A Qualitative Analysis of Android Taint-Analysis Results

Luo, Linghui; Bodden, Eric; Späth, Johannes

doi:10.1109/ase.2019.00020

Cited by 26 publications

(14 citation statements)

References 39 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…As we show in Section VI-E, these issues lead to a profusion of false positives for any data flow tracker that relies on SUSI's source/sink lists. Several works in the literature [57], [24], [35] have come to similar conclusions. Luo et al show that SUSI's sources list leads to a false positive rate of almost 80% while trying to detect sensitive data leaks [35].…”

Section: Introductionsupporting

confidence: 63%

Negative Results of Fusing Code and Documentation for Learning to Accurately Identify Sensitive Source and Sink Methods An Application to the Android Framework for Data Leak Detection

Samhi¹,

Kober²,

Kaboré³

et al. 2023

Preprint

View full text Add to dashboard Cite

Apps on mobile phones manipulate all sorts of data, including sensitive data, leading to privacy-related concerns. Recent regulations like the European GDPR provide rules for the processing of personal and sensitive data, like that no such data may be leaked without the consent of the user.Researchers have proposed sophisticated approaches to track sensitive data within mobile apps, all of which rely on specific lists of sensitive SOURCE and SINK API methods. The data flow analysis results greatly depend on these lists' quality. Previous approaches either used incomplete hand-written lists that quickly became outdated or relied on machine learning. The latter, however, leads to numerous false positives, as we show.This paper introduces CODOC, a tool that aims to revive the machine-learning approach to precisely identify privacyrelated SOURCE and SINK API methods. In contrast to previous approaches, CODOC uses deep learning techniques and combines the source code with the documentation of API methods. Firstly, we propose novel definitions that clarify the concepts of sensitive SOURCE and SINK methods. Secondly, based on these definitions, we build a new ground truth of Android methods representing sensitive SOURCE, SINK, and NEITHER (i.e., no source or sink) methods that will be used to train our classifier.We evaluate CODOC and show that, on our validation dataset, it achieves a precision, recall, and F1 score of 91% in 10-fold cross-validation, outperforming the state-of-the-art SUSI when used on the same dataset. However, similarly to existing tools, we show that in the wild, i.e., with unseen data, CODOC performs poorly and generates many false positive results. Our findings, together with time-tested results of previous approaches, suggest that machine-learning models for abstract concepts such as privacy fail in practice despite good lab results. To encourage future research, we release all our artifacts to the community.

show abstract

Section: Introductionsupporting

confidence: 63%

Negative Results of Fusing Code and Documentation for Learning to Accurately Identify Sensitive Source and Sink Methods An Application to the Android Framework for Data Leak Detection

Samhi¹,

Kober²,

Kaboré³

et al. 2023

Preprint

View full text Add to dashboard Cite

show abstract

“…Detecting the remaining 21 vulnerabilities by source code analysis is harder due to combinations of factors such as the semantics of general-purpose programming languages (e.g., Java), security-related specs provided by the developer (e.g., source/sink APIs), and the behavior of the underlying system (e.g., Android libraries and runtime). Hence, many existing tools based on source code analysis fail to detect vulnerabilities in real-world apps effectively [31,30,24].…”

Section: Discussionmentioning

confidence: 99%

SeMA: Extending and Analyzing Storyboards to Develop Secure Android Apps

Mitra,

Ranganath,

Amtoft

et al. 2020

Preprint

View full text Add to dashboard Cite

As security of mobile apps is crucial to modern-day living, there is a growing need to help developers build apps with provable security guarantees that apps do not leak sensitive user information or cannot be exploited to perform actions without the user's consent. The current prevalent approach to mobile app security is to curatively address vulnerabilities after apps have been developed. This approach has downsides in terms of time, resources, user inconvenience, and information loss.As an alternative, we propose SeMA, a design-based mobile app development methodology to prevent the creation of vulnerabilities in mobile apps. SeMA enables app designers and developers to iteratively reason about the security of an app by using its storyboard, an existing and prevalent design artifact. Consequently, SeMA makes security a first-class citizen of a mobile app's design. A proof of concept realization of SeMA using Android Studio tooling is able to prevent 49 known vulnerabilities that plague Android apps.

show abstract

“…Taint analysis has been particular useful for security, as it "establishes whether values from untrusted methods and parameters may flow into security-sensitive operations" [54]. In the literature, there have been many applications of taint analysis [53], and in particular in recent years on security evaluations of Android applications (e.g., References [38,44,49]).…”

Section: Taint Analysis and Seedingmentioning

confidence: 99%

Enhancing Search-based Testing with Testability Transformations for Existing APIs

ArcuriAndrea

Galeotti

2021

ACM Trans. Softw. Eng. Methodol.

View full text Add to dashboard Cite

Search-based software testing (SBST) has been shown to be an effective technique to generate test cases automatically. Its effectiveness strongly depends on the guidance of the fitness function. Unfortunately, a common issue in SBST is the so-called flag problem , where the fitness landscape presents a plateau that provides no guidance to the search. In this article, we provide a series of novel testability transformations aimed at providing guidance in the context of commonly used API calls (e.g., strings that need to be converted into valid date/time objects). We also provide specific transformations aimed at helping the testing of REST Web Services. We implemented our novel techniques as an extension to EvoMaster , an SBST tool that generates system-level test cases. Experiments on nine open-source REST web services, as well as an industrial web service, show that our novel techniques improve performance significantly.

show abstract

A Qualitative Analysis of Android Taint-Analysis Results

Cited by 26 publications

References 39 publications

Negative Results of Fusing Code and Documentation for Learning to Accurately Identify Sensitive Source and Sink Methods An Application to the Android Framework for Data Leak Detection

Negative Results of Fusing Code and Documentation for Learning to Accurately Identify Sensitive Source and Sink Methods An Application to the Android Framework for Data Leak Detection

SeMA: Extending and Analyzing Storyboards to Develop Secure Android Apps

Enhancing Search-based Testing with Testability Transformations for Existing APIs

Contact Info

Product

Resources

About