Author: Tong Yang, Ruian Duan, Jianyuan Lu, Shenjiang Zhang, Huichen Dai and Bin Liu
The Betrayal At Cloud City: An Empirical Analysis Of Cloud-Based … · 2019-08-15 · Omar...
Transcript of The Betrayal At Cloud City: An Empirical Analysis Of Cloud-Based … · 2019-08-15 · Omar...
![Page 1: The Betrayal At Cloud City: An Empirical Analysis Of Cloud-Based … · 2019-08-15 · Omar Alrawi*, Chaoshun Zuo*, Ruian Duan, Ranjita Pai Kasturi, Zhiqiang Lin, ... More Than What’s](https://reader033.fdocuments.us/reader033/viewer/2022043010/5f9ebfba621e4d196a2b62fd/html5/thumbnails/1.jpg)
The Betrayal At Cloud City:An Empirical Analysis Of
Cloud-Based Mobile BackendsOmar Alrawi*, Chaoshun Zuo*, Ruian Duan, Ranjita Pai Kasturi, Zhiqiang Lin, Brendan Saltaformaggio
*First Co-Authors
![Page 2: The Betrayal At Cloud City: An Empirical Analysis Of Cloud-Based … · 2019-08-15 · Omar Alrawi*, Chaoshun Zuo*, Ruian Duan, Ranjita Pai Kasturi, Zhiqiang Lin, ... More Than What’s](https://reader033.fdocuments.us/reader033/viewer/2022043010/5f9ebfba621e4d196a2b62fd/html5/thumbnails/2.jpg)
Conference
![Page 3: The Betrayal At Cloud City: An Empirical Analysis Of Cloud-Based … · 2019-08-15 · Omar Alrawi*, Chaoshun Zuo*, Ruian Duan, Ranjita Pai Kasturi, Zhiqiang Lin, ... More Than What’s](https://reader033.fdocuments.us/reader033/viewer/2022043010/5f9ebfba621e4d196a2b62fd/html5/thumbnails/3.jpg)
Conference
![Page 4: The Betrayal At Cloud City: An Empirical Analysis Of Cloud-Based … · 2019-08-15 · Omar Alrawi*, Chaoshun Zuo*, Ruian Duan, Ranjita Pai Kasturi, Zhiqiang Lin, ... More Than What’s](https://reader033.fdocuments.us/reader033/viewer/2022043010/5f9ebfba621e4d196a2b62fd/html5/thumbnails/4.jpg)
Conference
![Page 5: The Betrayal At Cloud City: An Empirical Analysis Of Cloud-Based … · 2019-08-15 · Omar Alrawi*, Chaoshun Zuo*, Ruian Duan, Ranjita Pai Kasturi, Zhiqiang Lin, ... More Than What’s](https://reader033.fdocuments.us/reader033/viewer/2022043010/5f9ebfba621e4d196a2b62fd/html5/thumbnails/5.jpg)
More Than What’s on
The Surface
![Page 6: The Betrayal At Cloud City: An Empirical Analysis Of Cloud-Based … · 2019-08-15 · Omar Alrawi*, Chaoshun Zuo*, Ruian Duan, Ranjita Pai Kasturi, Zhiqiang Lin, ... More Than What’s](https://reader033.fdocuments.us/reader033/viewer/2022043010/5f9ebfba621e4d196a2b62fd/html5/thumbnails/6.jpg)
More Than What’s on
The Surface
Mobile App
![Page 7: The Betrayal At Cloud City: An Empirical Analysis Of Cloud-Based … · 2019-08-15 · Omar Alrawi*, Chaoshun Zuo*, Ruian Duan, Ranjita Pai Kasturi, Zhiqiang Lin, ... More Than What’s](https://reader033.fdocuments.us/reader033/viewer/2022043010/5f9ebfba621e4d196a2b62fd/html5/thumbnails/7.jpg)
More Than What’s on
The Surface
Cloud Backend
Mobile App
![Page 8: The Betrayal At Cloud City: An Empirical Analysis Of Cloud-Based … · 2019-08-15 · Omar Alrawi*, Chaoshun Zuo*, Ruian Duan, Ranjita Pai Kasturi, Zhiqiang Lin, ... More Than What’s](https://reader033.fdocuments.us/reader033/viewer/2022043010/5f9ebfba621e4d196a2b62fd/html5/thumbnails/8.jpg)
More Than What’s on
The Surface
Cloud Backend
Mobile App
Web App
![Page 9: The Betrayal At Cloud City: An Empirical Analysis Of Cloud-Based … · 2019-08-15 · Omar Alrawi*, Chaoshun Zuo*, Ruian Duan, Ranjita Pai Kasturi, Zhiqiang Lin, ... More Than What’s](https://reader033.fdocuments.us/reader033/viewer/2022043010/5f9ebfba621e4d196a2b62fd/html5/thumbnails/9.jpg)
More Than What’s on
The Surface
Cloud Backend
Mobile App
Web App
Software Services
![Page 10: The Betrayal At Cloud City: An Empirical Analysis Of Cloud-Based … · 2019-08-15 · Omar Alrawi*, Chaoshun Zuo*, Ruian Duan, Ranjita Pai Kasturi, Zhiqiang Lin, ... More Than What’s](https://reader033.fdocuments.us/reader033/viewer/2022043010/5f9ebfba621e4d196a2b62fd/html5/thumbnails/10.jpg)
More Than What’s on
The Surface
Cloud Backend
Mobile App
Web App
Software Services
Operating System
![Page 11: The Betrayal At Cloud City: An Empirical Analysis Of Cloud-Based … · 2019-08-15 · Omar Alrawi*, Chaoshun Zuo*, Ruian Duan, Ranjita Pai Kasturi, Zhiqiang Lin, ... More Than What’s](https://reader033.fdocuments.us/reader033/viewer/2022043010/5f9ebfba621e4d196a2b62fd/html5/thumbnails/11.jpg)
More Than What’s on
The Surface
Cloud Backend
Mobile App
Web App
Software Services
Operating System
(v)Hardware
![Page 12: The Betrayal At Cloud City: An Empirical Analysis Of Cloud-Based … · 2019-08-15 · Omar Alrawi*, Chaoshun Zuo*, Ruian Duan, Ranjita Pai Kasturi, Zhiqiang Lin, ... More Than What’s](https://reader033.fdocuments.us/reader033/viewer/2022043010/5f9ebfba621e4d196a2b62fd/html5/thumbnails/12.jpg)
Mobile Backends All Over the News
![Page 13: The Betrayal At Cloud City: An Empirical Analysis Of Cloud-Based … · 2019-08-15 · Omar Alrawi*, Chaoshun Zuo*, Ruian Duan, Ranjita Pai Kasturi, Zhiqiang Lin, ... More Than What’s](https://reader033.fdocuments.us/reader033/viewer/2022043010/5f9ebfba621e4d196a2b62fd/html5/thumbnails/13.jpg)
Mobile Backends All Over the News
![Page 14: The Betrayal At Cloud City: An Empirical Analysis Of Cloud-Based … · 2019-08-15 · Omar Alrawi*, Chaoshun Zuo*, Ruian Duan, Ranjita Pai Kasturi, Zhiqiang Lin, ... More Than What’s](https://reader033.fdocuments.us/reader033/viewer/2022043010/5f9ebfba621e4d196a2b62fd/html5/thumbnails/14.jpg)
Mobile Backends All Over the News
![Page 15: The Betrayal At Cloud City: An Empirical Analysis Of Cloud-Based … · 2019-08-15 · Omar Alrawi*, Chaoshun Zuo*, Ruian Duan, Ranjita Pai Kasturi, Zhiqiang Lin, ... More Than What’s](https://reader033.fdocuments.us/reader033/viewer/2022043010/5f9ebfba621e4d196a2b62fd/html5/thumbnails/15.jpg)
Prior Work
• The rise of backends• Acar et al. "SoK: Lessons learned from android security
research for appified software platforms." IEEE S&P, 2016.
