Conference Proceeding Article
Cryptography is increasingly being used in mobile applications to provide various security services; from user authentication, data privacy, to secure communications. However, there are plenty of mistakes that developers could accidentally make when using cryptography in their mobile apps and such mistakes can lead to a false sense of security. Recent research efforts indeed show that a significant portion of mobile apps in both Android and iOS platforms misused cryptographic APIs. In this paper, we present CDRep, a tool for automatically repairing cryptographic misuse defects in Android apps. We classify such defects into seven types and manually assemble the corresponding fix patterns based on the best practices in cryptographic implementations. CDRep consists of two phases, a detection phase which identifies defect locations in a mobile app and a repair phase which repairs the vulnerable app automatically. In our validation, CDRep is able to successfully repair 94.5% of 1,262 vulnerable apps. Furthermore, CDRep is lightweight, the average runtime to generate a patch is merely 19.3 seconds and the size of a repaired app increases by only 0.667% on average.
vulnerability detection, cryptographic misuse, automated program repair
Computer Sciences | Information Security | Software Engineering
Cybersecurity; Software and Cyber-Physical Systems
ASIA CCS '16: Proceedings of the 11th ACM Asia Conference on Computer and Communications Security: May 30 - June 3, Xi'an, China
City or Country
MA, Siqi; LO, David; LI, Teng; and DENG, Robert H..
CDRep: Automatic repair of cryptographic-misuses in Android applications. (2016). ASIA CCS '16: Proceedings of the 11th ACM Asia Conference on Computer and Communications Security: May 30 - June 3, Xi'an, China. 711-722. Research Collection School Of Information Systems.
Available at: http://ink.library.smu.edu.sg/sis_research/3733
Creative Commons License
This work is licensed under a Creative Commons Attribution-Noncommercial-No Derivative Works 4.0 License.