TipTracer: Detecting Android Application Vulnerabilities Based on the Compliance with Security Guidance

被引：0
|
作者：
Zhang L. [1 ]
Yang Z. [1 ]
Li M. [1 ]
Yang M. [1 ]
机构：
[1] Software School, Fudan University, Shanghai
来源：
Jisuanji Yanjiu yu Fazhan/Computer Research and Development | 2019年 / 56卷 / 11期
基金：
中国国家自然科学基金;
关键词：
Android apps; Android security tips; Security property language; Static code analyzer; Vulnerability detection;
D O I：
10.7544/issn1000-1239.2019.20190348
中图分类号：
学科分类号：
摘要：
Many security vulnerabilities are caused by the unsafe use of library programming interfaces. To protect applications from security attacks, library designers provide security tips to help developers use security-sensitive APIs correctly. However, developers often fail to follow security tips, which can introduce vulnerabilities to their programs. To evaluate the scale and impact of this problem, we conduct the first systematic, large-scale study on security tips and their violations in Android apps. Our study shows that existing security tips are less effective, due to their imprecise descriptions, misleading sample code, incorrect default settings, fragmentation (scattered across different sources), and lack of compliance check. As a result, the significant portion of Android apps we analyze are found to be vulnerable. To help the security guidance better followed by app developers, we propose TipTracer, a framework for verifying Android security tips automatically and efficiently. TipTracer contains a security property language that formally describes constraints expressed in security tips and a static code analyzer that checks whether applications satisfy security tips. We demonstrate the effectiveness, efficiency and usability of TipTracer using a large set of real-world apps. © 2019, Science Press. All right reserved.
引用
收藏
页码：2315 / 2329
页数：14
相关论文
共 40 条
  • [1] Newman J., PCWorld: Skype for Android has a nasty vulnerability
  • [2] Luo T., Hao H., Du W., Et al., Attacks on Webview in the Android system, Proc of the 27th Annual Computer Security Applications Conf, pp. 343-352, (2011)
  • [3] Chin E., Wagner D., Bifocals: Analyzing webview vulnerabilities in Android applications, Proc of the 14th Int Workshop on Information Security Applications, pp. 138-159, (2013)
  • [4] Fahl S., Harbach M., Perl H., Et al., Rethinking SSL development in an appified world, Proc of the 2013 ACM SIGSAC Conf on Computer & Communications Security, pp. 49-60, (2013)
  • [5] Georgiey M., Iyengar S., Jana S., Et al., The most dangerous code in the world: Validating SSL certificates in non-browser software, Proc of the 2012 ACM SIGSAC Conf on Computer & Communications Security, pp. 38-49, (2012)
  • [6] Security with https and SSL
  • [7] Egele M., Brumley D., Fratantonio Y., Et al., An empirical study of cryptographic misuse in Android applications, Proc of the 2013 ACM SIGSAC Conf on Computer & Communications Security, pp. 73-84, (2013)
  • [8] Security tips
  • [9] API page of dexclassloader
  • [10] Poeplau S., Fratantonio Y., Bianchi A., Et al., Execute this! Analyzing unsafe and malicious dynamic code loading in Android applications, Proc of the 2014 Network and Distributed System Security Symp, pp. 23-26, (2014)
1234