Paper Info
Title
iCryptoTracer: Dynamic Analysis on Misuse of Cryptography Functions in iOS Applications.
Abstract
Cryptography is the common means to achieve strong data protection in mobile applications. However, cryptographic misuse is becoming one of the most common issues in development. Attackers usually make use of those flaws in implementation such as non-random key/IV to forge exploits and recover the valuable secrets. For the application developers who may lack knowledge of cryptography, it is urgent to provide an efficient and effective approach to assess whether the application can fulfill the security goal by the use of cryptographic functions. In this work, we design a cryptography diagnosis system iCryptoTracer. Combined with static and dynamic analyses, it traces the iOS application's usage of cryptographic APIs, extracts the trace log and judges whether the application complies with the generic cryptographic rules along with real-world implementation concerns. We test iCryptoTracer using real devices with various version of iOS. We diagnose 98 applications from Apple App Store and find that 64 of which contain various degrees of security flaws caused by cryptographic misuse. To provide the proof-of-concept, we launch ethical attacks on two applications respectively. The encrypted secret information can be easily revealed and the encryption keys can also be restored.
Year
Venue
Field
2014
Lecture Notes in Computer Science
App store,Computer science,Computer security,Cryptography,Computer network,Cryptographic primitive,Encryption,Exploit,Online payment,Data Protection Act 1998
DocType
Volume
ISSN
Conference
8792
0302-9743
Citations 
PageRank 
References 
11
0.52
8
Authors
4
Name
Order
Citations
PageRank
Yong Li1366.55
Yuanyuan Zhang221037.02
Juanru Li317924.07
Dawu Gu4644103.50