![Page 16: The Betrayal At Cloud City: An Empirical Analysis Of Cloud-Based … · 2019-08-15 · Omar Alrawi*, Chaoshun Zuo*, Ruian Duan, Ranjita Pai Kasturi, Zhiqiang Lin, ... More Than What’s](https://reader033.fdocuments.us/reader033/viewer/2022043010/5f9ebfba621e4d196a2b62fd/html5/thumbnails/16.jpg)
Prior Work
• The rise of backends• Acar et al. "SoK: Lessons learned from android security
research for appified software platforms." IEEE S&P, 2016.
• Evolution of backends
![Page 17: The Betrayal At Cloud City: An Empirical Analysis Of Cloud-Based … · 2019-08-15 · Omar Alrawi*, Chaoshun Zuo*, Ruian Duan, Ranjita Pai Kasturi, Zhiqiang Lin, ... More Than What’s](https://reader033.fdocuments.us/reader033/viewer/2022043010/5f9ebfba621e4d196a2b62fd/html5/thumbnails/17.jpg)
Prior Work
• The rise of backends• Acar et al. "SoK: Lessons learned from android security
research for appified software platforms." IEEE S&P, 2016.
• Evolution of backends• App Thinning1
[1] Mojica, Gregg. Working with App Thinning in iOS 9https://www.appcoda.com/app-thinning/, Accessed Aug 2019
![Page 18: The Betrayal At Cloud City: An Empirical Analysis Of Cloud-Based … · 2019-08-15 · Omar Alrawi*, Chaoshun Zuo*, Ruian Duan, Ranjita Pai Kasturi, Zhiqiang Lin, ... More Than What’s](https://reader033.fdocuments.us/reader033/viewer/2022043010/5f9ebfba621e4d196a2b62fd/html5/thumbnails/18.jpg)
Prior Work
• The rise of backends• Acar et al. "SoK: Lessons learned from android security
research for appified software platforms." IEEE S&P, 2016.
• Evolution of backends• App Thinning1
• Security of Backends
[1] Mojica, Gregg. Working with App Thinning in iOS 9https://www.appcoda.com/app-thinning/, Accessed Aug 2019
![Page 19: The Betrayal At Cloud City: An Empirical Analysis Of Cloud-Based … · 2019-08-15 · Omar Alrawi*, Chaoshun Zuo*, Ruian Duan, Ranjita Pai Kasturi, Zhiqiang Lin, ... More Than What’s](https://reader033.fdocuments.us/reader033/viewer/2022043010/5f9ebfba621e4d196a2b62fd/html5/thumbnails/19.jpg)
Prior Work
• The rise of backends• Acar et al. "SoK: Lessons learned from android security
research for appified software platforms." IEEE S&P, 2016.
• Evolution of backends• App Thinning1
• Security of Backends• Zuo et al. "Authscope: Towards automatic discovery of
vulnerable authorizations in online services." ACM CCS., 2017• Zuo et al. "Why does your data leak? uncovering the data
leakage in cloud from mobile apps.” IEEE S&P. 2019• Appthority2
[1] Mojica, Gregg. Working with App Thinning in iOS 9https://www.appcoda.com/app-thinning/, Accessed Aug 2019[2] K. Watkins, “HospitalGown: The Backend Exposure Putting Enterprise Data at Risk,” Appthority, Tech. Rep., 2017.
![Page 20: The Betrayal At Cloud City: An Empirical Analysis Of Cloud-Based … · 2019-08-15 · Omar Alrawi*, Chaoshun Zuo*, Ruian Duan, Ranjita Pai Kasturi, Zhiqiang Lin, ... More Than What’s](https://reader033.fdocuments.us/reader033/viewer/2022043010/5f9ebfba621e4d196a2b62fd/html5/thumbnails/20.jpg)
Mel is an app developer.
Mel just wants to ship his killer app.
![Page 21: The Betrayal At Cloud City: An Empirical Analysis Of Cloud-Based … · 2019-08-15 · Omar Alrawi*, Chaoshun Zuo*, Ruian Duan, Ranjita Pai Kasturi, Zhiqiang Lin, ... More Than What’s](https://reader033.fdocuments.us/reader033/viewer/2022043010/5f9ebfba621e4d196a2b62fd/html5/thumbnails/21.jpg)
Mel is an app developer.
Mel just wants to ship his killer app.
Mobile App
Web App
Software Services
Operating System
(v)Hardware
![Page 22: The Betrayal At Cloud City: An Empirical Analysis Of Cloud-Based … · 2019-08-15 · Omar Alrawi*, Chaoshun Zuo*, Ruian Duan, Ranjita Pai Kasturi, Zhiqiang Lin, ... More Than What’s](https://reader033.fdocuments.us/reader033/viewer/2022043010/5f9ebfba621e4d196a2b62fd/html5/thumbnails/22.jpg)
Let’s Help Mel
![Page 23: The Betrayal At Cloud City: An Empirical Analysis Of Cloud-Based … · 2019-08-15 · Omar Alrawi*, Chaoshun Zuo*, Ruian Duan, Ranjita Pai Kasturi, Zhiqiang Lin, ... More Than What’s](https://reader033.fdocuments.us/reader033/viewer/2022043010/5f9ebfba621e4d196a2b62fd/html5/thumbnails/23.jpg)
Let’s Help Mel
Challenges for Mel
![Page 24: The Betrayal At Cloud City: An Empirical Analysis Of Cloud-Based … · 2019-08-15 · Omar Alrawi*, Chaoshun Zuo*, Ruian Duan, Ranjita Pai Kasturi, Zhiqiang Lin, ... More Than What’s](https://reader033.fdocuments.us/reader033/viewer/2022043010/5f9ebfba621e4d196a2b62fd/html5/thumbnails/24.jpg)
Let’s Help Mel
Challenges for Mel• What backends does my app use?
