Y9^kPUfZ9l7_k"
L@gkR87H7lċÓĩŅ©ĻÖ ĤxēŇmasahiro@asial.co.jp

2017Ñ2ÿ8ø
JSSEC L@gkR8]=qjd 20171

7H7lċÓĩĩďŊ• ĎŰ2002Ñ• ŖĄŠŰ1000r
• zĎâŰć|ŭĄĩŮFp]jpHJE• ØĎ¶ôŰĴ40¯ŭ8ºĳŮzĎÍ• ŢĦ_jPT]=qdzĎŰŢĦQqlUI]mqdoqA• ŢĦðîzĎŰ7_kŢĦFqZqF9UŭPHPŮŢĦ
• óľzĎŰTmqWpB½į

2

HTML5fZ9l7_kŢĦ¾Ĩ Monaca

HTML5mJavaScriptx¯¹fL

 ¤ ¯V|¸¥fLH

UI­»¿³½¿Onsen UI9a$3|=A\±¿¤3

fZ9lSZ9J"L@gkR84

7LPT − òï/È1'ÎŔŖĢ4äí15`IBQ`IjZKjZpsBQcZ)C¨ ¤½¿cBQ

¾¤5

SD¿¥^@rBQ´¿º¥»SMSbBQWebhW)C´¸:1BQ

jZ+

BluetoothcBQ
GPSBQ

5ŖĢ4È1

Þ¿ŖĢ

R!

ŖĢR!
T'ŀ

21

• òïĽ!.0Þ¿4§ĝ21• òïĽ!.0Þ¿4ñ521• òïĽ!.0Þ¿4Ŧ21
đĿŖĢŀ

21

• òïĽ!.0đĿ4ģ21

6

fZ9l7_k!

1Attack Surface¯¹¿·¾
¾¿
GPS

WiFi
BluetoothNFC­¸ ¶´µ¹­»¿³½¿/ ¸®¸¹[Y¢³¬¨
¼£¿
OSApplication

Web API Server

DB Server7Y9^kPU7_k#8Y9^kPU7_kűHTML5ůX9R8^¯¹A}HTML5x&UHTML¾¢¾¡¨¢®¿¥¨¢®¯¹0,xe*©¿¥BQJQ¯¸¾x¨¢®BQ8.

9

Cross PlatformQql"H;70%

10%

20%

30%

40%

50%

60%

70%

61%

PhoneGap/Cordova
35%

Xamarin
31%

Unity
18%

Qt

15%

Adobe Air
Appcelerator

13%

Corona12%
9%

Marmelade
Codename One

4%

Live Code3%
Using this tool

Prioritize this tool

Vision Mobile Analysis of Cross-Platform Development, July 201510

CordovaPhoneGap

Őġ!
byCordova´¯>q_pMqJ¤NqfL

PhoneGap#
Adobeĩ"_nOAT¯!

2009Ñ
Nitobiĩ PhoneGap4ŢĦ
>q_pMqJňµ2011Ñ
Adobeĩ Nitobiĩ4ŕ¨
PhoneGap#Cordova!

"ĹĉÂ "ĎCordovaŢĦ!§¡11¬<pNq_j9KMEAPMADP"E7fIgqlèģ









PhoneGap

MonacaIBM MobileFirst
Platform

SenchaSAP Mobile
Platform
MS Visual
Studio12

Cordova]mqdoqAŭiOS/AndroidŮ

¨
¢
®
A
PIAndroid
iOS

¨
¢
®
¼



À
ºª


HTML5CSSJavaScript

WebView
7_kCqHip[PCqI13

Cordova]mqdoqAŭWindows/Windows PhoneŮ

¸
¾

³A
PI
Windows
jpN9d(WinRT)

HTML5CSSJavaScript

Chakra + EdgeHTML
7_kCqHip[PCqI14

Y9^kPU7_k"L@gkR815

'2016 OWASP Mobile Top 10 Candidate
Improper Platform
UsageOSBQ¶¹¢|P|]JnAndroid¾¢¾¤«¿² ·¾|gdomKeychain|]Jzyn

Insecure DataStorage$Insecure
Communication©¾¥|gdooSSLª¿·¾|Jm>t

Insecure
Authentication[YInsufficient
Cryptography

_tInsecure
Authorization[Client Code Quality¿¥»°º|&Ulnª ­¿ª¿­¼¿<"Code Tamperingª¦¹­º|;u¹¿­º|

Reverse Engineeringª¦¹­ºp|¿¿¥2mJ¸®¸¹º¹³|7ExtraneousFunctionalityivª ¥|#m¹¹¿¯¹{ w}oszo´¾¤|Exzo£¿k|J6vzo£¿FDzyn
wozoczyn

