Why eve and mallory love android: an analysis of android SSL (in)security

By Sascha Fahl, Marian Harbach, T. Muders, Matthew Smith, Lars Baumgärtner, Bernd Freisleben. Conference on Computer and Communications Security, 2012

608 citations recorded by the source corpus.

Subfields: Information Systems, Signal Processing

View Paper: https://www.semanticscholar.org/paper/d7156ab7d568a07dd0a116a81a2ac5a871c2a2b4

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Information Systems

In Signal Processing

Citations in the corpus

Lucky Thirteen: Breaking the TLS and DTLS Record Protocols (2013, background): “Other recent work on the security of TLS implementations includes [16, 17, 30].”
IccTA: Detecting Inter-Component Privacy Leaks in Android Apps (2015, background): “Except privacy leaks detection, there has been a rich body of work on other Android security issues [10], [13], [19], [21], [24], [51] such as energy bugs [16], [32] and SSL vulnerabilities [20], [41].”
: Privacy on Mobile Devices – It ’ s Complicated (2016, background): “More precisely, mallodroid [164], an open-source static analysis tool for Android, found that 1,074 out of 13,500 analyzed applications were improperly using cryptographic certificates (41 of the 1,074 were manually verified) [122].”
You Get Where You're Looking for: The Impact of Information Sources on Code Security (2016, background): “13,500 popular, free Android apps contained misconfigured TLS code vulnerable to Man-In-The-Middle attacks [16].”
Understanding security mistakes developers make: Qualitative analysis from Build It, Break It, Fix It (2020, methodology): “Other researchers used fuzzing and static analysis to identify problems with SSL/TLS implementations in libraries and in Android apps [28,33].”
Reliable Third-Party Library Detection in Android and its Security Applications (2016, background): “(in-)security [25, 11], or (mis-)use of cryptographic APIs [9].”
*droid (2016, methodology): “In the MalloDroid paper [Fahl et al. 2012], only 8% of those 13,500 applications produced potential vulnerabilities.”
An empirical study of cryptographic misuse in android applications (2013, background): “Fahl et al. [15] presented MaloDroid, a system that identi-ﬁes Android applications that do not perform the necessary validation on SSL certiﬁcates.”
Stack Overflow Considered Harmful? The Impact of Copy&Paste on Android Application Security (2017, methodology): “Practically, we observe that custom trust managers basically ignore authentication at all [2].”
HVLearn: Automated Black-Box Analysis of Hostname Verification in SSL/TLS Implementations (2017, background): “However, despite the critical nature of the hostname verification process, none of the prior research projects dealing with adversarial testing of SSL/TLS certificate validation [36], [38], [45], [50], support detailed automated testing of hostname verification implementations.”
Static analysis of android apps: A systematic literature review (2017, methodology): “TOOL Brief Description IR Example Usages Soot [12] A Java/Android static analysis and optimization framework JIMPLE, JASMIN FlowDroid [6], IccTA [7], AppIntent [90] WALAa A Java/Javascript static analysis framework WALA-IR (SSA-based) AsDroid [95], Asynchronizer [144], ORBIT [154] Chord [161] A Java”
Amandroid: A Precise and General Inter-component Data Flow Analysis Framework for Security Vetting of Android Apps (2014, background): “There has been a large body of work reporting Android app security issues [36, 37], some of which use static analysis techniques [11, 14, 18, 19].”
SoK: Privacy on Mobile Devices – It’s Complicated (2016, background): “More precisely, mallodroid [164], an open-source static analysis tool for Android, found that 1,074 out of 13,500 analyzed applications were improperly using cryptographic certificates (41 of the 1,074 were manually verified) [122].”