Profiling Android Vulnerabilities

Jiménez, M.; Papadakis, Mike; Bissyandé, Tegawendé F.; Klein, Jacques

doi:10.1109/qrs.2016.34

Cited by 25 publications

(13 citation statements)

References 24 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…Finally, Jimenez et al [15] analyzed 32 vulnerabilities from the CVE database [49] to identify the issues, involved components, code complexity of the patches, and complexity of the code methods/functions involved in the vulnerability.…”

Section: A Malware and Vulnerabilitiesmentioning

confidence: 99%

An Empirical Study on Android-Related Vulnerabilities

Linares‐Vásquez

Bavota

Escobar‐Velásquez

2017

2017 IEEE/ACM 14th International Conference on Mining Software Repositories (MSR)

View full text Add to dashboard Cite

Mobile devices are used more and more in everyday life. They are our cameras, wallets, and keys. Basically, they embed most of our private information in our pocket. For this and other reasons, mobile devices, and in particular the software that runs on them, are considered first-class citizens in the software-vulnerabilities landscape. Several studies investigated the software-vulnerabilities phenomenon in the context of mobile apps and, more in general, mobile devices. Most of these studies focused on vulnerabilities that could affect mobile apps, while just few investigated vulnerabilities affecting the underlying platform on which mobile apps run: the Operating System (OS). Also, these studies have been run on a very limited set of vulnerabilities.In this paper we present the largest study at date investigating Android-related vulnerabilities, with a specific focus on the ones affecting the Android OS. In particular, we (i) define a detailed taxonomy of the types of Android-related vulnerability; (ii) investigate the layers and subsystems from the Android OS affected by vulnerabilities; and (iii) study the survivability of vulnerabilities (i.e., the number of days between the vulnerability introduction and its fixing). Our findings could help OS and apps developers in focusing their verification & validation activities, and researchers in building vulnerability detection tools tailored for the mobile world.

show abstract

Section: A Malware and Vulnerabilitiesmentioning

confidence: 99%

An Empirical Study on Android-Related Vulnerabilities

Linares‐Vásquez

Bavota

Escobar‐Velásquez

2017

2017 IEEE/ACM 14th International Conference on Mining Software Repositories (MSR)

View full text Add to dashboard Cite

show abstract

“…Other related studies that analysed vulnerabilities and their patches are due to Milenkoski et al [19], Fonseca et al [20] and Jimenez et al [21]. These studies focus on specific kinds of vulnerabilities and their causes.…”

Section: Vulnerability Prediction Modelling (Vpm): Initiated Bymentioning

confidence: 99%

An Empirical Analysis of Vulnerabilities in OpenSSL and the Linux Kernel

Jiménez

Papadakis

Traon

2016

2016 23rd Asia-Pacific Software Engineering Conference (APSEC)

Self Cite

View full text Add to dashboard Cite

Vulnerabilities are one of the main concerns faced by practitioners when working with security critical applications. Unfortunately, developers and security teams, even experienced ones, fail to identify many of them with severe consequences. Vulnerabilities are hard to discover since they appear in various forms, caused by many different issues and their identification requires an attacker's mindset. In this paper, we aim at increasing the understanding of vulnerabilities by investigating their characteristics on two major open-source software systems, i.e., the Linux kernel and OpenSSL. In particular, we seek to analyse and build a profile for vulnerable code, which can ultimately help researchers in building automated approaches like vulnerability prediction models. Thus, we examine the location, criticality and category of vulnerable code along with its relation with software metrics. To do so, we collect more than 2,200 vulnerable files accounting for 863 vulnerabilities and compute more than 35 software metrics. Our results indicate that while 9 Common Weakness Enumeration (CWE) types of vulnerabilities are prevalent, only 3 of them are critical in OpenSSL and 2 of them in the Linux kernel. They also indicate that different types of vulnerabilities have different characteristics, i.e., metric profiles, and that vulnerabilities of the same type have different profiles in the two projects we examined. We also found that the file structure of the projects can provide useful information related to the vulnerabilities. Overall, our results demonstrate the need for making project specific approaches that focus on specific types of vulnerabilities.

show abstract

“…Thomas et al [39] have analyzed 102k+ apks to study a CVE reported vulnerability on the JavaScript-to-Java interface of the WebView API. Jimenez et al [107] have attempted to profile 32 CVE vulnerabilities by characterizing the OS components, the issues, the complexity of the associated patches, etc. Linares-Vásquez et al [108] have then presented a larger-scale empirical study on Android OS-related vulnerabilities.…”

Section: Related Workmentioning

confidence: 99%

Understanding the Evolution of Android App Vulnerabilities

Gao

Kong

et al. 2021

IEEE Trans. Rel.

Self Cite

View full text Add to dashboard Cite

The Android ecosystem today is a growing universe of a few billion devices, hundreds of millions of users and millions of applications targeting a wide range of activities where sensitive information is collected and processed. Security of communication and privacy of data are thus of utmost importance in application development. Yet, regularly, there are reports of successful attacks targeting Android users. While some of those attacks exploit vulnerabilities in the Android OS, others directly concern application-level code written by a large pool of developers with varying experience. Recently, a number of studies have investigated this phenomenon, focusing however only on a specific vulnerability type appearing in apps, and based on only a snapshot of the situation at a given time. Thus, the community is still lacking comprehensive studies exploring how vulnerabilities have evolved over time, and how they evolve in a single app across developer updates. Our work fills this gap by leveraging a data stream of 5 million app packages to reconstruct versioned lineages of Android apps and finally obtained 28,564 app lineages (i.e., successive releases of the same Android apps) with more than 10 app versions each, corresponding to a total of 465,037 apks. Based on these app lineages, we apply stateof-the-art vulnerability-finding tools and investigate systematically the reports produced by each tool. In particular, we study which types of vulnerabilities are found, how they are introduced in the app code, where they are located, and whether they foreshadow malware. We provide insights based on the quantitative data as reported by the tools, but we further discuss the potential false positives. Our findings and study artifacts constitute a tangible knowledge to the community. It could be leveraged by developers to focus verification tasks, and by researchers to drive vulnerability discovery and repair research efforts.

show abstract

Profiling Android Vulnerabilities

Cited by 25 publications

References 24 publications

An Empirical Study on Android-Related Vulnerabilities

An Empirical Study on Android-Related Vulnerabilities

An Empirical Analysis of Vulnerabilities in OpenSSL and the Linux Kernel

Understanding the Evolution of Android App Vulnerabilities

Contact Info

Product

Resources

About