![Page 25: The Betrayal At Cloud City: An Empirical Analysis Of Cloud-Based … · 2019-08-15 · Omar Alrawi*, Chaoshun Zuo*, Ruian Duan, Ranjita Pai Kasturi, Zhiqiang Lin, ... More Than What’s](https://reader033.fdocuments.us/reader033/viewer/2022043010/5f9ebfba621e4d196a2b62fd/html5/thumbnails/25.jpg)
Let’s Help Mel
Challenges for Mel• What backends does my app use?
• How do I check if they are secure?
![Page 26: The Betrayal At Cloud City: An Empirical Analysis Of Cloud-Based … · 2019-08-15 · Omar Alrawi*, Chaoshun Zuo*, Ruian Duan, Ranjita Pai Kasturi, Zhiqiang Lin, ... More Than What’s](https://reader033.fdocuments.us/reader033/viewer/2022043010/5f9ebfba621e4d196a2b62fd/html5/thumbnails/26.jpg)
Let’s Help Mel
Challenges for Mel• What backends does my app use?
• How do I check if they are secure?
• How do I fix them?
![Page 27: The Betrayal At Cloud City: An Empirical Analysis Of Cloud-Based … · 2019-08-15 · Omar Alrawi*, Chaoshun Zuo*, Ruian Duan, Ranjita Pai Kasturi, Zhiqiang Lin, ... More Than What’s](https://reader033.fdocuments.us/reader033/viewer/2022043010/5f9ebfba621e4d196a2b62fd/html5/thumbnails/27.jpg)
Let’s Help Mel
Challenges for Mel• What backends does my app use?
• How do I check if they are secure?
• How do I fix them?
• Can I fix them (attribution)?
![Page 28: The Betrayal At Cloud City: An Empirical Analysis Of Cloud-Based … · 2019-08-15 · Omar Alrawi*, Chaoshun Zuo*, Ruian Duan, Ranjita Pai Kasturi, Zhiqiang Lin, ... More Than What’s](https://reader033.fdocuments.us/reader033/viewer/2022043010/5f9ebfba621e4d196a2b62fd/html5/thumbnails/28.jpg)
Let’s Help Mel
Challenges for Mel• What backends does my app use?
• How do I check if they are secure?
• How do I fix them?
• Can I fix them (attribution)?
![Page 29: The Betrayal At Cloud City: An Empirical Analysis Of Cloud-Based … · 2019-08-15 · Omar Alrawi*, Chaoshun Zuo*, Ruian Duan, Ranjita Pai Kasturi, Zhiqiang Lin, ... More Than What’s](https://reader033.fdocuments.us/reader033/viewer/2022043010/5f9ebfba621e4d196a2b62fd/html5/thumbnails/29.jpg)
Let’s Help Mel
Challenges for Mel• What backends does my app use?
• How do I check if they are secure?
• How do I fix them?
• Can I fix them (attribution)?
Mel’s Dream: Upload APK and vet all backends!
![Page 30: The Betrayal At Cloud City: An Empirical Analysis Of Cloud-Based … · 2019-08-15 · Omar Alrawi*, Chaoshun Zuo*, Ruian Duan, Ranjita Pai Kasturi, Zhiqiang Lin, ... More Than What’s](https://reader033.fdocuments.us/reader033/viewer/2022043010/5f9ebfba621e4d196a2b62fd/html5/thumbnails/30.jpg)
What Backends My App Uses?
![Page 31: The Betrayal At Cloud City: An Empirical Analysis Of Cloud-Based … · 2019-08-15 · Omar Alrawi*, Chaoshun Zuo*, Ruian Duan, Ranjita Pai Kasturi, Zhiqiang Lin, ... More Than What’s](https://reader033.fdocuments.us/reader033/viewer/2022043010/5f9ebfba621e4d196a2b62fd/html5/thumbnails/31.jpg)
What Backends My App Uses?
![Page 32: The Betrayal At Cloud City: An Empirical Analysis Of Cloud-Based … · 2019-08-15 · Omar Alrawi*, Chaoshun Zuo*, Ruian Duan, Ranjita Pai Kasturi, Zhiqiang Lin, ... More Than What’s](https://reader033.fdocuments.us/reader033/viewer/2022043010/5f9ebfba621e4d196a2b62fd/html5/thumbnails/32.jpg)
What Backends My App Uses?
![Page 33: The Betrayal At Cloud City: An Empirical Analysis Of Cloud-Based … · 2019-08-15 · Omar Alrawi*, Chaoshun Zuo*, Ruian Duan, Ranjita Pai Kasturi, Zhiqiang Lin, ... More Than What’s](https://reader033.fdocuments.us/reader033/viewer/2022043010/5f9ebfba621e4d196a2b62fd/html5/thumbnails/33.jpg)
What Backends My App Uses?
![Page 34: The Betrayal At Cloud City: An Empirical Analysis Of Cloud-Based … · 2019-08-15 · Omar Alrawi*, Chaoshun Zuo*, Ruian Duan, Ranjita Pai Kasturi, Zhiqiang Lin, ... More Than What’s](https://reader033.fdocuments.us/reader033/viewer/2022043010/5f9ebfba621e4d196a2b62fd/html5/thumbnails/34.jpg)
What Backends My App Uses?
![Page 35: The Betrayal At Cloud City: An Empirical Analysis Of Cloud-Based … · 2019-08-15 · Omar Alrawi*, Chaoshun Zuo*, Ruian Duan, Ranjita Pai Kasturi, Zhiqiang Lin, ... More Than What’s](https://reader033.fdocuments.us/reader033/viewer/2022043010/5f9ebfba621e4d196a2b62fd/html5/thumbnails/35.jpg)
What Backends My App Uses?
![Page 36: The Betrayal At Cloud City: An Empirical Analysis Of Cloud-Based … · 2019-08-15 · Omar Alrawi*, Chaoshun Zuo*, Ruian Duan, Ranjita Pai Kasturi, Zhiqiang Lin, ... More Than What’s](https://reader033.fdocuments.us/reader033/viewer/2022043010/5f9ebfba621e4d196a2b62fd/html5/thumbnails/36.jpg)
How Many Backends?
