Abstract:

This paper studies the formation mechanism of the Webview vulnerability, and learns that the vulnerability arises from the unsafe function’ invoking and did not defend java reflection on the program. At present, Webview vulnerability detection method is mainly based on black box testing, which is at low accuracy. This paper proposes a detection combined of static analysis and dynamic analysis: static analysis can carry out where is the unsafe function, and dynamic analysis can make a test on the unsafe function, in that way the Webview vulnerability can be detected effectively and accurately. At the same time, this paper studies the Webview vulnerability protection proposed by Google, and pointed out that there exits three defects in Google’s defend. So this paper proposes a vulnerability defend based on access control and script detection, the defend is strict with the visitors’ authority limit, timely responding to the user and makes use of script detection to distinguish the security scripts and malicious script, putting an end to the Webview vulnerability without any ability weaken. Finally, this paper designs a set of experiment, comparing the undefended program and the defend programs, the result shows that the protection is valid.

Key words: android system, Webview vulnerability, detection, defend