Insecurity of Mobile Deep Links of Android Fang Liu, Chun Wang, Andres Pico, Danfeng Yao, Gang Wang Department of Computer Science, Virginia Tech ffbeyond, wchun, andres, danfeng,
[email protected] Abstract launch apps from websites with preloaded context, which becomes instrumental to many key user experiences. For Mobile deep links are URIs that point to specific loca- instance, from a restaurant’s home page, users can tap a tions within apps, which are instrumental to web-to-app hyperlink to launch the phone app and call the restaurant, communications. Existing “scheme URLs” are known to or launch Google Maps for navigation. Recently, users have hijacking vulnerabilities where one app can freely can even search in-app content with a web-based search register another app’s schemes to hijack the communi- engine (e.g., Google) and directly launch the target app cation. Recently, Android introduced two new meth- by clicking the search result [5]. ods “App links” and “Intent URLs” which were designed with security features, to replace scheme URLs. While The key enabler of web-to-mobile communication is the new mechanisms are secure in theory, little is known mobile deep links.