On the WebView addJavascriptInterface Saga
In the last month, several new facts （機の）カム to light in the saga of 安全 問題／発行するs with using addJavascriptInterface in Android WebView 反対するs. While the dangers associated with this method are 井戸／弁護士席 文書d, the 十分な extent and reach of associated 問題／発行するs was not known until recently. These 問題／発行するs continue to be a 疫病／悩ます on the 安全 of the Android ecosystem to this day.
We decided to 令状 this 地位，任命する for many different 推論する／理由s. First, we want to 始める，決める the facts straight. The interactions 伴う／関わるing this method and the 安全 問題／発行するs that result from it are コンビナート／複合体. Understandably, some published articles 含む／封じ込める technically inaccuracies. Second, we have been doing more 実験（する）ing and think that some of the 実験（する） results are 利益／興味ing. Finally, we want to make some 推薦s to さまざまな parties within the ecosystem and 文書 open questions in and 未来 directions for our 研究.
It’s important to 公式文書，認める that this 地位，任命する does not discuss a number of other important Android 安全 問題／発行するs. Many egregious privacy 漏れるs 茎・取り除く from Android 使用／適用s and advertising SDKs. 在庫／株 and third party browsers are often 攻撃を受けやすい to 公然と 公表する／暴露するd vulnerabilities. There are other 安全 問題／発行するs that can 茎・取り除く from using addJavascriptInterface too. These topics are not covered in this 地位，任命する, but deserve attention too.
NOTE: This 地位，任命する ballooned 意味ありげに. As such, we will be working to publish more 詳細（に述べる）s in the 未来.
Background
In this section, you will learn about the different 科学（工学）技術s and paradigms that come together to create the 問題／発行するs that are the topic of this 地位，任命する. This 含むs introductions to ソフトウェア 扱うing on Android, the 攻撃を受けやすい API, and important 所有物／資産／財産s of these vulnerabilities.
ソフトウェア on Android
ソフトウェア on Android 装置s consists of firmware and 使用／適用s. Each type of ソフトウェア are 見解／翻訳／版d, 分配するd, and updated using different 機械装置s.
The firmware for a particular 装置 is built by the party 責任がある 持続するing the 装置. The firmware is put の上に the 装置 by that party and later updates (経由で OTA usually) must go through that party 同様に. In 新規加入 to the Android 見解／翻訳／版, OEMs and 運送／保菌者s have their own 見解／翻訳／版ing 計画／陰謀s. This part of the Android ソフトウェア update 過程 is discussed in depth どこかよそで, so we won’t (a)手の込んだ／(v)詳述する その上の.
使用／適用s are either 分配するd as part of the firmware or 経由で Google Play. In both 事例／患者s, the 使用／適用s can be updated 直接／まっすぐに by the vendor 経由で Google Play. 使用／適用s are 見解／翻訳／版d by their 各々の vendors.
In 新規加入 to the Android 見解／翻訳／版, Google uses a 見解／翻訳／版ing 機械装置 to 示す the 正確な availability and 行為 of 反対するs and methods. These 反対するs and methods 構成する the developer API, and hence this 見解／翻訳／版 is called the API level. As the API levels have 増加するd, many changes have been made. The developer documentation 含む／封じ込めるs lots of 公式文書，認めるs about changes throughout the 進化 of Android.
使用／適用 developers choose which API level they use for their 使用／適用 at 収集する time. When a new API level is 解放（する）d, developers don’t have to do anything unless they want to take advantage of functionality from the new API. That is, app developers are 解放する／自由な to select an older API level when they build their 使用／適用. Google has tried to dissuade this practice in newer 見解／翻訳／版s of the SDK by printing 警告s at 収集する time. Also, Google created Google Play Services to 緩和する some of the 苦痛 原因（となる）d by API 進化. However, no technical 障壁 妨げるs using older API levels. In fact, some developers do this 故意に as a way to maximize 装置 compatibility. Once an 使用／適用 is built against a particular API level, it cannot be changed without recompiling and redeploying.
WebViews and addJavascriptInterface
In Android, many browsers web-based 動きやすい 使用／適用s rely on the WebView 構成要素. The documentation for this 構成要素 is pretty good, so check it out if you want to fully understand it’s 目的 and usage. 十分である to say that it’s a part of the Android 枠組み that 供給するs a working, embeddable Web browser. On 見解／翻訳／版s 事前の to Android KitKat (4.4) it’s based on the WebKit engine. With KitKat and later, it’s based on Chromium. It doesn’t 含む the UI 部分 which is also referred to as “the chrome” (not to be 混乱させるd with the Chrome browser).
