AppSec EU 2017 Combining The Security Risks Of Native And Web Development Hybrid Apps

### Overview This presentation examines the security implications of hybrid mobile applications, focusing specifically on Apache Cordova (also underlying technologies like Adobe PhoneGap and SAP Kapsel). Hybrid architectures allow developers to write web applications in HTML5 and JavaScript that are wrapped in a native WebView container (e.g., in Java for Android) and access platform-specific hardware via plugins. While this model promises "write once, run anywhere" efficiency, it bridges two distinct programming and security models, thereby compounding the vulnerabilities of web, native, and mobile ecosystems.

### Key Topics - **Empirical Findings in the Google Play Store**: The researchers analyzed Cordova usage across the Play Store, noting that hybrid apps make up about 5–6% of apps on average, with higher adoption in critical sectors such as business, finance, and medical apps. In an analysis of the top 1,000 apps, roughly 10% shipped components of Cordova, though only about half actually executed Cordova calls. An in-depth review of three SAP Kapsel apps revealed massive codebases (e.g., over 300,000 lines of JavaScript in one app) due to bundled web libraries, and uncovered an asymmetry where Java-to-JavaScript invocations occurred far more frequently than JavaScript-to-Java calls. Some apps even bridged three layers, invoking native C code via JNI for basic arithmetic. - **The JavaScript-to-Native Bridge**: The primary interaction mechanism in Cordova relies on execution methods (such as the bridge's `execute` method) and Android's `addJavascriptInterface`. Crossing this language boundary introduces translation complexities, asynchronous callbacks, and mismatched security assumptions between untyped JavaScript and native Java code. - **Compound Attack Surface**: Vulnerabilities from the web world translate directly into native risks. For instance, an unencrypted or injected advertisement iframe can access the exposed Cordova bridge, escalating a standard web injection into unauthorized native device access. Similarly, developers may fail to consider SQL injection at the JavaScript layer or cross-site scripting (XSS) at the native database query return layer.

### Technical Details & Framework Quirks - **Historical Reflection Flaws**: Early implementations of Android's `addJavascriptInterface` exposed unintended reflection methods to JavaScript, eventually prompting the requirement of explicit Java annotations to restrict exposed methods. - **Silent SSL Validation Disabling**: A major security issue in Cordova is tied to debug builds (e.g., using `cordova run android`). When the debug flag is enabled, Cordova silently ignores all HTTPS certificate errors. This design choice, debated heavily in the Cordova bug tracker as a feature versus bug, poses a serious risk if debug-configured applications are accidentally deployed to production. - **Static and Dynamic Analysis Approaches**: Traditional static application security testing (SAST) tools typically analyze languages in isolation and fail to trace data flows across native-to-web boundaries. Three approaches exist for hybrid SAST: full framework source analysis (ideal but impractical), framework modeling (modeling how the bridge connects layers, proven effective by the speakers' prototype), and interface/plugin modeling. When conducting penetration testing or dynamic analysis, teams must verify that native plugin code is completely removed—not merely the JavaScript wrapper—because an injected script can reconstruct missing JavaScript interfaces to call exposed native endpoints.

### Takeaways Securing hybrid mobile apps requires multi-domain expertise spanning secure web development (CSP, same-origin policy, iframe sandboxing), native secure coding (input validation, avoiding implicit trust of web layers), and platform-specific capabilities (Android permissions, mobile key stores). Developers must retire legacy OS support where feasible, remove custom cryptographic or key storage implementations in favor of platform-native keystores, enforce strict plugin whitelisting, verify that debug flags are disabled before production release, and monitor open-source dependencies via CVE databases.