![Page 37: The Betrayal At Cloud City: An Empirical Analysis Of Cloud-Based … · 2019-08-15 · Omar Alrawi*, Chaoshun Zuo*, Ruian Duan, Ranjita Pai Kasturi, Zhiqiang Lin, ... More Than What’s](https://reader033.fdocuments.us/reader033/viewer/2022043010/5f9ebfba621e4d196a2b62fd/html5/thumbnails/37.jpg)
How Many Backends?
10 or More Unique Backends on Average
![Page 38: The Betrayal At Cloud City: An Empirical Analysis Of Cloud-Based … · 2019-08-15 · Omar Alrawi*, Chaoshun Zuo*, Ruian Duan, Ranjita Pai Kasturi, Zhiqiang Lin, ... More Than What’s](https://reader033.fdocuments.us/reader033/viewer/2022043010/5f9ebfba621e4d196a2b62fd/html5/thumbnails/38.jpg)
How Many Backends?
10 or More Unique Backends on Average
![Page 39: The Betrayal At Cloud City: An Empirical Analysis Of Cloud-Based … · 2019-08-15 · Omar Alrawi*, Chaoshun Zuo*, Ruian Duan, Ranjita Pai Kasturi, Zhiqiang Lin, ... More Than What’s](https://reader033.fdocuments.us/reader033/viewer/2022043010/5f9ebfba621e4d196a2b62fd/html5/thumbnails/39.jpg)
How Do I Check If They Are Secure?
![Page 40: The Betrayal At Cloud City: An Empirical Analysis Of Cloud-Based … · 2019-08-15 · Omar Alrawi*, Chaoshun Zuo*, Ruian Duan, Ranjita Pai Kasturi, Zhiqiang Lin, ... More Than What’s](https://reader033.fdocuments.us/reader033/viewer/2022043010/5f9ebfba621e4d196a2b62fd/html5/thumbnails/40.jpg)
How Do I Check If They Are Secure?
![Page 41: The Betrayal At Cloud City: An Empirical Analysis Of Cloud-Based … · 2019-08-15 · Omar Alrawi*, Chaoshun Zuo*, Ruian Duan, Ranjita Pai Kasturi, Zhiqiang Lin, ... More Than What’s](https://reader033.fdocuments.us/reader033/viewer/2022043010/5f9ebfba621e4d196a2b62fd/html5/thumbnails/41.jpg)
How Do I Check If They Are Secure?
First: Bug finding via input perturbation
![Page 42: The Betrayal At Cloud City: An Empirical Analysis Of Cloud-Based … · 2019-08-15 · Omar Alrawi*, Chaoshun Zuo*, Ruian Duan, Ranjita Pai Kasturi, Zhiqiang Lin, ... More Than What’s](https://reader033.fdocuments.us/reader033/viewer/2022043010/5f9ebfba621e4d196a2b62fd/html5/thumbnails/42.jpg)
How Do I Check If They Are Secure?
First: Bug finding via input perturbation
![Page 43: The Betrayal At Cloud City: An Empirical Analysis Of Cloud-Based … · 2019-08-15 · Omar Alrawi*, Chaoshun Zuo*, Ruian Duan, Ranjita Pai Kasturi, Zhiqiang Lin, ... More Than What’s](https://reader033.fdocuments.us/reader033/viewer/2022043010/5f9ebfba621e4d196a2b62fd/html5/thumbnails/43.jpg)
How Do I Check If They Are Secure?
First: Bug finding via input perturbation
![Page 44: The Betrayal At Cloud City: An Empirical Analysis Of Cloud-Based … · 2019-08-15 · Omar Alrawi*, Chaoshun Zuo*, Ruian Duan, Ranjita Pai Kasturi, Zhiqiang Lin, ... More Than What’s](https://reader033.fdocuments.us/reader033/viewer/2022043010/5f9ebfba621e4d196a2b62fd/html5/thumbnails/44.jpg)
How Do I Check If They Are Secure?
First: Bug finding via input perturbation
![Page 45: The Betrayal At Cloud City: An Empirical Analysis Of Cloud-Based … · 2019-08-15 · Omar Alrawi*, Chaoshun Zuo*, Ruian Duan, Ranjita Pai Kasturi, Zhiqiang Lin, ... More Than What’s](https://reader033.fdocuments.us/reader033/viewer/2022043010/5f9ebfba621e4d196a2b62fd/html5/thumbnails/45.jpg)
How Do I Check If They Are Secure?
First: Bug finding via input perturbation
SQLi, XSS, XXE
![Page 46: The Betrayal At Cloud City: An Empirical Analysis Of Cloud-Based … · 2019-08-15 · Omar Alrawi*, Chaoshun Zuo*, Ruian Duan, Ranjita Pai Kasturi, Zhiqiang Lin, ... More Than What’s](https://reader033.fdocuments.us/reader033/viewer/2022043010/5f9ebfba621e4d196a2b62fd/html5/thumbnails/46.jpg)
How Do I Check If They Are Secure?
![Page 47: The Betrayal At Cloud City: An Empirical Analysis Of Cloud-Based … · 2019-08-15 · Omar Alrawi*, Chaoshun Zuo*, Ruian Duan, Ranjita Pai Kasturi, Zhiqiang Lin, ... More Than What’s](https://reader033.fdocuments.us/reader033/viewer/2022043010/5f9ebfba621e4d196a2b62fd/html5/thumbnails/47.jpg)
How Do I Check If They Are Secure?
Second: Scan services for known vulnerabilities
![Page 48: The Betrayal At Cloud City: An Empirical Analysis Of Cloud-Based … · 2019-08-15 · Omar Alrawi*, Chaoshun Zuo*, Ruian Duan, Ranjita Pai Kasturi, Zhiqiang Lin, ... More Than What’s](https://reader033.fdocuments.us/reader033/viewer/2022043010/5f9ebfba621e4d196a2b62fd/html5/thumbnails/48.jpg)
65K Ports
How Do I Check If They Are Secure?
Second: Scan services for known vulnerabilities
![Page 49: The Betrayal At Cloud City: An Empirical Analysis Of Cloud-Based … · 2019-08-15 · Omar Alrawi*, Chaoshun Zuo*, Ruian Duan, Ranjita Pai Kasturi, Zhiqiang Lin, ... More Than What’s](https://reader033.fdocuments.us/reader033/viewer/2022043010/5f9ebfba621e4d196a2b62fd/html5/thumbnails/49.jpg)
65K Ports
How Do I Check If They Are Secure?
Second: Scan services for known vulnerabilities
![Page 50: The Betrayal At Cloud City: An Empirical Analysis Of Cloud-Based … · 2019-08-15 · Omar Alrawi*, Chaoshun Zuo*, Ruian Duan, Ranjita Pai Kasturi, Zhiqiang Lin, ... More Than What’s](https://reader033.fdocuments.us/reader033/viewer/2022043010/5f9ebfba621e4d196a2b62fd/html5/thumbnails/50.jpg)
65K Ports
How Do I Check If They Are Secure?
