Stack Overflow Considered Harmful? The Impact of Copy&Paste on Android Application Security

Abstract

Abstract-Online programming discussion platforms such as Stack Overflow serve as a rich source of information for software developers. Available information include vibrant discussions and oftentimes ready-to-use code snippets. Previous research identified Stack Overflow as one of the most important information sources developers rely on. Anecdotes report that software developers copy and paste code snippets from those information sources for convenience reasons. Such behavior results in a constant flow of community-provided code snippets into production software. To date, the impact of this behaviour on code security is unknown.We answer this highly important question by quantifying the proliferation of security-related code snippets from Stack Overflow in Android applications available on Google Play. Access to the rich source of information available on Stack Overflow including ready-to-use code snippets provides huge benefits for software developers. However, when it comes to code security there are some caveats to bear in mind: Due to the complex nature of code security, it is very difficult to provide ready-to-use and secure solutions for every problem. Hence, integrating a security-related code snippet from Stack Overflow into production software requires caution and expertise. Unsurprisingly, we observed insecure code snippets being copied into Android applications millions of users install from Google Play every day.To quantitatively evaluate the extent of this observation, we scanned Stack Overflow for code snippets and evaluated their security score using a stochastic gradient descent classifier. In order to identify code reuse in Android applications, we applied state-of-the-art static analysis. Our results are alarming: 15.4% of the 1.3 million Android applications we analyzed, contained security-related code snippets from Stack Overflow. Out of these 97.9% contain at least one insecure code snippet.

CryptoExplorer: An Interactive Web Platform Supporting Secure Use of Cryptography APIs

“…In the case of navigating large files, there are two buttons that assist users to jump to the highlighted lines quickly. Under each returned example, users can read related information regarding the example's misuses (3). Finally, users can navigate for more examples (4).…”

“…Code snippets obtained from online information sources are untrustworthy too. A study of 1.3 million Android apps showed that 196 403 (i.e., 15%) used vulnerable code snippets that were very likely copied from the Stack Overflow website [3]. Examination of 217 818 Stack Overflow posts also showed that 31% suffer from potential API misuses that could lead to unexpected behavior such as program crashes and resource leaks [4].…”

A UK Case Study on Cybersecurity Education and Accreditation

“…Another recommendation for future work is a comprehensive survey equivalent to [46] for Android textbooks; [50] looked specifically at the use of resources from Stack Overflow in Android applications.…”

Analyzing and Supporting Adaptation of Online Code Examples

“…SO examples are created for illustration purposes, which can serve as a good starting point. However, these examples may be insufficient to be ported to a production environment, as previous studies find that SO examples may suffer from API usage violations [7], insecure coding practices [8], unchecked obsolete usage [9], and incomplete code * Both the first author and the second author contributed significantly and this research is led by UCLA. fragments [10].…”