Systematic Mutation-Based Evaluation of the Soundness of Security-Focused Android Static Analysis Techniques

Abstract

Mobile application security has been a major area of focus for security research over the course of the last decade. Numerous application analysis tools have been proposed in response to malicious, curious, or vulnerable apps. However, existing tools, and specifically, static analysis tools, trade soundness of the analysis for precision and performance and are hence sound y . Unfortunately, the specific unsound choices or flaws in the design of these tools is often not known or well documented, leading to misplaced confidence among researchers, developers, and users. This article describes the Mutation-Based Soundness Evaluation (μSE) framework, which systematically evaluates Android static analysis tools to discover, document, and fix flaws, by leveraging the well-founded practice of mutation analysis. We implemented μSE and applied it to a set of prominent Android static analysis tools that detect private data leaks in apps. In a study conducted previously, we used μSE to discover 13 previously undocumented flaws in FlowDroid, one of the most prominent data leak detectors for Android apps. Moreover, we discovered that flaws also propagated to other tools that build upon the design or implementation of FlowDroid or its components. This article substantially extends our μSE framework and offers a new in-depth analysis of two more major tools in our 2020 study; we find 12 new, undocumented flaws and demonstrate that all 25 flaws are found in more than one tool, regardless of any inheritance-relation among the tools. Our results motivate the need for systematic discovery and documentation of unsound choices in soundy tools and demonstrate the opportunities in leveraging mutation testing in achieving this goal.

Estrategias para Identificar y Mitigar Vulnerabilidades de Inyección SQL en Aplicaciones Móviles Android: Revisión Bibliográfica

“…Desde otro punto de vista orientado a herramientas de identificación, para determinar el originan de vulnerabilidades como, inyección SQL, el estudio realizado por (Ami et al, 2021), resalta la importancia del framework μSE que permite generar de forma sistemática aplicaciones modificadas con comportamientos no deseados insertados, con el fin de evaluar de manera exhaustiva las capacidades y limitaciones de herramientas de análisis estático en la identificación de dichos comportamientos. A través del análisis pormenorizado de los casos falsos negativos, μSE facilita la detección de suposiciones y lagunas en las herramientas existentes, orientando al desarrollo de nuevas técnicas que mejoren la identificación de vulnerabilidades, en base a este antecedente, este método brinda la posibilidad de descubrir de dónde y cómo se producen las vulnerabilidades en las aplicaciones Android, por medio de la herramienta que genera sistemáticamente aplicaciones modificadas con comportamientos no deseados insertados.…”