Second: Scan services for known vulnerabilities
![Page 51: The Betrayal At Cloud City: An Empirical Analysis Of Cloud-Based … · 2019-08-15 · Omar Alrawi*, Chaoshun Zuo*, Ruian Duan, Ranjita Pai Kasturi, Zhiqiang Lin, ... More Than What’s](https://reader033.fdocuments.us/reader033/viewer/2022043010/5f9ebfba621e4d196a2b62fd/html5/thumbnails/51.jpg)
65K Ports
How Do I Check If They Are Secure?
Second: Scan services for known vulnerabilities
![Page 52: The Betrayal At Cloud City: An Empirical Analysis Of Cloud-Based … · 2019-08-15 · Omar Alrawi*, Chaoshun Zuo*, Ruian Duan, Ranjita Pai Kasturi, Zhiqiang Lin, ... More Than What’s](https://reader033.fdocuments.us/reader033/viewer/2022043010/5f9ebfba621e4d196a2b62fd/html5/thumbnails/52.jpg)
65K Ports
How Do I Check If They Are Secure?
Second: Scan services for known vulnerabilities
![Page 53: The Betrayal At Cloud City: An Empirical Analysis Of Cloud-Based … · 2019-08-15 · Omar Alrawi*, Chaoshun Zuo*, Ruian Duan, Ranjita Pai Kasturi, Zhiqiang Lin, ... More Than What’s](https://reader033.fdocuments.us/reader033/viewer/2022043010/5f9ebfba621e4d196a2b62fd/html5/thumbnails/53.jpg)
Can I Fix Them?
![Page 54: The Betrayal At Cloud City: An Empirical Analysis Of Cloud-Based … · 2019-08-15 · Omar Alrawi*, Chaoshun Zuo*, Ruian Duan, Ranjita Pai Kasturi, Zhiqiang Lin, ... More Than What’s](https://reader033.fdocuments.us/reader033/viewer/2022043010/5f9ebfba621e4d196a2b62fd/html5/thumbnails/54.jpg)
Can I Fix Them?
Mobile App
Web App
Software Services
Operating System
(v)Hardware
![Page 55: The Betrayal At Cloud City: An Empirical Analysis Of Cloud-Based … · 2019-08-15 · Omar Alrawi*, Chaoshun Zuo*, Ruian Duan, Ranjita Pai Kasturi, Zhiqiang Lin, ... More Than What’s](https://reader033.fdocuments.us/reader033/viewer/2022043010/5f9ebfba621e4d196a2b62fd/html5/thumbnails/55.jpg)
Can I Fix Them?
Mobile App
Web App
Software Services
Operating System
(v)Hardware
First-Party: If Mel owns the whole stack
![Page 56: The Betrayal At Cloud City: An Empirical Analysis Of Cloud-Based … · 2019-08-15 · Omar Alrawi*, Chaoshun Zuo*, Ruian Duan, Ranjita Pai Kasturi, Zhiqiang Lin, ... More Than What’s](https://reader033.fdocuments.us/reader033/viewer/2022043010/5f9ebfba621e4d196a2b62fd/html5/thumbnails/56.jpg)
Can I Fix Them?
Mobile App
Web App
Software Services
Operating System
(v)Hardware
Mel is responsible for this portion
First-Party: If Mel owns the whole stack
![Page 57: The Betrayal At Cloud City: An Empirical Analysis Of Cloud-Based … · 2019-08-15 · Omar Alrawi*, Chaoshun Zuo*, Ruian Duan, Ranjita Pai Kasturi, Zhiqiang Lin, ... More Than What’s](https://reader033.fdocuments.us/reader033/viewer/2022043010/5f9ebfba621e4d196a2b62fd/html5/thumbnails/57.jpg)
Can I Fix Them?
Mobile App
Web App
Software Services
Operating System
(v)Hardware
![Page 58: The Betrayal At Cloud City: An Empirical Analysis Of Cloud-Based … · 2019-08-15 · Omar Alrawi*, Chaoshun Zuo*, Ruian Duan, Ranjita Pai Kasturi, Zhiqiang Lin, ... More Than What’s](https://reader033.fdocuments.us/reader033/viewer/2022043010/5f9ebfba621e4d196a2b62fd/html5/thumbnails/58.jpg)
Can I Fix Them?
Mobile App
Web App
Software Services
Operating System
(v)HardwareNo Access!
SDK Access
Third-Party: If Mel uses an SDK
![Page 59: The Betrayal At Cloud City: An Empirical Analysis Of Cloud-Based … · 2019-08-15 · Omar Alrawi*, Chaoshun Zuo*, Ruian Duan, Ranjita Pai Kasturi, Zhiqiang Lin, ... More Than What’s](https://reader033.fdocuments.us/reader033/viewer/2022043010/5f9ebfba621e4d196a2b62fd/html5/thumbnails/59.jpg)
Can I Fix Them?
Mobile App
Web App
Software Services
Operating System
(v)Hardware
![Page 60: The Betrayal At Cloud City: An Empirical Analysis Of Cloud-Based … · 2019-08-15 · Omar Alrawi*, Chaoshun Zuo*, Ruian Duan, Ranjita Pai Kasturi, Zhiqiang Lin, ... More Than What’s](https://reader033.fdocuments.us/reader033/viewer/2022043010/5f9ebfba621e4d196a2b62fd/html5/thumbnails/60.jpg)
Can I Fix Them?
Mobile App
Web App
Software Services
Operating System
(v)Hardware
Mel is responsible for this portion
Hybrid: If Mel uses a rented platform
![Page 61: The Betrayal At Cloud City: An Empirical Analysis Of Cloud-Based … · 2019-08-15 · Omar Alrawi*, Chaoshun Zuo*, Ruian Duan, Ranjita Pai Kasturi, Zhiqiang Lin, ... More Than What’s](https://reader033.fdocuments.us/reader033/viewer/2022043010/5f9ebfba621e4d196a2b62fd/html5/thumbnails/61.jpg)
Can I Fix Them?
Mobile App
Web App
Software Services
Operating System
(v)Hardware
Mel is responsible for this portion
Platform Provider is responsible for this portion
Rented!
Hybrid: If Mel uses a rented platform
![Page 62: The Betrayal At Cloud City: An Empirical Analysis Of Cloud-Based … · 2019-08-15 · Omar Alrawi*, Chaoshun Zuo*, Ruian Duan, Ranjita Pai Kasturi, Zhiqiang Lin, ... More Than What’s](https://reader033.fdocuments.us/reader033/viewer/2022043010/5f9ebfba621e4d196a2b62fd/html5/thumbnails/62.jpg)
How Do I Fix Them?
