iOS, Your OS, Everybody’s OS: Vetting and Analyzing Network Services of iOS Applications Zhushou Tang, Shanghai Jiao Tong University and PWNZEN InfoTech Co., LTD; Ke Tang, Shanghai Jiao Tong University; Minhui Xue, The University of Adelaide; Yuan Tian, University of Virginia; Sen Chen, Nanyang Technological University; Muhammad Ikram, Macquarie University; Tielei Wang, PWNZEN InfoTech Co., LTD; Haojin Zhu, Shanghai Jiao Tong University https://www.usenix.org/conference/usenixsecurity20/presentation/tang This paper is included in the Proceedings of the 29th USENIX Security Symposium. August 12–14, 2020 978-1-939133-17-5 Open access to the Proceedings of the 29th USENIX Security Symposium is sponsored by USENIX. iOS, Your OS, Everybody’s OS: Vetting and Analyzing Network Services of iOS Applications Zhushou Tang1,6 Ke Tang1 Minhui Xue2 Yuan Tian3 Sen Chen4 Muhammad Ikram5 Tielei Wang6 Haojin Zhu1 1Shanghai Jiao Tong University 2The University of Adelaide 3University of Virginia 4Nanyang Technological University 5Macquarie University 6PWNZEN InfoTech Co., LTD Abstract Recent research evaluating the security of open port us- Smartphone applications that listen for network connections age in Android apps has demonstrated new attack avenues introduce significant security and privacy threats for users. that can exploit the vulnerability of network services and In this paper, we focus on vetting and analyzing the secu- access unauthorized sensitive data previously unthought rity of iOS apps’ network services. To this end, we develop of [22, 32, 55, 80]. Some works have also proposed vetting an efficient and scalable iOS app collection tool to down- methodologies to handle dynamic code loading [69], complex load 168,951 iOS apps in the wild. We investigate a set of implicit control/data flows [31], or advanced code obfusca- 1,300 apps to understand the characteristics of network ser- tion [46, 79], techniques created to overcome the inherent lim- vice vulnerabilities, confirming 11 vulnerabilities in popular itations of Android app static analysis. Unfortunately, these apps, such as Waze, Now, and QQBrowser. From these vul- sophisticated and ad hoc vetting approaches only target An- nerabilities, we create signatures for a large-scale analysis droid apps. of 168,951 iOS apps, which shows that the use of certain third-party libraries listening for remote connections is a com- iOS’s network architecture is built on top of BSD sockets. mon source of vulnerable network services in 92 apps. These When acting as a resource provider, the app turns the iOS vulnerabilities open up the iOS device to a host of possible device into a server to provide services to a client once a attacks, including data leakage, remote command execution, connection is established. For example, the Handoff [23] and denial-of-service attacks. We have disclosed identified feature of iPhone serves as a server to receive commands vulnerabilities and received acknowledgments from vendors. from a client in the same Wi-Fi network. Apple encourages network connections between different components through 1 Introduction Bonjour protocol [28, 73], which broadcasts the network service to clients. Although Apple reviews third-party apps A network service is built on an application programming in- before releasing them on the iTunes App Store, The vetting terface (API) or a library that provides networked data storage, process predominantly focuses on detecting malicious apps or other online functionality to applications. Many potential instead of network service vulnerabilities. threats have spawned with the widespread use of smartphones with network service capabilities. Poor implementation prac- In this work, we propose the first vetting methodology of tices expose users to denial-of-service (DoS) or remote code iOS apps’ network services. There are three elements that execution (RCE) attacks, and unauthorized access can oc- make vetting and analyzing iOS apps more technically chal- cur due to the weak protection of network resources. Such lenging than Android apps. (i) Android apps are easy to col- threats have already been substantiated in the real world. One lect and analyze; however, a public repository of iOS apps such example is the DoS or RCE attack against WhatsApp is not readily available due to the closed nature of Apple’s that can occur when a WhatsApp user accepts a call from a app ecosystem. (ii) Practical program analysis tools for auto- malicious peer [5, 17]. Another is the “wormhole” vulnera- matically analyzing iOS apps (implemented in Objective-C bility, where open ports in Android apps allow an attacker to or SWIFT) are not as well developed or diverse as tools for remotely access data or manipulate apps without sufficient Android (written in Java) are [26, 45, 77]. (iii) The layout of authorization [51]. Recently, a proof-of-concept DoS attack code in Android apps is highly structural, but the boundaries that prevents communication between iOS devices has been of iOS