The addJavascriptInterface method is one of the ways that developers that embed a WebView into their 使用／適用 (含むing people that build browsers) to expose Java functionality to Javascript. It has 存在するd since the first 解放（する） of Android (API level 1). It 供給するs a method to 達成する synchronous (meaning Javascript waits for a 返答) communication with the hosting 使用／適用. There’s plenty of 資源s showing how to use this functionality out there, so we won’t go into その上の 詳細（に述べる） here. For a more high-level explanation, see the Our findings make uncomfortable reading section of Dave Hartley’s article on the MWR blog.
安全 問題／発行するs
多重の 安全 問題／発行するs 存在する 伴う／関わるing the addJavascriptInterface method of Android WebView 反対するs. Several 問題／発行するs 伴う／関わる 使用／適用s that expose an 反対する to untrusted Javascript within a WebView using the 攻撃を受けやすい API. Another 問題／発行する, on which the 開発／利用 of the aforementioned 問題／発行するs rely, is that untrusted Javascript can 遂行する／発効させる 独断的な Java code (and thus 爆撃する 命令（する）s and native code). More 詳細（に述べる）s about these 問題／発行するs are 現在のd in the に引き続いて sections. The important point to understand here is that this is not just one 問題／発行する. There are 多重の, interrelated vulnerabilities.
In all 事例／患者s, 偉業／利用するing 攻撃を受けやすい apps gives an 攻撃者 the 特権s of the app itself. However, wide public availability of 特権 escalation 偉業／利用するs for Android 装置s can lead to a 十分な 装置 妥協.
Attack Vectors
Each vulnerability can be 偉業／利用するd 経由で one or more attack vectors. 正確に／まさに which attack vectors 許す 開発／利用 depends on the 状況 in which the 影響する／感情d WebView is used. That is, it depends where untrusted Javascript comes from. From our point of 見解（をとる） they break 負かす／撃墜する into the に引き続いて 部類s:
- URL-based attack vectors such as sending a URL 経由で email, IM, SMS, etc.
- Malicious 宣伝s (aka Malvertising)
- 注入するing an 偉業／利用する into a 妥協d 信用d 場所／位置 (e.g. a watering 穴を開ける attack)
- Man in the Middle attacks (MitM) such as DNS ハイジャック, rogue AP/BTS, etc.
- 地元の attacks against Javascript （武器などの）隠匿場所d on 外部の 貯蔵 (SD card)
The most 厳しい 問題／発行するs can be 偉業／利用するd in all シナリオs while わずかに いっそう少なく 厳しい can only be 偉業／利用するd 経由で a subset.
New 開発s
支援する in September 2013, jduck developed a Metasploit 偉業／利用する module called addjsif that 的s 攻撃を受けやすい uses of addJavascriptInterface within advertising SDKs. He created this 偉業／利用する in hopes that having it in Metasploit would bring 付加 attention and visibility to the 真面目さ of these 問題／発行するs. It is 特に designed to be used as a MitM proxy server that will 注入する its payload into passing traffic. The addjsif 事業／計画（する）’s README 文書s how 行政官／管理者s can 始める，決める up and use the 偉業／利用する to 実験（する） 装置s on their 網状組織s.
While 実験（する）ing his module, jduck 首尾よく 偉業／利用するd the wildly popular Fruit Ninja and Angry Birds games 任命する／導入するd on a Nexus 4 running Android 4.3 (!!). He also 研究d the 指名するs of other 反対するs exposed 経由で addJavascriptInterface and embedded their 指名するs into the module.
The 決定／判定勝ち（する） to open source jduck’s 偉業／利用する module at the end of January 2014 始める，決める in 動議 the sequence of events 主要な to this 地位，任命する. Though MWR Labs published an 偉業／利用する in December 2013, their Drozer 道具 簡単に doesn’t have as large of 使用者 base as Metasploit does. The 初めの goal stood and so the module was 解放（する）d 公然と.
Starting in 早期に February, the Metasploit engineers took jduck’s work and started looking to 統合する it into their 侵入／浸透 実験（する）ing 枠組み. Some of their 成果／努力s are 文書d in the pull request 始めるd to 合併する it. As seen in description of the pull request, Rapid7’s Joe Vennix discovered that after minor modifications jduck’s 偉業／利用する module was able to remotely 遂行する／発効させる 独断的な code on older 見解／翻訳／版s of the 在庫／株 Android Browser app. This was news to us, as it hadn’t 以前 been 報告（する）／憶測d 公然と by anyone (含むing Google!).
