Hooking Java methods and native functions to enhance Android applications security

Mobile devices are becoming the main end-user platform to access the Internet. Therefore, hackers’ interest for fraudulent mobile applications is now higher than ever. Most of the times, static analysis is not enough to detect the application hidden malicious code. For this reason, we design and implement a security library for Android applications exploiting the hooking of Java and native functions to enable runtime analysis. The library verifies if the application shows compliance to some of the most important security protocols and it tries to detect unwanted activities. Testing of the library shows that it successfully intercepts the targeted functions, thus allowing to block the application malicious behaviour. We also assess the feasibility of an automatic tool that uses reverse engineering to decompile the application, inject our library and recompile the security-enhanced application.