CRYLOGGER：动态检测密码滥用
CRYLOGGER: Detecting Crypto Misuses Dynamically
摘要：
加密算法是所有安全系统的基本组成部分：例如，加密哈希函数和加密算法可以保证完整性和机密性等属性。然而，开发人员可以通过使用常量密钥和弱密码来滥用这些算法的应用程序编程接口（API）。本文介绍了第一个动态检测密码滥用的开源工具-WARLLOGGER。CRYLOGGER记录执行期间传递给加密API的参数，并通过使用加密规则列表离线检查其合法性。我们比较了CryptoGuard，最有效的静态工具之一，以检测加密滥用的加密日志。我们表明，我们的工具补充了CryptoGuard的结果，使静态和动态方法相结合的情况下。我们分析了从Google Play商店下载的1780个流行的Android应用程序，以表明BLOG可以动态自动地检测数千个应用程序上的加密滥用。我们对28个Android应用程序进行了逆向工程，并确认了由Google Logger标记的问题。我们还向应用程序开发人员披露最关键的漏洞，并收集他们的反馈。
英文摘要：
Cryptographic (crypto) algorithms are the essential ingredients of all secure systems: crypto hash functions and encryption algorithms, for example, can guarantee properties such as integrity and confidentiality. Developers, however, can misuse the application programming interfaces (API) of such algorithms by using constant keys and weak passwords. This paper presents CRYLOGGER, the first open-source tool to detect crypto misuses dynamically. CRYLOGGER logs the parameters that are passed to the crypto APIs during the execution and checks their legitimacy offline by using a list of crypto rules. We compare CRYLOGGER with CryptoGuard, one of the most effective static tools to detect crypto misuses. We show that our tool complements the results of CryptoGuard, making the case for combining static and dynamic approaches. We analyze 1780 popular Android apps downloaded from the Google Play Store to show that CRYLOGGER can detect crypto misuses on thousands of apps dynamically and automatically. We reverse-engineer 28 Android apps and confirm the issues flagged by CRYLOGGER. We also disclose the most critical vulnerabilities to app developers and collect their feedback.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
