Finding architectural flaws in android apps is easy

Authors:
Radu Vanciu;Marwan Abi-Antoun
Affiliations:
Wayne State University, Detroit, MI, USA;Wayne State University, Detroit, MI, USA
Venue:
Proceedings of the 2013 companion publication for conference on Systems, programming, & applications: software for humanity
Year:
2013

Citing 3
Cited 0

Threat Modeling

Threat Modeling
Tool support for the static extraction of sound hierarchical representations of runtime object graphs

Companion to the 23rd ACM SIGPLAN conference on Object-oriented programming systems languages and applications
Ownership Object Graphs with Dataflow Edges

WCRE '12 Proceedings of the 2012 19th Working Conference on Reverse Engineering

Quantified Score

Hi-index	0.00

Visualization

Abstract

Mobile devices store confidential information. As a result, security vulnerabilities such as information disclosure in mobile apps can have serious consequences. To build secure apps, developers are expected to follow security policies that are described only informally. Some policies target architectural flaws, rather than coding defects, and are not easily checked or enforced with existing tools. Scoria is a prototype tool that allows architects to write security policies as machine-checkable constraints that are executed against a program abstraction that is a hierarchy of abstract objects with dataflow communication edges. Using Scoria, architects reason not only about the presence or absence of communication, but also about object provenance, hierarchy and reachability. We show how Scoria can find information disclosure in an open-source Android app.