Currently, Application Programming Interfaces (APIs) are becoming increasingly popular to facilitate data transfer in a variety of mobile applications. These APIs often process sensitive user information through their endpoints, which are potentially exploitable due to developer misimplementation. In this paper, a custom, modular endpoint vulnerability detection tool was created and implemented to present current statistics on the degree of information leakage in various mobile Android applications. Our endpoint vulnerability detection tool provided an automated approach to API testing, programmatically modifying requests multiple times using specific information attack methods (IAMs) and heuristically analyzing responses for potentially vulnerable endpoints (PVEs). After analysis of API requests in an encompassing range of applications, findings showed that easily exploitable Broken Access Control (BAC) vulnerabilities of varying severity were common in over 50% of applications. These vulnerabilities ranged from small data leakages due to unintended API use, to full disclosure of sensitive user data, including passwords, names, addresses, and SSNs. This investigation aims to demonstrate the necessity of complete API endpoint security within Android applications, as well as provide an open source example of a modular program which developers could use to test for endpoint vulnerabilities.

翻译：当前，应用程序编程接口（API）在各类移动应用中日益普及，用于促进数据传输。这些API常通过其端点处理敏感用户信息，而由于开发者实施不当，这些端点可能存在被利用的风险。本文创建并实现了一款定制的模块化端点漏洞检测工具，以呈现多种移动Android应用中信息泄露程度的当前统计数据。我们的端点漏洞检测工具提供了一种API测试的自动化方法，通过使用特定信息攻击方法程序化地多次修改请求，并基于启发式分析响应以识别潜在易受攻击端点。在对广泛范围内的应用进行API请求分析后，研究发现，易于利用的各类严重程度的访问控制漏洞在超过50%的应用中普遍存在。这些漏洞范围从因API非预期使用导致的小规模数据泄露，到敏感用户数据的完全披露，包括密码、姓名、地址及社会安全号码。本研究旨在证明Android应用中完整的API端点安全性的必要性，并提供一个开源模块化程序示例，开发者可利用该程序测试端点漏洞。