Mobile devices are used more and more in everyday life. They are our cameras, wallets, and keys. Basically, they embed most of our private information in our pocket. For this and other reasons, mobile devices, and in particular the software that runs on them, are considered first-class citizens in the software-vulnerabilities landscape. Several studies investigated the software-vulnerabilities phenomenon in the context of mobile apps and, more in general, mobile devices. Most of these studies focused on vulnerabilities that could affect mobile apps, while just few investigated vulnerabilities affecting the underlying platform on which mobile apps run: the Operating System (OS). Also, these studies have been run on a very limited set of vulnerabilities.
In this paper we present the largest study at date investigating Android-related vulnerabilities, with a specific focus on the ones affecting the Android OS. In particular, we (i) define a detailed taxonomy of the types of Android-related vulnerability; (ii) investigate the layers and subsystems from the Android OS affected by vulnerabilities; and (iii) study the survivability of vulnerabilities (i.e., the number of days between the vulnerability introduction and its fixing). Our findings could help OS and apps developers in focusing their verification & validation activities, and researchers in building vulnerability detection tools tailored for the mobile world.
Frequently advised secure development recommendations often fall short in practice for app developers. Tool-driven (e.g., using static analysis tools) approaches lack context and domain-specific requirements of an app being tested. App developers struggle to find an actionable and prioritized list of vulnerabilities from a laundry list of security warnings reported by static analysis tools. Process-driven (e.g., applying threat modeling methods) approaches require substantial resources (e.g., security testing team, budget) and security expertise, which small to medium-scale app dev teams could…
Never before has any OS been so popular as Android. Existing mobile phones are not simply devices for making phone calls and receiving SMS messages, but powerful communication and entertainment platforms for web surfing, social networking, etc. Even though the Android OS offers powerful communication and application execution capabilities, it is riddled with defects (e.g., security risks, and compatibility issues), new vulnerabilities come to light daily, and bugs cost the economy tens of billions of dollars annually. For example, malicious apps (e.g., back-doors, fraud apps, ransomware, spywa…
Too Quiet in the Library: An Empirical Study of Security Updates in Android Apps' Native Code
Android应用包含第三方原生库，以提高性能和重用功能。原生代码通过Java原生接口或Android原生开发工具包直接从应用执行。Android开发人员将预编译的原生库添加到他们的项目中，以启用它们的使用。不幸的是，开发人员经常努力或干脆忽视及时更新这些库。这导致在补丁可用多年后，仍继续使用过时的本机库，这些本机库具有未修补的安全漏洞。为了进一步了解这种现象，我们研究了9月10日以来Google Play上最受欢迎的200个免费应用程序中原生库的安全更新。2013年至2020年5月。我们在这项研究中面临的一个核心困难是图书馆及其版本的识别。开发人员经常重命名或修改库，使其识别具有挑战性。我们创建了一种名为LibRARIAN（LibRAry veRsion IdentificAtioN）的方法，该方法基于我们新颖的相似性度量bin 2sim准确识别Android应用中的原生库及其版本。LibRARIAN利用了基于元数据从库中提取的不同特征，并在只读部分中识别字符串。我们发现，在2009年9月20日至2011年9月30日期间，200个流行应用程序中有53个（26.5%）存在已知CVE的易受攻击版本。2013年和2020年5月，其中14个应用程序仍然存在漏洞。我们发现，应用程序开发人员平均需要528.71天来应用安全补丁，而库开发人员在54.59天后发布安全补丁-更新速度慢了10倍。
Android is nowadays the most popular operating system in the world, not only in the realm of mobile devices, but also when considering desktop and laptop computers. Such a popularity makes it an attractive target for security attacks, also due to the sensitive information often manipulated by mobile apps. The latter are going through a transition in which the Android ecosystem is moving from the usage of Java as the official language for developing apps, to the adoption of Kotlin as the first choice supported by Google. While previous studies have partially studied security weaknesses affectin…
Evaluating LLMs for Obfuscation Detection and Classification in Android Apps
IMT School for Advanced Studies Lucca（卢卡高等研究学院）；Interdisciplinary Centre for Security, Reliability and Trust（安全、可靠性和信任跨学科中心）；University of Verona（维罗纳大学）；University of Genoa（热那亚大学）
We propose a system, named ATVHunter, which can pinpoint the precise vulnerable in-app TPL versions and provide detailed information about the vulnerabilities and TPLs. We propose a two-phase detection approach to identify specific TPL versions. Specifically, we extract the Control Flow Graphs as the coarse-grained feature to match potential TPLs in the pre-defined TPL database, and then extract opcode in each basic block of CFG as the fine-grained feature to identify the exact TPL versions. We build a comprehensive TPL database (189,545 unique TPLs with 3,006,676 versions) as the reference da…
Container technology, (e.g., Docker) is being widely adopted for deploying software infrastructures or applications in the form of container images. Security vulnerabilities in the container images are a primary concern for developing containerized software. Exploitation of the vulnerabilities could result in disastrous impact, such as loss of confidentiality, integrity, and availability of containerized software. Understanding the exploitability and impact characteristics of vulnerabilities can help in securing the configuration of containerized software. However, there is a lack of research …
CONTEXT: Applying vulnerability detection techniques is one of many tasks using the limited resources of a software project. OBJECTIVE: The goal of this research is to assist managers and other decision-makers in making informed choices about the use of software vulnerability detection techniques through an empirical study of the efficiency and effectiveness of four techniques on a Java-based web application. METHOD: We apply four different categories of vulnerability detection techniques \textendash~ systematic manual penetration testing (SMPT), exploratory manual penetration testing (EMPT), …
Virtualization-based Penetration Testing Study for Detecting Accessibility Abuse Vulnerabilities in Banking Apps in East and Southeast Asia
Singapore Management University（新加坡管理大学）；MIE-SPPU Institute of Higher Education（MIE-SPPU高等教育学院）；i-Sprint Innovations Pte. Ltd（i-Sprint创新私人有限公司）；Promon（普罗蒙）
Context: Smart contracts are computer programs that are automatically executed on the blockchain. Vulnerabilities in their implementation have led to severe loss of cryptocurrency. Smart contracts become immutable when deployed to the Ethereum blockchain. Therefore, it is essential to understand the nature of vulnerabilities in Ethereum smart contracts to prevent them in the future. Existing classifications exist, but are limited in several ways. Objective: We aim to characterize vulnerabilities in Ethereum smart contracts written in Solidity, and unify existing classifications schemes. Method…
Blockchain, as a distributed ledger technology, becomes increasingly popular, especially for enabling valuable cryptocurrencies and smart contracts. However, the blockchain software systems inevitably have many bugs. Although bugs in smart contracts have been extensively investigated, security bugs of the underlying blockchain systems are much less explored. In this paper, we conduct an empirical study on blockchain's system vulnerabilities from four representative blockchains, Bitcoin, Ethereum, Monero, and Stellar. Specifically, we first design a systematic filtering process to effectively i…
Characterizing Trust Boundary Vulnerabilities in TEE Containers: An Empirical Study
Nankai University（南开大学）；Indiana University Bloomington（印第安纳大学布鲁明顿分校）；Nanyang Technological University（南洋理工大学）；Institute of Information Engineering, Chinese Academy of Sciences（中国科学院信息工程研究所）；Duke University（杜克大学）；Huazhong University of Science and Technology（华中科技大学）
