Identifying Inter-Component Communication Vulnerabilities in Event-based Systems

Event based systems are flexible, scalable, and adaptable based on its feature of non-determinism in event communication. However, this may yield security vulnerabilities in event communication between components. For example, malicious components can steal sensitive data or manipulate other components in an intended way. This paper introduces SCUTUM, a novel technique that automatically detects vulnerable event communication channels from event-based systems by combining static flow analysis and pattern matching. SCUTUM’s evaluation demonstrated that it identifies vulnerable event communication channels with higher accuracy than existing techniques from 28 real-world apps and it is applicable to the apps comprising a number of components.