通信学报 ›› 2014, Vol. 35 ›› Issue (Z2): 117-123.doi: 10.3969/j.issn.1000-436x.2014.z2.016

• 学术论文 • 上一篇    下一篇

Android平台NFC应用漏洞挖掘技术研究

王志强1,刘奇旭2,张玉清2   

  1. 1 西安电子科技大学 综合业务网理论及关键技术国家重点实验室，陕西 西安 710071
    2 中国科学院大学 国家计算机网络入侵防范中心，北京 101408
  • 出版日期:2014-11-25 发布日期:2017-06-19
  • 基金资助:
    国家自然科学基金资助项目;国家自然科学基金资助项目;发改办高技[2012]1424

Research of discovering vulnerabilities of NFC applications on Android platform

Zhi-qiang WANG1,Qi-xu LIU2,Yu-qing ZHANG2   

  1. 1 State Key Laboratory of Integrated Services Networks,Xidian University,Xi’an 710071,China
    2 National Computer Network Intrusion Protection Center,University of Chinese Academy of Sciences,Beijing 101408,China
  • Online:2014-11-25 Published:2017-06-19
  • Supported by:
    The National Natural Science Foundation of China;The National Natural Science Foundation of China;The National Development and Reform Commission Special Notice of Information Security

在线阅读

7

PDF下载

1415

摘要：

为了提高NFC技术的安全性，针对Android平台NFC应用进行NDEF协议漏洞挖掘研究，提出了一种基于Fuzzing技术的测试方法。该方法采用手工、生成和变异3种策略构造测试用例，使用报文逆向分析和嗅探2种手段辅助分析并构造报文；然后，利用构造的测试用例对NFC应用目标进行漏洞挖掘并输出结果。根据该方法，开发了一个NFC应用安全漏洞挖掘系统ANDEFVulFinder，采用logcat和进程监控的手段在漏洞挖掘过程中对目标进行监测，并通过模拟标签和触碰操作实现漏洞挖掘过程自动化。最后，通过测试MIUI系统和6个应用，发现了8个漏洞，结果表明了漏洞挖掘方法的有效性。

关键词: 近场通信, 移动设备, Fuzzing技术, 漏洞挖掘

Abstract:

To improve the security of NFC technology,a research is done for discovering NDEF vulnerabilities of NFC applications on Android platform,and a method of bug hunting is proposed on based Fuzzing technology.The method adopts manual craft,the generation and the mutation strategies to construct test cases,and uses two assistant means of analyzing and constructing test cases,including reverse message anylysis and packet sniffing.Then,NFC applications’ vulnerabilities with constructed test cases and output results are discovered.According to the method,a system called ANDEFVulFinder is developed for discovering the security vulnerabilities of NFC applications.The tool logcat and process monitoring are used to monitor targets’ exceptions during the discovering process,and the test is automated

Key words: near field communication, mobile devices, Fuzzing, vulnerability discovering

No Suggested Reading articles found!