  Cross-app collaboration via inter-component communication is a fundamental
mechanism on Android. Although it brings the benefits such as functionality
reuse and data sharing, a threat called component hijacking is also introduced.
By hijacking a vulnerable component in victim apps, an attack app can escalate
its privilege for operations originally prohibited. Many prior studies have
been performed to understand and mitigate this issue, but no defense is being
deployed in the wild, largely due to the deployment difficulties and
performance concerns. In this paper we present SCLib, a secure component
library that performs in-app mandatory access control on behalf of app
components. It does not require firmware modification or app repackaging as in
previous works. The library-based nature also makes SCLib more accessible to
app developers, and enables them produce secure components in the first place
over fragmented Android devices. As a proof of concept, we design six mandatory
policies and overcome unique implementation challenges to mitigate attacks
originated from both system weaknesses and common developer mistakes. Our
evaluation using ten high-profile open source apps shows that SCLib can protect
their 35 risky components with negligible code footprint (less than 0.3% stub
code) and nearly no slowdown to normal intra-app communications. The worst-case
performance overhead to stop attacks is about 5%.