G| ·¾OG|lzyn
~r£¿{(vwm%z>Jn

G|n¸¾¤¥x|[Gm/®¸¾zyn
G|gdozyn?mMz´µ¹|;uzynzyn

zyn

16

Y9^kPU7_k"L@gkR8áÜ

• XPToqAś¹ª¿¾
§¹¾

– WebView /ŭbqI"Œ)ř)
XHR"AjaxŮ– X9R8^ /ŭAndroid/iOSŮJavaScript{&U• WebView

WebView¨ ¤½¿c®¸¾
¾|S-4¯¸¾&U¯¸¾¨¢®X\{&U– ^j:G<pIp"ŁÔÝ

• CordovaĄ– Cordova"ŁÔÝ

• _jB9p– _jB9p"ŁÔÝ

Cordova• kZqJ<pIW7kpB– nIPA"ĚĖ-EqU"ñ5

7_kCqHip[PCqI• MqJEqU– MqJEqU"ŁÔÝ
17

XPToqAś!Î1L@gkR8fSl

18

XPToqAś!Î1L@gkR8fSl

Same-Origin Policy

Same-Origin Policy
Cordova Đęħ!ģ1iOS"UIWebView-Android"WebView#file://_nTEl
Origin  0Same-Origin Policy#ŝģ2 .Content-Security Policy"çË ÚŊ 1iOS 9 + Cordova iOS 4.0 /ģ 1WKWebView4ģ1À­WebView"u­ /Same-Origin Policy ŝģ21+FqZq!CORS`POq4~v1
ÚŊ 1

19XPToqAś!Î1L@gkR8fSl

Access OriginAllow Navigation

Access Origin
ŎË]69l(config.xmlŮ!ōŚ1ĂZqIip.0Æ»S]=lT# * ŭ'ŏªŮ "ĕß ÚŊ<video>NB-WebSocketİ#ť2
+Content Security Policy"ģ êÄ21
<access origin="http://example.com" /><access origin="*" />Allow Navigation
Cordova iOS/Android 4.0s!Ð2L@gkR8fSlAndroid#cordova-pluginwhitelist"Ð ÚŊŭS]=lTķ)ř)ėŮWebViewŞĬªĿ bqI4ť1
S]=lT#file:// /ŢÅ21ŭĭă!Æ»1ŮURL!V\DqHip4ŏª1
<allow-navigation href="http://example.com/*" />20

XPToqAś!Î1L@gkR8fSl

Content Security Policy

Content Security PolicyHTML!<meta>NB4ģōŚ1KitKatŭAndroid 4.4ŮŤÛCrosswalk4ģ1Android 4.0ŤÎÛªĿ.%iOS 7ŤÎ<meta http-equiv="Content-Security-Policy" content="default-src 'self' data: gap:
https://ssl.gstatic.com; style-src 'self' 'unsafe-inline'; media-src *">• gap://_nTElŭiOS"UIWebViewŮ .%https://ssl.gstatic.comŭAndroidÚŊŮ4ŏª• eval()ţô-9pj9pJAk_T4ĪĒ<meta http-equiv="Content-Security-Policy" content="default-src *; style-src 'self' 'unsafeinline'; script-src 'self' 'unsafe-inline' 'unsafe-eval'">• CSSJavaScript#®>kIp","4ŏª• eval()ţô9pj9pJAk_T,ŏª21

XPToqAś!Î1L@gkR8fSl

iOS Application Transport Security (ATS)iOS Application Transport Security (ATS)iOS"æL@gkR8¾ęÏĆħ!ŎË ÚŪ¤21yËATS Ā¢"À­HTTPś
#ŏª2TLS 1.2s ÚŪ
Cordova#<access>ŊĶ, #<allow-navigation>ŊĶ4çË1ATSŎË4ōŚ1Info.plist]69l sý 2ŎË ŝģ21
iOS 10Ť"çË!ÎÛ1+tō".!<access>ŊĶ

åÕ2

<access origin='*' allows-arbitrary-loads-in-media='true' allows-arbitrary-loads-inweb-content='true' allows-local-networking='true' />allows-arbitrary-loads-in-media• true"À­AV Foundation FrameworkĸĥŒ)ř*eS87!Îéĺť
allows-arbitrary-loads-in-web-content• true"À­WebView /Ń321kA<JT!ÎéĺťŌŦ21

ŌŦ21

allows-local-networking• true"À­nq?lXPToqA!1kMqJ!ÎéĺťŌŦ21
22

WebView"ŁÔÝ

23

WebView"ŁÔÝ

WebView"ŁÔÝł£7P_SqT Ń321iOSĔ'apOq"ÎÛ!Æ1Android#HJRdE
pcqXpT1WebView 7P_SqT2 ·ū 1Android 5 /#
WebView OS0Ũ2Google Play Store4śł£ħ!7P_SqT21.!
iOS .%Android OS"ZqIipH;7ŭ¬ĩWebF9T.0Ů
iPhone/iPad#ĔŗħJdqK!w{Ŝ* Android#Ĵ¥ô ZqIip4t
WebView!ŁÔÝ4æAndroid 4.3"H;7#ĜŬŭ20%Ů24

WebView"ŁÔÝ

WebView"ŁÔÝ&"ÎÛ

Chromium4WebViewģ

1.!FqU[qR8ňj9^jk1

Crosswalk<pIp47_k!ķ)ř* Android 4Ť^j:G<pIp4þö!