![Page 63: The Betrayal At Cloud City: An Empirical Analysis Of Cloud-Based … · 2019-08-15 · Omar Alrawi*, Chaoshun Zuo*, Ruian Duan, Ranjita Pai Kasturi, Zhiqiang Lin, ... More Than What’s](https://reader033.fdocuments.us/reader033/viewer/2022043010/5f9ebfba621e4d196a2b62fd/html5/thumbnails/63.jpg)
How Do I Fix Them?
![Page 64: The Betrayal At Cloud City: An Empirical Analysis Of Cloud-Based … · 2019-08-15 · Omar Alrawi*, Chaoshun Zuo*, Ruian Duan, Ranjita Pai Kasturi, Zhiqiang Lin, ... More Than What’s](https://reader033.fdocuments.us/reader033/viewer/2022043010/5f9ebfba621e4d196a2b62fd/html5/thumbnails/64.jpg)
How Do I Fix Them?Data
Aggregation and
Consolidation
![Page 65: The Betrayal At Cloud City: An Empirical Analysis Of Cloud-Based … · 2019-08-15 · Omar Alrawi*, Chaoshun Zuo*, Ruian Duan, Ranjita Pai Kasturi, Zhiqiang Lin, ... More Than What’s](https://reader033.fdocuments.us/reader033/viewer/2022043010/5f9ebfba621e4d196a2b62fd/html5/thumbnails/65.jpg)
How Do I Fix Them?Data
Aggregation and
Consolidation
![Page 66: The Betrayal At Cloud City: An Empirical Analysis Of Cloud-Based … · 2019-08-15 · Omar Alrawi*, Chaoshun Zuo*, Ruian Duan, Ranjita Pai Kasturi, Zhiqiang Lin, ... More Than What’s](https://reader033.fdocuments.us/reader033/viewer/2022043010/5f9ebfba621e4d196a2b62fd/html5/thumbnails/66.jpg)
How Do I Fix Them?Data
Aggregation and
Consolidation
![Page 67: The Betrayal At Cloud City: An Empirical Analysis Of Cloud-Based … · 2019-08-15 · Omar Alrawi*, Chaoshun Zuo*, Ruian Duan, Ranjita Pai Kasturi, Zhiqiang Lin, ... More Than What’s](https://reader033.fdocuments.us/reader033/viewer/2022043010/5f9ebfba621e4d196a2b62fd/html5/thumbnails/67.jpg)
How Do I Fix Them?Data
Aggregation and
Consolidation
![Page 68: The Betrayal At Cloud City: An Empirical Analysis Of Cloud-Based … · 2019-08-15 · Omar Alrawi*, Chaoshun Zuo*, Ruian Duan, Ranjita Pai Kasturi, Zhiqiang Lin, ... More Than What’s](https://reader033.fdocuments.us/reader033/viewer/2022043010/5f9ebfba621e4d196a2b62fd/html5/thumbnails/68.jpg)
Geo and Net Distribution
How can Mel be expected to solve everything?
![Page 69: The Betrayal At Cloud City: An Empirical Analysis Of Cloud-Based … · 2019-08-15 · Omar Alrawi*, Chaoshun Zuo*, Ruian Duan, Ranjita Pai Kasturi, Zhiqiang Lin, ... More Than What’s](https://reader033.fdocuments.us/reader033/viewer/2022043010/5f9ebfba621e4d196a2b62fd/html5/thumbnails/69.jpg)
Google Play Store
![Page 70: The Betrayal At Cloud City: An Empirical Analysis Of Cloud-Based … · 2019-08-15 · Omar Alrawi*, Chaoshun Zuo*, Ruian Duan, Ranjita Pai Kasturi, Zhiqiang Lin, ... More Than What’s](https://reader033.fdocuments.us/reader033/viewer/2022043010/5f9ebfba621e4d196a2b62fd/html5/thumbnails/70.jpg)
Google Play Store
• Top 5,000 apps from August 2018
![Page 71: The Betrayal At Cloud City: An Empirical Analysis Of Cloud-Based … · 2019-08-15 · Omar Alrawi*, Chaoshun Zuo*, Ruian Duan, Ranjita Pai Kasturi, Zhiqiang Lin, ... More Than What’s](https://reader033.fdocuments.us/reader033/viewer/2022043010/5f9ebfba621e4d196a2b62fd/html5/thumbnails/71.jpg)
Google Play Store
• Top 5,000 apps from August 2018
• We found
• Over 600 0-DAY
• Over 900 N-DAY
![Page 72: The Betrayal At Cloud City: An Empirical Analysis Of Cloud-Based … · 2019-08-15 · Omar Alrawi*, Chaoshun Zuo*, Ruian Duan, Ranjita Pai Kasturi, Zhiqiang Lin, ... More Than What’s](https://reader033.fdocuments.us/reader033/viewer/2022043010/5f9ebfba621e4d196a2b62fd/html5/thumbnails/72.jpg)
Google Play Store
• Top 5,000 apps from August 2018
• We found
• Over 600 0-DAY
• Over 900 N-DAY
Mobile App
Web App
Software Services
Operating System
(v)Hardware
![Page 73: The Betrayal At Cloud City: An Empirical Analysis Of Cloud-Based … · 2019-08-15 · Omar Alrawi*, Chaoshun Zuo*, Ruian Duan, Ranjita Pai Kasturi, Zhiqiang Lin, ... More Than What’s](https://reader033.fdocuments.us/reader033/viewer/2022043010/5f9ebfba621e4d196a2b62fd/html5/thumbnails/73.jpg)
Google Play Store
• Top 5,000 apps from August 2018
• We found
• Over 600 0-DAY
• Over 900 N-DAY
• 0-day vulnerabilities affect web apps
Mobile App
Web App
Software Services
Operating System
(v)Hardware
![Page 74: The Betrayal At Cloud City: An Empirical Analysis Of Cloud-Based … · 2019-08-15 · Omar Alrawi*, Chaoshun Zuo*, Ruian Duan, Ranjita Pai Kasturi, Zhiqiang Lin, ... More Than What’s](https://reader033.fdocuments.us/reader033/viewer/2022043010/5f9ebfba621e4d196a2b62fd/html5/thumbnails/74.jpg)
Google Play Store
• Top 5,000 apps from August 2018
• We found
• Over 600 0-DAY
• Over 900 N-DAY
• 0-day vulnerabilities affect web apps
• N-day affects software below the web apps
Mobile App
Web App
Software Services
Operating System
(v)Hardware
![Page 75: The Betrayal At Cloud City: An Empirical Analysis Of Cloud-Based … · 2019-08-15 · Omar Alrawi*, Chaoshun Zuo*, Ruian Duan, Ranjita Pai Kasturi, Zhiqiang Lin, ... More Than What’s](https://reader033.fdocuments.us/reader033/viewer/2022043010/5f9ebfba621e4d196a2b62fd/html5/thumbnails/75.jpg)
Overall Vulnerabilities
![Page 76: The Betrayal At Cloud City: An Empirical Analysis Of Cloud-Based … · 2019-08-15 · Omar Alrawi*, Chaoshun Zuo*, Ruian Duan, Ranjita Pai Kasturi, Zhiqiang Lin, ... More Than What’s](https://reader033.fdocuments.us/reader033/viewer/2022043010/5f9ebfba621e4d196a2b62fd/html5/thumbnails/76.jpg)
Overall Vulnerabilities
Over 1,600 Vulnerability Instances
![Page 77: The Betrayal At Cloud City: An Empirical Analysis Of Cloud-Based … · 2019-08-15 · Omar Alrawi*, Chaoshun Zuo*, Ruian Duan, Ranjita Pai Kasturi, Zhiqiang Lin, ... More Than What’s](https://reader033.fdocuments.us/reader033/viewer/2022043010/5f9ebfba621e4d196a2b62fd/html5/thumbnails/77.jpg)
Overall Vulnerabilities
![Page 78: The Betrayal At Cloud City: An Empirical Analysis Of Cloud-Based … · 2019-08-15 · Omar Alrawi*, Chaoshun Zuo*, Ruian Duan, Ranjita Pai Kasturi, Zhiqiang Lin, ... More Than What’s](https://reader033.fdocuments.us/reader033/viewer/2022043010/5f9ebfba621e4d196a2b62fd/html5/thumbnails/78.jpg)
Overall Vulnerabilities
Over 600 ZERO-DAYS!
