Publication Type

Conference Proceeding Article

Version

publishedVersion

Publication Date

6-2016

Abstract

Cryptography is increasingly being used in mobile applications to provide various security services; from user authentication, data privacy, to secure communications. However, there are plenty of mistakes that developers could accidentally make when using cryptography in their mobile apps and such mistakes can lead to a false sense of security. Recent research efforts indeed show that a significant portion of mobile apps in both Android and iOS platforms misused cryptographic APIs. In this paper, we present CDRep, a tool for automatically repairing cryptographic misuse defects in Android apps. We classify such defects into seven types and manually assemble the corresponding fix patterns based on the best practices in cryptographic implementations. CDRep consists of two phases, a detection phase which identifies defect locations in a mobile app and a repair phase which repairs the vulnerable app automatically. In our validation, CDRep is able to successfully repair 94.5% of 1,262 vulnerable apps. Furthermore, CDRep is lightweight, the average runtime to generate a patch is merely 19.3 seconds and the size of a repaired app increases by only 0.667% on average.

Keywords

vulnerability detection, cryptographic misuse, automated program repair

Discipline

Computer Sciences | Information Security | Software Engineering

Research Areas

Cybersecurity; Software and Cyber-Physical Systems

Publication

ASIA CCS '16: Proceedings of the 11th ACM Asia Conference on Computer and Communications Security: May 30 - June 3, Xi'an, China

First Page

711

Last Page

722

ISBN

9781450342339

Identifier

10.1145/2897845.2897896

Publisher

ACM

City or Country

New York

Additional URL

http://doi.org/10.1145/2897845.2897896

Download

Share

COinS