Security Smells in Android

Abstract

The ubiquity of smartphones, and their very broad capabilities and usage, make the security of these devices tremendously important. Unfortunately, despite all progress in security and privacy mechanisms, vulnerabilities continue to proliferate.Research has shown that many vulnerabilities are due to insecure programming practices. However, each study has often dealt with a specific issue, making the results less actionable for practitioners.To promote secure programming practices, we have reviewed related research, and identified avoidable vulnerabilities in Android-run devices and the security code smells that indicate their presence. In particular, we explain the vulnerabilities, their corresponding smells, and we discuss how they could be eliminated or mitigated during development. Moreover, we develop a lightweight static analysis tool and discuss the extent to which it successfully detects several vulnerabilities in about 46 000 apps hosted by the official Android market.

Security code smells in Android ICC

“…The horizontal axis shows the different Android releases apps are targeting in their configuration, whereas the vertical axis shows the contribution of a specific smell to the total amount of smells detected. As in previous work [10], we see changes in some of the security smells apps suffer from. We believe that the positive trend in Unauthorized Intent within apps is the consequence of built-in sharing functionalities to external services.…”

“…Given this situation, in previous work we identified 28 security code smells, i.e., symptoms in the code that signal potential security vulnerabilities [10]. We studied the prevalence of ten such smells, and realized that despite the diversity of apps in popularity, size, and release date, the majority suffer from at least three different security smells, and such smells are in fact good indicators of actual security vulnerabilities.…”

Web APIs in Android through the Lens of Security

“…In previous work, we defined the notion of security code smells and investigated their appearance in 46 000 closedsource Android apps from the official market [6]. We identified 28 different security smells in five different categories, and found that XSS-like Code Injection, Dynamic Code Loading, and Custom Scheme Channel are the most prevalent smells.…”

“…We manually inspected the tool's output for 100 random apps, and used the reported URLs to connect to the servers and to investigate their response. We found eight security code smells, i.e., symptoms in the code that signal the prospect of a security vulnerability [6], on both ends, dominated by the use of embedded computer languages. We handcrafted regular expressions to automatically identify the use of those languages, and other languages prevalent on GitHub.…”

Unix Domain Sockets Applied in Android Malware Should Not Be Ignored

“…Although Google encourages Android developers to use Android IPCs, some still use Unix domain sockets, known as local sockets [15]. This practice occurs not only because using UNIX domain sockets for IPC is more efficient but also because Android IPCs are unsuitable for communication between the Java language in which most apps are written and native processes/threads [16]. Both the Android software development kit (SDK) and the Android native development kit (NDK) [17] provide APIs for Unix domain sockets.…”