A whitebox approach for automated security testing of Android applications on the cloud

Abstract

Abstract-By changing the way software is delivered to endusers, markets for mobile apps create a false sense of security: apps are downloaded from a market that can potentially be regulated. In practice, this is far from truth and instead, there has been evidence that security is not one of the primary design tenets for the mobile app stores. Recent studies have indicated mobile markets are harboring apps that are either malicious or vulnerable leading to compromises of millions of devices. The key technical obstacle for the organizations overseeing these markets is the lack of practical and automated mechanisms to assess the security of mobile apps, given that thousands of apps are added and updated on a daily basis. In this paper, we provide an overview of a multi-faceted project targeted at automatically testing the security and robustness of Android apps in a scalable manner. We describe an Android-specific program analysis technique capable of generating a large number of test cases for fuzzing an app, as well as a test bed that given the generated test cases, executes them in parallel on numerous emulated Androids running on the cloud.

A Systematic Mapping Study of Empirical Studies on Software Cloud Testing Methods

“…The study [33] uses a prototype framework for load balancing implemented with OpenStack with 63 hosts and 400 requests, comparing the proposed method with other algorithms. A white-box automated security testing approach [34] for cloud-based Android apps is evaluated by an example run over 1,000 test cases using 100 parallel instances. The study [35] presents a testing approach with experiments evaluated on a combination of 1,000+ emulated instances and 10 actual devices.…”

Exploitation and Detection of a Malicious Mobile Application

“…Mahmood et al [22] presented a scalable dynamic analysis framework for evaluating Android application by utilizing the cloud. The platform utilizes robotium test automation in order to perform fuzz and dynamic analysis on android applications.…”

An Approach to Mobile Application Testing Based on Natural Language Scripting

“…Engineers can use this tool to detect race conditions and deadlocks based on UML state machines and symbolic execution. Mahmood and his colleagues [2] use a white-box approach to generate test cases with two program-based models (call graph and architectural) to achieve mobile program code coverage. Many black-box testing techniques are useful in mobile apptesting.…”

“…Testing mobile apps on different mobile platforms and various devices becomes very costly and tedious due to the fast upgrading of mobile devices, and rapid updates of mobile platforms and technologies. Testing mobile web applications on diverse mobile browsers on different devices become very difficult and costly due to increasing mobile scalability, constantly updates of mobile devices and mobile technologies, diversity of involved mobile web technology, and fast upgrading mobile application services [1,2,3,18].…”