![Page 79: The Betrayal At Cloud City: An Empirical Analysis Of Cloud-Based … · 2019-08-15 · Omar Alrawi*, Chaoshun Zuo*, Ruian Duan, Ranjita Pai Kasturi, Zhiqiang Lin, ... More Than What’s](https://reader033.fdocuments.us/reader033/viewer/2022043010/5f9ebfba621e4d196a2b62fd/html5/thumbnails/79.jpg)
Overall Vulnerabilities
![Page 80: The Betrayal At Cloud City: An Empirical Analysis Of Cloud-Based … · 2019-08-15 · Omar Alrawi*, Chaoshun Zuo*, Ruian Duan, Ranjita Pai Kasturi, Zhiqiang Lin, ... More Than What’s](https://reader033.fdocuments.us/reader033/viewer/2022043010/5f9ebfba621e4d196a2b62fd/html5/thumbnails/80.jpg)
Overall Vulnerabilities
Audited over 9,000 backends
![Page 81: The Betrayal At Cloud City: An Empirical Analysis Of Cloud-Based … · 2019-08-15 · Omar Alrawi*, Chaoshun Zuo*, Ruian Duan, Ranjita Pai Kasturi, Zhiqiang Lin, ... More Than What’s](https://reader033.fdocuments.us/reader033/viewer/2022043010/5f9ebfba621e4d196a2b62fd/html5/thumbnails/81.jpg)
Overall Vulnerabilities
![Page 82: The Betrayal At Cloud City: An Empirical Analysis Of Cloud-Based … · 2019-08-15 · Omar Alrawi*, Chaoshun Zuo*, Ruian Duan, Ranjita Pai Kasturi, Zhiqiang Lin, ... More Than What’s](https://reader033.fdocuments.us/reader033/viewer/2022043010/5f9ebfba621e4d196a2b62fd/html5/thumbnails/82.jpg)
Overall Vulnerabilities
Over 1,000 third-party backends.Used by multiple mobile apps!
![Page 83: The Betrayal At Cloud City: An Empirical Analysis Of Cloud-Based … · 2019-08-15 · Omar Alrawi*, Chaoshun Zuo*, Ruian Duan, Ranjita Pai Kasturi, Zhiqiang Lin, ... More Than What’s](https://reader033.fdocuments.us/reader033/viewer/2022043010/5f9ebfba621e4d196a2b62fd/html5/thumbnails/83.jpg)
Top Vulnerabilities
![Page 84: The Betrayal At Cloud City: An Empirical Analysis Of Cloud-Based … · 2019-08-15 · Omar Alrawi*, Chaoshun Zuo*, Ruian Duan, Ranjita Pai Kasturi, Zhiqiang Lin, ... More Than What’s](https://reader033.fdocuments.us/reader033/viewer/2022043010/5f9ebfba621e4d196a2b62fd/html5/thumbnails/84.jpg)
Top Vulnerabilities
![Page 85: The Betrayal At Cloud City: An Empirical Analysis Of Cloud-Based … · 2019-08-15 · Omar Alrawi*, Chaoshun Zuo*, Ruian Duan, Ranjita Pai Kasturi, Zhiqiang Lin, ... More Than What’s](https://reader033.fdocuments.us/reader033/viewer/2022043010/5f9ebfba621e4d196a2b62fd/html5/thumbnails/85.jpg)
Top Vulnerabilities
![Page 86: The Betrayal At Cloud City: An Empirical Analysis Of Cloud-Based … · 2019-08-15 · Omar Alrawi*, Chaoshun Zuo*, Ruian Duan, Ranjita Pai Kasturi, Zhiqiang Lin, ... More Than What’s](https://reader033.fdocuments.us/reader033/viewer/2022043010/5f9ebfba621e4d196a2b62fd/html5/thumbnails/86.jpg)
Top Vulnerabilities
![Page 87: The Betrayal At Cloud City: An Empirical Analysis Of Cloud-Based … · 2019-08-15 · Omar Alrawi*, Chaoshun Zuo*, Ruian Duan, Ranjita Pai Kasturi, Zhiqiang Lin, ... More Than What’s](https://reader033.fdocuments.us/reader033/viewer/2022043010/5f9ebfba621e4d196a2b62fd/html5/thumbnails/87.jpg)
Top Vulnerabilities
![Page 88: The Betrayal At Cloud City: An Empirical Analysis Of Cloud-Based … · 2019-08-15 · Omar Alrawi*, Chaoshun Zuo*, Ruian Duan, Ranjita Pai Kasturi, Zhiqiang Lin, ... More Than What’s](https://reader033.fdocuments.us/reader033/viewer/2022043010/5f9ebfba621e4d196a2b62fd/html5/thumbnails/88.jpg)
Top Vulnerabilities
![Page 89: The Betrayal At Cloud City: An Empirical Analysis Of Cloud-Based … · 2019-08-15 · Omar Alrawi*, Chaoshun Zuo*, Ruian Duan, Ranjita Pai Kasturi, Zhiqiang Lin, ... More Than What’s](https://reader033.fdocuments.us/reader033/viewer/2022043010/5f9ebfba621e4d196a2b62fd/html5/thumbnails/89.jpg)
Top Vulnerabilities
BEWARE: Can Install Malicious Apps Through Redirection
![Page 90: The Betrayal At Cloud City: An Empirical Analysis Of Cloud-Based … · 2019-08-15 · Omar Alrawi*, Chaoshun Zuo*, Ruian Duan, Ranjita Pai Kasturi, Zhiqiang Lin, ... More Than What’s](https://reader033.fdocuments.us/reader033/viewer/2022043010/5f9ebfba621e4d196a2b62fd/html5/thumbnails/90.jpg)
Top Vulnerabilities
![Page 91: The Betrayal At Cloud City: An Empirical Analysis Of Cloud-Based … · 2019-08-15 · Omar Alrawi*, Chaoshun Zuo*, Ruian Duan, Ranjita Pai Kasturi, Zhiqiang Lin, ... More Than What’s](https://reader033.fdocuments.us/reader033/viewer/2022043010/5f9ebfba621e4d196a2b62fd/html5/thumbnails/91.jpg)
