An empirical study of cryptographic misuse in android applications

By Manuel Egele, David Brumley, Yanick Fratantonio, Christopher Kruegel. 2013

515 citations recorded by the source corpus.

Subfields: Information Systems, Software, Safety, Robustness & Interpretability, Signal Processing

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Information Systems

In Software

In Safety, Robustness & Interpretability

In Signal Processing

Citations in the corpus

You Autocomplete Me: Poisoning Vulnerabilities in Neural Code Completion (2020, methodology): “Despite its insecurity, ECB is still used by programmers [20, 63].”
SoK: Security Evaluation of Home-Based IoT Deployments (2019, methodology): “We adapted Acar’s approach and identified three major classes of insecurities that effect IoT devices: over-privilege (permissions [38], [39]), programming errors (programming [40]), and hard-coded sensitive information (data protection [41]).”
Build It, Break It, Fix It: Contesting Secure Development (2016, background): “Common findings include developers who do not understand the threat model, security APIs with confusing options and poorly chosen defaults, and “temporary" test configurations that were not corrected prior to deployment [26, 27, 29].”
SoK: Privacy on Mobile Devices – It’s Complicated (2016, background): “9% of the analyzed Android apps [156] and 65.”
*droid (2016, methodology): “These challenges mean that there is currently no dynamic analysis analogue to scalable lightweight static analysis systems like CryptoLint [Egele et al. 2013] or MalloDroid [Fahl et al. 2012], which can analyze code at market scale.”
You Get Where You're Looking for: The Impact of Information Sources on Code Security (2016, background): “examined the use of cryptography – including block ciphers and message authentication codes – in Android applications and found more than 10,000 apps misusing cryptographic primitives in insecure ways [11].”
Static analysis of android apps: A systematic literature review (2017, methodology): “As an example, CryptoLint [54] leverages program analysis techniques to automatically check apps hosted on the official Google Play store.”
Understanding security mistakes developers make: Qualitative analysis from Build It, Break It, Fix It (2020, background): “Egele et al. developed an analyzer to recognize speciﬁc cryptographic errors and found that nearly 88% of Google Play applications using cryptographic APIs make at least one of these mistakes [26].”
Stack Overflow Considered Harmful? The Impact of Copy&Paste on Android Application Security (2017, methodology): “Additionally, we included code snippets with reference to the following security libraries, which were specially designed for Android: BouncyCastle (BC) is the default, pre-installed cryptographic service provider on Android and is widely used [3].”
: Privacy on Mobile Devices – It ’ s Complicated (2016, background): “9% of the analyzed Android apps [156] and 65.”
Reliable Third-Party Library Detection in Android and its Security Applications (2016, methodology): “In this study, we are interested in finding answers to security- and privacy-related questions about libraries, such as “How prevalent are thirdparty libraries in the top apps and how up-to-date are the library versions?”, “Do app developers update the libs included in their apps and how quickly do ”
Amandroid: A Precise and General Inter-component Data Flow Analysis Framework for Security Vetting of Android Apps (2014, background): “There has been a large body of work reporting Android app security issues [36, 37], some of which use static analysis techniques [11, 14, 18, 19].”
Brahmastra: Driving Apps to Test the Security of Third-Party Components (2014, background): “Indeed, our interest in this topic grew after learning that popular SDKs provided by Facebook and Microsoft for authentication were prone to misuse by applications [30], and that applications often make improper use of Android cryptography libraries [20].”