An empirical study of cryptographic misuse in android applications

Authors:
Manuel Egele;David Brumley;Yanick Fratantonio;Christopher Kruegel
Affiliations:
Carnegie Mellon University, Pittsburgh, USA;Carnegie Mellon University, Pittsburgh, USA;University Of California Santa Barbara, Santa Barbara, USA;University of California Santa Barbara, Sanata Barbara, USA
Venue:
Proceedings of the 2013 ACM SIGSAC conference on Computer & communications security
Year:
2013

Citing 19
Cited 0

Efficiently computing static single assignment form and the control dependence graph

ACM Transactions on Programming Languages and Systems (TOPLAS)
Authenticated encryption in SSH: provably fixing the SSH binary packet protocol

Proceedings of the 9th ACM conference on Computer and communications security
MOPS: an infrastructure for examining security properties of software

Proceedings of the 9th ACM conference on Computer and communications security
Optimization of Object-Oriented Programs Using Static Class Hierarchy Analysis

ECOOP '95 Proceedings of the 9th European Conference on Object-Oriented Programming
Program slicing

ICSE '81 Proceedings of the 5th international conference on Software engineering
Automated analysis of cryptographic protocols using Mur/spl phi/

SP '97 Proceedings of the 1997 IEEE Symposium on Security and Privacy
Statically detecting likely buffer overflow vulnerabilities

SSYM'01 Proceedings of the 10th conference on USENIX Security Symposium - Volume 10
Why Johnny can't encrypt: a usability evaluation of PGP 5.0

SSYM'99 Proceedings of the 8th conference on USENIX Security Symposium - Volume 8
Cryptographically verified implementations for TLS

Proceedings of the 15th ACM conference on Computer and communications security
On lightweight mobile phone application certification

Proceedings of the 16th ACM conference on Computer and communications security
Apex: extending Android permission model and enforcement with user-defined runtime constraints

ASIACCS '10 Proceedings of the 5th ACM Symposium on Information, Computer and Communications Security
TaintDroid: an information-flow tracking system for realtime privacy monitoring on smartphones

OSDI'10 Proceedings of the 9th USENIX conference on Operating systems design and implementation
All your droid are belong to us: a survey of current android attacks

WOOT'11 Proceedings of the 5th USENIX conference on Offensive technologies
Why (special agent) Johnny (still) can't encrypt: a security analysis of the APCO project 25 two-way radio system

SEC'11 Proceedings of the 20th USENIX conference on Security
Android permissions demystified

Proceedings of the 18th ACM conference on Computer and communications security
Password-based encryption analyzed

ICALP'05 Proceedings of the 32nd international conference on Automata, Languages and Programming
Why eve and mallory love android: an analysis of android SSL (in)security

Proceedings of the 2012 ACM conference on Computer and communications security
AdDroid: privilege separation for applications and advertisers in Android

Proceedings of the 7th ACM Symposium on Information, Computer and Communications Security
Slicing droids: program slicing for smali code

Proceedings of the 28th Annual ACM Symposium on Applied Computing

Quantified Score

Hi-index	0.00

Visualization

Abstract

Developers use cryptographic APIs in Android with the intent of securing data such as passwords and personal information on mobile devices. In this paper, we ask whether developers use the cryptographic APIs in a fashion that provides typical cryptographic notions of security, e.g., IND-CPA security. We develop program analysis techniques to automatically check programs on the Google Play marketplace, and find that 10.327 out of 11,748 applications that use cryptographic APIs -- 88% overall -- make at least one mistake. These numbers show that applications do not use cryptographic APIs in a fashion that maximizes overall security. We then suggest specific remediations based on our analysis towards improving overall cryptographic security in Android applications.