その上の 実験（する）ing by Tim Wright showed that the 偉業／利用する also 作品 on the 現在の 見解／翻訳／版 of Google Glass (XE12 as of this 令状ing). Even worse, an 偉業／利用するd Google Glass browser 産する／生じるs camera 許可s. That’s 権利. This 偉業／利用する 許すs an 攻撃者 to see whatever someone who is wearing Google Glass sees. On 最高の，を越す of that, several 公然と 利用できる 偉業／利用するs are 有能な of 伸び（る）ing root 特権s on a Google Glass 装置. These facts 連合させるd should 原因（となる） やめる a 関心 for 早期に adopters of this exorbitantly 定価つきの gadget.
に引き続いて these events, another マスコミ blitz 続いて起こるd with many articles （人命などを）奪う，主張するing that 70% of Android 装置s are 攻撃を受けやすい to this particular 偉業／利用する. A 非常に長い discussion on a 地位，任命する to the /r/Android sub-reddit had us defending our 研究 against vehement 対抗者s. Truth be told, the 70% number （機の）カム from an 仮定／引き受けること that all 装置s 事前の to Android 4.2 were 影響する／感情d. We had 実験（する）d against only a handful of 装置s at that point and thus decided to do some more 徹底的な 実験（する）ing against the 在庫／株 browser of さまざまな 装置s.
First, jduck 始める，決める out to create a simple and 安全な 実験（する） page that would （悪事，秘密などを）発見する whether or not the WebView in which it was 負担d was 攻撃を受けやすい. The Rapid7/Metasploit team 補助装置d in 組織するing some （人が）群がる-sourced 実験（する）ing on Twitter while he 実験（する）d against the droidsec droid army. Each of jduck’s 装置s run 在庫／株 firmware (in most 事例／患者s the 最新の 利用できる), so the 実験（する）s are a decent 見本ing of the over all 装置 pool. その上の, Joe Vennix ran some 実験（する）s against one of the public 実験（する）ing services to see how their 装置s fared. The results of this 一連の会議、交渉／完成する of 実験（する）ing were やめる 利益／興味ing and several new facts were 暴露するd.
重要な Findings
Through our 実験（する）ing, we have discovered several important facts 価値（がある） discussing. The 重要な findings are:
-
早期に 実験（する）ing with 広告-supported apps 明らかにする／漏らすd that even 現在の and fully up-to-date 装置s can be 首尾よく 偉業／利用するd in 明確な／細部 circumstances. 使用／適用s that (1) insecurely use addJavascriptInterface to （判決などを）下す untrusted content and (2) are 収集するd against an API level いっそう少なく than 17 remain 攻撃を受けやすい. The popular apps 実験（する）d are only two such apps; it’s likely that many many more 存在する. This 問題／発行する was 割り当てるd CVE-2012-6636.
-
More 最近の 実験（する）ing 明らかにする／漏らすd that 確かな 見解／翻訳／版s of 在庫／株 browsers, 含むing AOSP, are also 攻撃を受けやすい. This 問題／発行する is 予定 to insecure use of addJavascriptInterface 伴う／関わるing the searchBoxJavaBridge_ 反対する. Digging in deeper we discovered 正確に／まさに when the 攻撃を受けやすい 反対する was introduced (9497c5f in Android 4.0) and 除去するd (d773ca8 and 0e9292b in Android 4.2) within AOSP code. It was 割り当てるd CVE-2014-1939 per our request.
-
Some 装置s using 見解／翻訳／版s of Android within the 影響する／感情d 範囲 (4.0 < x < 4.2) were not 攻撃を受けやすい. This 示すs that OEMs/運送／保菌者s 支援する-ported the patch to their firmware somewhere along the way. It’s possible (maybe even likely) that Google 通知するd these partners of the 問題／発行する to 刺激（する） movement without 通知するing the general public. 決定するing the entirety of 攻撃を受けやすい 装置 + firmware combinations remains an open problem (and one that we are 活発に 捜し出すing to 演説（する）／住所).
