Source Attribution of Cryptographic API Misuse in Android Applications

Abstract

Recent research suggests that 88% of Android applications that use Java cryptographic APIs make at least one mistake, which results in an insecure implementation. It is unclear, however, if these mistakes originate from code written by application or thirdparty library developers. Understanding the responsible party for a misuse case is important for vulnerability disclosure. In this paper, we bridge this knowledge gap and introduce source attribution to the analysis of cryptographic API misuse. We developed BinSight, a static program analyzer that supports source attribution, and we analyzed 132K Android applications collected in years 2012, 2015, and 2016. Our results suggest that third-party libraries are the main source of cryptographic API misuse. In particular, 90% of the violating applications, which contain at least one call-site to Java cryptographic API, originate from libraries. When compared to 2012, we found the use of ECB mode for symmetric ciphers has signi cantly decreased in 2016, for both application and third-party library code. Unlike application code, however, third-party libraries have signi cantly increased their reliance on static encryption keys for symmetric ciphers and static IVs for CBC mode ciphers. Finally, we found that the insecure RC4 and DES ciphers were the second and the third most used ciphers in 2016. CCS CONCEPTS • Security and privacy → Software security engineering; Security requirements;

A novel hybrid method to analyze security vulnerabilities in Android applications

“…And partial means that for the types of vulnerabilities in Table 7, FlowDroid and the method in Ref. [12] do not detect all cases, and there may be other vulnerability situations. FlowDroid can directly detect partial sensitive data leaks.…”

“…The analyzed vulnerability categories in Ref. [12] partially overlap with the "insecure password" vulnerability. The vulnerability categories detected by our system are relatively more comprehensive.…”

SSLDetecter: Detecting SSL Security Vulnerabilities of Android Applications Based on a Novel Automatic Traversal Method

“…Formula (1) indicates that if s1 and s2 belong to different Activities, they correspond to different interface states and the similarity of them is zero. When s1 and s2 belong to the same Activity, the similarity of the corresponding interface state can be calculated based on the widget path set.…”

“…To protect users' privacy in network communications, the applications can use encryption-based functions and SSL protocols. However, recent research has pointed out that about 88% of Android applications misuse the Java crypto APIs and cause security vulnerabilities [1]. Although the Android SDK implements the SSL protocol (in this paper, SSL means secure sockets layer protocol SSL and transport layer security protocol TLS) to protect communication security, the situation has not been greatly alleviated.…”

A forensic investigation of Android mobile applications

“…Next, these two classes are used in the "encryptCipher" method to initialize the Java Cipher class, in order to encrypt the PIN of the user using AES in CBC mode (see Figure 3 and 4) and store it in the device. Evidently, since the key and the initialization vector are static, it leads us to the conclusion that the produced ciphertext is deterministic [17] and can be easily decrypted to obtain the user's PIN. As a side note, the latest version released in September 2018, the vulnerabilities described have been fixed.…”