  Android allows apps to communicate with its system services via system
service helpers so that these apps can use various functions provided by the
system services. Meanwhile, the system services rely on their service helpers
to enforce security checks for protection. Unfortunately, the security checks
in the service helpers may be bypassed via directly exploiting the non-SDK
(hidden) APIs, degrading the stability and posing severe security threats such
as privilege escalation, automatic function execution without users'
interactions, crashes, and DoS attacks. Google has proposed various approaches
to address this problem, e.g., case-by-case fixing the bugs or even proposing a
blacklist to block all the non-SDK APIs. However, the developers can still
figure out new ways of exploiting these hidden APIs to evade the non-SDKs
restrictions.
  In this paper, we systematically study the vulnerabilities due to the hidden
API exploitation and analyze the effectiveness of Google's countermeasures. We
aim to answer if there are still vulnerable hidden APIs that can be exploited
in the newest Android 12. We develop a static analysis tool called ServiceAudit
to automatically mine the inconsistent security enforcement between service
helper classes and the hidden service APIs. We apply ServiceAudit to Android
6~12. Our tool discovers 112 vulnerabilities in Android 6 with higher precision
than existing approaches. Moreover, in Android 11 and 12, we identify more than
25 hidden APIs with inconsistent protections; however, only one of the
vulnerable APIs can lead to severe security problems in Android 11, and none of
them work on Android 12.
