Paper Info
Title
Source Attribution of Cryptographic API Misuse in Android Applications.
Abstract
Recent research suggests that 88% of Android applications that use Java cryptographic APIs make at least one mistake, which results in an insecure implementation. It is unclear, however, if these mistakes originate from code written by application or third-party library developers. Understanding the responsible party for a misuse case is important for vulnerability disclosure. In this paper, we bridge this knowledge gap and introduce source attribution to the analysis of cryptographic API misuse. We developed BinSight, a static program analyzer that supports source attribution, and we analyzed 132K Android applications collected in years 2012, 2015, and 2016. Our results suggest that third-party libraries are the main source of cryptographic API misuse. In particular, 90% of the violating applications, which contain at least one call-site to Java cryptographic API, originate from libraries. When compared to 2012, we found the use of ECB mode for symmetric ciphers has significantly decreased in 2016, for both application and third-party library code. Unlike application code, however, third-party libraries have significantly increased their reliance on static encryption keys for symmetric ciphers and static IVs for CBC mode ciphers. Finally, we found that the insecure RC4 and DES ciphers were the second and the third most used ciphers in 2016.
Year
DOI
Venue
2018
10.1145/3196494.3196538
AsiaCCS
Keywords
Field
DocType
Static Analysis, Source Attribution, Android, Cryptography APIs, Applied Cryptography
Misuse case,Android (operating system),Mistake,Computer security,Computer science,Cryptography,Static analysis,Encryption,RC4,Java
Conference
ISBN
Citations 
PageRank 
978-1-4503-5576-6
1
0.35
References 
Authors
11
3
Name
Order
Citations
PageRank
Ildar Muslukhov141518.51
Yazan Boshmaf249122.39
Konstantin Beznosov31521105.47