code are obscure, causing previous methods for third- demonstrated by utilizing the specific design flaw of the Apple party library identification in Android apps [27, 48, 76] to Wireless Direct Link (AWDL) protocol [74]. function incorrectly on iOS apps. USENIX Association 29th USENIX Security Symposium 2415 To ensure the efficiency of our pipeline, we tailor our app Table 1: Major Vulnerabilities Found. collection (cf. § 3), vetting process (cf. § 4), and library iden- tification (cf. § 5) techniques to overcome the unique chal- App Vendor Vulnerability Impact Severity (by vendor) Status lenges presented by iOS apps. First, to collect and analyze Waze Google CE/RCE/DoS N/A Patched Scout GPS Link Telenav CE N/A Pending apps, we need to download, decrypt, and parse the executable, QQBrowser Tencent CE High Patched Taobao4iPhone Alibaba CE N/A Pending a process that leverages iTunes’ unique download interface Youku Alibaba CE N/A Pending Handoff Apple RCE/DoS N/A Patched with a special decryption method to expedite app collection. Now Tencent Privacy Leaks High Patched Amazon Prime Video Amazon Privacy Leaks N/A Pending Our collection methodology can download and decrypt over QQSports Tencent Privacy Leaks N/A Pending KENWOOD WebLink RCE/DoS N/A Patched 5,000 apps per day using only two Apple accounts and two JVC WebLink RCE/DoS N/A Patched WebLink Host WebLink CE/RCE/DoS N/A Patched jailbroken iOS devices, providing better scaling up of tasks Flipps TV Flipps Media CE/RCE/DoS N/A Pending with lower latency than past works [62, 67]. After collection, FITE TV Flipps Media CE/RCE/DoS N/A Pending JDRead JD Privacy Leaks Medium Patched we parse the iOS apps, obtain the metadata of apps, and feed QQMail Tencent Privacy Leaks N/A Pending 1 CE: Command Execution. it into a search engine for retrieval and subsequent analy- RCE: Remote Code Execution. sis. Second, to improve the accuracy and efficiency of our DoS: Denial-of-Service. vetting results, we write an “addon” which evaluates the net- vulnerabilities found in Table 1). We also helped the vendors work interface on the fly. To expedite the automated analysis, patch these vulnerabilities and are currently discussing possi- we leverage an on-demand inter-procedural [70] data-flow bilities of vendor deployment of our vetting system. To foster analysis tool to restore the implicit call introduced by the further research, we release the dataset used in this paper and message dispatch property [24] of Objective-C or SWIFT the code developed for analysis, and encourage readers to runtime. Third, to deal with the obscure documentation of view short video demos of vulnerabilities we discovered at system and third-party network services, we propose a call https://sites.google.com/site/iosappnss/. stack based collection method that overcomes the limitations The key contributions of this paper are as follows: of the current class-clustering based third-party library identi- fication [67]. In our method, we first identify system network An efficient iOS app collection tool. To facilitate our anal- • service APIs by traveling the call stack of each app; then third- ysis, we introduce an iOS app collection tool thanks to party network service libraries can be distinguished through the use of the headless-downloader and executable decryp- similarity analysis on the runtime call stack. tion. The headless-downloader enables us to download We begin our analysis with a set of 1,300 applications, .ipa files from iTunes App Store fluently. The executable which we refer to as “seed apps”. Seed apps are used to under- decryption we developed does not need to upload large stand the characteristics of network service vulnerabilities and .ipa files to iOS devices, install apps, or download en- extract signatures for large-scale analysis of network services. tire decrypted .ipa files from iOS devices. The proposed To analyze the seed apps, we adopt the vetting methodology downloading enables large-scale dataset collection with of “dynamic first, static later, and manual confirmation last”. limited iOS devices, and can decrypt over 5,000 apps per The dynamic analysis can check for misconfigured network day with only two iOS devices, improving the scalability of interfaces on a large scale, which allows us to pinpoint a data collection by 17 times compared to the state-of-the-art small portion of candidate network service apps. The compa- collection method in [62]. The collection of such a large rably more time-consuming static analysis can then be used dataset of iOS apps is a significant resource and also serves to perform a fine-grained check for potential vulnerabilities. as a useful benchmark for future research. Finally, manual confirmation is involved in verifying static Systematic characterization of network services of iOS analysis results. In addition, the precise call stack of _bind • apps. We apply dynamic analysis to collect a call stack collected by dynamic analysis can be used for the identifica- from each app.