Top Vulnerabilities
![Page 92: The Betrayal At Cloud City: An Empirical Analysis Of Cloud-Based … · 2019-08-15 · Omar Alrawi*, Chaoshun Zuo*, Ruian Duan, Ranjita Pai Kasturi, Zhiqiang Lin, ... More Than What’s](https://reader033.fdocuments.us/reader033/viewer/2022043010/5f9ebfba621e4d196a2b62fd/html5/thumbnails/92.jpg)
Top Zero-Day Vulnerabilities
![Page 93: The Betrayal At Cloud City: An Empirical Analysis Of Cloud-Based … · 2019-08-15 · Omar Alrawi*, Chaoshun Zuo*, Ruian Duan, Ranjita Pai Kasturi, Zhiqiang Lin, ... More Than What’s](https://reader033.fdocuments.us/reader033/viewer/2022043010/5f9ebfba621e4d196a2b62fd/html5/thumbnails/93.jpg)
Top Zero-Day Vulnerabilities
![Page 94: The Betrayal At Cloud City: An Empirical Analysis Of Cloud-Based … · 2019-08-15 · Omar Alrawi*, Chaoshun Zuo*, Ruian Duan, Ranjita Pai Kasturi, Zhiqiang Lin, ... More Than What’s](https://reader033.fdocuments.us/reader033/viewer/2022043010/5f9ebfba621e4d196a2b62fd/html5/thumbnails/94.jpg)
Top Zero-Day Vulnerabilities
![Page 95: The Betrayal At Cloud City: An Empirical Analysis Of Cloud-Based … · 2019-08-15 · Omar Alrawi*, Chaoshun Zuo*, Ruian Duan, Ranjita Pai Kasturi, Zhiqiang Lin, ... More Than What’s](https://reader033.fdocuments.us/reader033/viewer/2022043010/5f9ebfba621e4d196a2b62fd/html5/thumbnails/95.jpg)
https://MobileBackend.vet
![Page 96: The Betrayal At Cloud City: An Empirical Analysis Of Cloud-Based … · 2019-08-15 · Omar Alrawi*, Chaoshun Zuo*, Ruian Duan, Ranjita Pai Kasturi, Zhiqiang Lin, ... More Than What’s](https://reader033.fdocuments.us/reader033/viewer/2022043010/5f9ebfba621e4d196a2b62fd/html5/thumbnails/96.jpg)
What’s Next?
NOTIFICATION WORKING WITH 3RD
PARTY LIBRARIESIMPACT ON APP USERS
![Page 97: The Betrayal At Cloud City: An Empirical Analysis Of Cloud-Based … · 2019-08-15 · Omar Alrawi*, Chaoshun Zuo*, Ruian Duan, Ranjita Pai Kasturi, Zhiqiang Lin, ... More Than What’s](https://reader033.fdocuments.us/reader033/viewer/2022043010/5f9ebfba621e4d196a2b62fd/html5/thumbnails/97.jpg)
Related Work• Backes et al., “Reliable third-party library detection in android and its security applications,” ACM CCS, Oct.
2016.
• Arzt et al., “Flowdroid: Precise context, flow, field, object-sensitive and lifecycle-aware taint analysis for android apps,” ACM SIGPLAN PLDI, 2014.
• You et al., “Semfuzz: Semantics-based automatic generation of proof-of-concept exploits,” ACM CCS, 2017.
• Durumeric et al., “Zmap: Fast internet-wide scanning and its security applications.,” USENIX Security, 2013.
• Li et al., “You‘ve got vulnerability: Exploring effective vulnerability notifications,” USENIX Security, 2016.
• Durumeric et al., “The matter of heartbleed,” IMC, 2014
• Ristenpart et al., “Hey, you, get off of my cloud: Exploring information leakage in third-party compute clouds,” ACM CCS, 2009.
• Sun et al., “Pileus: Protecting user resources from vulnerable cloud services,” ACSAC, 2016.
• Durumeric et al., “Analysis of the https certificate ecosystem,” IMC, 2013.
• Fernandes et al., “Security analysis of emerging smart home applications,” IEEE S&P, May 2016.
![Page 99: The Betrayal At Cloud City: An Empirical Analysis Of Cloud-Based … · 2019-08-15 · Omar Alrawi*, Chaoshun Zuo*, Ruian Duan, Ranjita Pai Kasturi, Zhiqiang Lin, ... More Than What’s](https://reader033.fdocuments.us/reader033/viewer/2022043010/5f9ebfba621e4d196a2b62fd/html5/thumbnails/99.jpg)
Recommendation
• Delegate
• Use reputable 3rd party services
• Dedicate
• Time and personal to secure development
• Develop
• A plan to for incidents: backup data, backup providers, etc.
• Defense
• Use WAFs and CDNs PROPERLY!
![Page 100: The Betrayal At Cloud City: An Empirical Analysis Of Cloud-Based … · 2019-08-15 · Omar Alrawi*, Chaoshun Zuo*, Ruian Duan, Ranjita Pai Kasturi, Zhiqiang Lin, ... More Than What’s](https://reader033.fdocuments.us/reader033/viewer/2022043010/5f9ebfba621e4d196a2b62fd/html5/thumbnails/100.jpg)
Unknown Category
• Backend domains with different effective second-level domain
• Missing registration information
• Privacy WHOIS
• IP address show up as delegated
• IP address in collocation facility, but maybe hosting reseller
• CDNs fronted (can overcome with pDNS)