ªĿ

25

Cordova/_jB9p"ŁÔÝ

26

Cordova/_jB9p"ŁÔÝ

Cordova!ţ1ŁÔÝ"¿²

CVE-2015-5208
Apache Cordova iOS before 4.0.0 allows remote attackers to execute arbitrary plugins via a link.
CVE-2015-5207
Apache Cordova iOS before 4.0.0 might allow attackers to bypass a URL whitelist protection mechanism in an app and load
arbitrary resources by leveraging unspecified methods.
CVE-2015-5204
CRLF injection vulnerability in the Apache Cordova File Transfer Plugin (cordova-plugin-file-transfer) for Android before
1.3.0 allows remote attackers to inject arbitrary headers via CRLF sequences in the filename of an uploaded file.
CVE-2015-8320
Apache Cordova-Android before 3.7.0 improperly generates random values for BridgeSecret data, which makes it easier forattackers to conduct bridge hijacking attacks by predicting a value.
CVE-2015-5256
Apache Cordova-Android before 4.1.0, when an application relies on a remote server, improperly implements a JavaScript
whitelist protection mechanism, which allows attackers to bypass intended access restrictions via a crafted URI.

27

Cordova/_jB9p"ŁÔÝ

Google Play Store"ÎÛŁÔÝ"1Cordova ģ/21À­Google Play Store!ŢĒŃ321ğ»#Cordova Android 4.1.1
[PCqI#7P_nqUuª/2

Cordova"ŁÔÝ Ħġ1}×,ÎÛÚŊ! 1epRVpJ4õÚŊ 1Google Play Store"őùōz
https://support.google.com/faqs/answer/6325474?hl=ja28

Cordova/_jB9p"ŁÔÝ

kZqJ<pIW7kpB

Y9^kPU7_k"7LPT]69lŭHTML/JavaScriptİŮ#X9R8^EqU!Ep[9l2MqJEqU"Ğàĭă!Čĵ21ěģ ōŚ4Ŧ1+EepT"Ŧ-ũŒ¤ŭþŝ¤Ů4Ì÷1 ā(.0Ŝ5Îı#\lUú!ü«¤4ŃÌŃú!Ù«1FqU[qR8ň"ü«¤_jB9p4ģ1Ù«!@q#kfqTFqZqİ"É Àâ /©
0ÚŊ 1Monaca!ì217LPTü«¤_jB9p
https://ja.monaca.io/enterprise.html

29

Cordova/_jB9p"ŁÔÝ

uŊ_jB9p"Ŧ¦Cordova°7_kRp_mqT"Â

Cordova Core Plugins³$21¾Ą_jB9p4'®č1Ìŧ!#ģ
1ªĿÝ

EqU±(2(ŁÔÝ"ĘÒ!

1
PhoneGap"WebF9T!ëŘ2622
"7_k!Î"œĊŭ2014ÑŮ#_jB9p"ķ)ř)Ìŧ"ģ!Ã
Ţ

ŋ/21

Mohamed Shehab et. al, Reducing Attack Surface on Cordova-Based
Hybrid Mobile Apps, MobileDeLi 201430

L@g7EqS8pB

31

L@g7EqS8pB

EqS9pB"çš

Cordova7_k"Ã¥#SPA¼0fZ9lWebF9TĔ',JavaScript":;9TŬL@g7EqS8pBÎı#HTML5°"_jAR8J4ŝģ• hqGq• ŝ

1

SqN"ZkSqHip<JCq_Ġ• JavaScript9pI;AHip"¸ş• API@q"ŝĲĠ

32

L@g7EqS8pB<JCq_Ġ

EpR@JT!Û<JCq_ĠÚŊ1 ŝōŚ4Ń"#¹ũSPA]mqdoqA-Rp_mqT<pIp"èģā(<JCq_Ġ4łÌņ1"#¹ũ1+

Z9pS8pB4FcqT1]mqdoqA]mqdoqA4èģ1-j9^jkā(tō"#'"Áô!"<JCq_ĠÚŊ<div onmouseover="${data1}">${data2}</div><a href="${data3}">link</a><iframe srcdoc="${data4}"></iframe>
Nishimura Muneaki et al, Y9^kPU7_kCqHip"ŁÔÝ!ţ1Ĉ 20152-Way Binding4æ,"• Angular 1• Angular 2
1-Way Binding4æ,"• React
Rp_mqT<pIp• Handlebars• Mustache33§ļÞ¿U@gepTİ• CordovaU@gepT– Security Guide– Whitelist Guide• OWASP HTML5 Security Cheat Sheet• Y9^kPU7_kCqHip"ŁÔÝ!ţ1Ĉ– ŉąÊû et al, Į14¸Þ¿īÇãń]=qjdŭ2014Ů340(·­3Ű
7H7lċÓĩ ĤxēŇmasahiro@asial.co.jp

35