-
An 付加 insecurely exposed 反対する was 設立する within 確かな HTC 装置 firmware 見解／翻訳／版s. In particular, 実験（する）ing against the One V and One X+ on Android 4.0.3 and 4.1.1 showed that an 反対する called HTMLOUT was exposed. Interestingly, this is the exact 指名する of an 反対する that was discussed in a blog by Aleksander Kmetec in 2009. (NOTE: A quick search while 令状ing this 地位，任命する turned up this （a）忠告の／（n）警報 on WooYun. We don’t believe a CVE has been 割り当てるd yet.)
-
確かな 見解／翻訳／版s of third-party browsers are also 攻撃を受けやすい. In particular, 確かな 見解／翻訳／版s of the イルカ Browser 実験（する）d 攻撃を受けやすい. Unfortunately, the exact 見解／翻訳／版 and 名簿（に載せる）／表（にあげる） of exposed 反対するs are not 利用できる.
にもかかわらず the fact that these 問題／発行するs have 存在するd for years, several of these findings have only come to light in the last month. These 問題／発行するs are important and need more attention. The next section 供給するs some suggestions about what さまざまな parties in the Android ecosystem can do to help.
Suggestions
These 問題／発行するs have not been holistically 演説（する）／住所d. Thankfully, there are a number of things that さまざまな groups within the Android ecosystem can do to 改善する the 状況／情勢. Without 介入 or 援助 from Android vendors, we are 大部分は left to our own 装置 to 保護する ourselves and our 使用者s.
That leads to the first, and most important, 推薦 for everyone in the ecosystem. Communication is 重要な. We as a community need to spread the word about what brings these 問題／発行するs about, how to 避ける them, how to 位置を示す and 直す／買収する，八百長をする instances of them, and so on. Please do your part to help make the Android ecosystem a more 安全な・保証する place.
Google - You took a 肯定的な step when you made that 安全 enhancement in Android 4.2. However, the 初めの “直す／買収する，八百長をする” and messaging surrounding it leave much to be 願望（する）d.
On the messaging 味方する, that 地位，任命する 代表するs a 行方不明になるd 適切な時期 to 伝える the 真面目さ of the 事柄. You could have 堅固に recommended 的ing apps that depend on addJavascriptInterface to the 最新の API level. You could have 繰り返し言うd the 危険，危なくする of improperly using this API. Unfortunately, you 選ぶd to only casually explain the change as an enhancement.
On the “直す／買収する，八百長をする” 味方する, a more 積極的な approach would be far more 効果的な. Had you taken such an approach, you might not be reading this 地位，任命する. Because of the approach you chose, developers can still build, and are still building, 攻撃を受けやすい apps today. These apps can even be 偉業／利用するd on the most up-to-date 装置s. These are serious vulnerabilities and they should be given the 尊敬（する）・点 and 緊急 that they deserve. We 嘆願d with you to take more 積極的な 活動／戦闘s to 治療（薬） this blight.
OEMs and 運送／保菌者s - Some of you have done a good thing by 支援する-porting the 直す／買収する，八百長をする to older firmwares. That’s 広大な／多数の／重要な for the 装置s that did get updated, but that leaves 使用者s of older 装置s exposed. We dream of a day when you don’t leave anyone behind. The time from a 安全 直す／買収する，八百長をする to it 存在 on 使用者s’ 装置s really should be on the order of days, not months or weeks. We implore you to find ways to continue to 改善する this 過程.
App Developers - If you’re 現在／一般に 分配するing a 攻撃を受けやすい app/SDK, please take 即座の steps to 訂正する the 問題／発行する and get an update （軍隊を）展開する，配備するd. If possible, 避ける using addJavascriptInterface at all. If you must use it, 的 your app/SDK to API level 17 or higher. If you’re making an SDK, consider 軍隊ing your 使用者s to use API level 17 or higher. If you must have a synchronous 関係 to Java-land, consider using shouldAllowURLOverriding to 無視／無効 onJsAlert or onJsPrompt. App developers need to go the extra mile to be sure they are not 含むing advertising SDKs that put 使用者s at 危険. Finally, use the best practices (HTTPS and 証明書 pinning) to help keep your WebView content 信頼できる in the 直面する of MitM attacks.
研究員s - Join us in doing 付加 研究, 実験（する）ing, and 報告（する）／憶測ing so that we can 除去する these dangerous 問題／発行するs. Help discover 正確に／まさに which 装置s and/or apps that are out there are 攻撃を受けやすい. 捜し出す out 付加 危険な uses of addJavascriptInterface and 報告（する）／憶測 your findings. It’s my understanding that finding such a thing will 勝利，勝つ you a shiny CVE. The 名簿（に載せる）／表（にあげる） in the addjsif MSF module might even be a good starting place. Work with 攻撃を受けやすい 装置/app vendors to get the 問題／発行するs 直す／買収する，八百長をするd. Start 対話s with your 顧客s in the 動きやすい space to raise 認識／意識性. Finally, you can help 保護する 使用者s by creating third-party 解答s!
使用者s - The 安全 and privacy of your 装置 is 最終的に in your 手渡すs. Keep your 注目する，もくろむs and ears open for （警察などへの）密告，告訴（状） about 攻撃を受けやすい apps. Don’t connect to 潜在的に malicious Wi-Fi 接近 points. 除去する 攻撃を受けやすい apps from your 装置 until they can be updated. Give 1-星／主役にする ratings to 攻撃を受けやすい apps. As a 警戒, play 広告-supported games in airplane 方式. 支払う／賃金 for your apps so that advertising 網状組織 code is never 活動させる／戦時編成するd.
未来 Work / Open Questions
While putting together this 研究 we have identified a number of gaps and 優れた questions. We have 付加 詳細（に述べる）s that we 計画（する） to publish in the coming days and weeks. Ideas for 未来 work 含む:
-
More 実験（する）ing - Our 実験（する） results are 公正に／かなり 限られた／立憲的な. We’d like to solicit more high 質 実験（する） results from the community 捕まらないで. We’re thinking of the best way to enable this 実験（する）ing, but for now に引き続いて the directions on the 実験（する） page would help.
-
More 装置s - Our 実験（する） bed is 公正に／かなり small. We’d love to 追加する more 装置s, and have 追加するd a 嘆願 for 装置s to our 寄付 page.
-
More 統計（学） - 抽出するing 統計（学） from app markets is very 資源 集中的な. 決定するing which apps use addJavascriptInterface insecurely 要求するs looking at each app 個々に, かもしれない even 多重の 見解／翻訳／版s of each.
-
More 研究 - Our 実験（する）s looking into whether or not 収集するing a library for Android apps 原因（となる）s apps that use that library to be 攻撃を受けやすい were 十分な説得力のない. Do they build against a particular API level? Can they use a different API level than the app they are 含むd in? These are questions we’d like to answer.
There’s more than enough for us to do. We would love your help!
結論
This 地位，任命する 文書s some history and our 最新の findings in our 現在進行中の 研究 of the WebView addJavascriptInterface vulnerability saga. Though these 問題／発行するs have received a 広大な／多数の／重要な 取引，協定 of attention in the 圧力（をかける）, most 使用者s remain 攻撃を受けやすい. The 最新の articles 焦点（を合わせる） on the new 発見s that some 在庫／株 browsers are 攻撃を受けやすい. However, they fail to explain the 十分な 危険. Once an 攻撃者 伸び（る）s 接近, a variety of 公然と 利用できる 偉業／利用するs 許す them to fully 妥協 the 装置. Most importantly, 使用／適用 developers often still expose 使用者s’ 装置s by insecurely using addJavascriptInterface. These 問題／発行するs can be 偉業／利用するd, even on a fully updated and 現在の 装置 (such as a Nexus 5 - 実験（する）d today with Fruit Ninja).
The perilous 状況／情勢 of more than 51% of the Android 装置 pool running woefully outdated ソフトウェア remains. As について言及するd 以前, many of the 実験（する）d 装置s are fully updated to their 最新の 在庫／株 firmware. In our 実験（する）ing of 44 装置s, 13 were running browsers in the 攻撃を受けやすい 見解／翻訳／版 範囲. Of those, 6 had a 攻撃を受けやすい 在庫／株 browser. Extrapolating these numbers out 正確に is impossible without the exact numbers of each 装置/firmware combination, but a fair estimation is something like 25 パーセント (46% of 51%). This is much いっそう少なく than the 70% 引用するd in many articles, but also doesn’t take into account the other 問題／発行するs surrounding this method (which are much larger 問題／発行するs).
In の近くにing, there is much to do before this saga will end. We’ve 供給するd some 推薦s for さまざまな parties in the ecosystem and hope that they will not 落ちる on deaf ears. That said, we’re not naive. We 認める that there are many challenges on the road ahead of us. Through our 率先s we hope to 打ち勝つ these 問題／発行するs and 勧める Android 安全 into a new 時代.
Be 安全な out there!