Understanding the Origins of Mobile App Vulnerabilities: A Large-Scale Measurement Study of Free and Paid Apps

Watanabe, Takahiro; Akiyama, Mitoshi; Kanei, Fumihiro; Shioji, Eitaro; Takata, Yuta; Sun, Bo; Ishi, Yuta; Shibahara, Toshiki; Yagi, T.; Mori, Tatsuya

doi:10.1109/msr.2017.23

Cited by 33 publications

(28 citation statements)

References 15 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…Therefore more focus should be given on the analysis of libraries and market maintainers could draw policies rejecting apps using non-vetted libraries. Moreover, the claim made in [71] that more code and libraries imply more vulnerabilities may not be always true.…”

Section: Vulnerability Introduction Vehiclecontrasting

(Expert classified)

“…In addition to new findings, this large scale study also confirms most of the conclusions from previous studies with relatively small datasets. However, the result of this study also suggests that the recent claim made by Watanabe et al [71] that more code and libraries imply more vulnerabilities may not be always true. Finally, 3 valuable artifacts produced by this study: 1) app lineages, 2) the complete dataset of vulnerability scanning reports, 3) recorded vulnerable pieces of code, are shared.…”

Section: Resultscontrasting

confidence: 41%

“…OS vulnerabilities have also been investigated by Thomas et al [109] to assess the lifetime of vulnerabilities on devices even after OS updates are provided. Closely related to our work is the study by Watanabe et al [71] where authors investigated the location of vulnerabilities in mobile apps. Our work extends and scales their study to a significantly larger dataset.…”

Section: Related Workmentioning

confidence: 95%

“…The recent "heartbleed" [66] and "stagefright" [67], [68], [69] vulnerabilities in the SSL library and the media framework have left the majority of apps vulnerable and served as a reminder on the unfortunate reality of insecure libraries [70]. A recent study by Watanabe et al [71] has even concluded that over 50% of vulnerabilities of free/paid Android apps stem from third-party libraries. We partially replicate their study at a larger scale.…”

Section: Research Questionsmentioning

confidence: 99%

See 3 more Smart Citations

Understanding the Evolution of Android App Vulnerabilities

Gao

Kong

et al. 2021

IEEE Trans. Rel.

View full text Add to dashboard Cite

The Android ecosystem today is a growing universe of a few billion devices, hundreds of millions of users and millions of applications targeting a wide range of activities where sensitive information is collected and processed. Security of communication and privacy of data are thus of utmost importance in application development. Yet, regularly, there are reports of successful attacks targeting Android users. While some of those attacks exploit vulnerabilities in the Android OS, others directly concern application-level code written by a large pool of developers with varying experience. Recently, a number of studies have investigated this phenomenon, focusing however only on a specific vulnerability type appearing in apps, and based on only a snapshot of the situation at a given time. Thus, the community is still lacking comprehensive studies exploring how vulnerabilities have evolved over time, and how they evolve in a single app across developer updates. Our work fills this gap by leveraging a data stream of 5 million app packages to reconstruct versioned lineages of Android apps and finally obtained 28,564 app lineages (i.e., successive releases of the same Android apps) with more than 10 app versions each, corresponding to a total of 465,037 apks. Based on these app lineages, we apply stateof-the-art vulnerability-finding tools and investigate systematically the reports produced by each tool. In particular, we study which types of vulnerabilities are found, how they are introduced in the app code, where they are located, and whether they foreshadow malware. We provide insights based on the quantitative data as reported by the tools, but we further discuss the potential false positives. Our findings and study artifacts constitute a tangible knowledge to the community. It could be leveraged by developers to focus verification tasks, and by researchers to drive vulnerability discovery and repair research efforts.

show abstract

Section: Vulnerability Introduction Vehiclecontrasting

(Expert classified)

Section: Resultscontrasting

confidence: 41%

Section: Related Workmentioning

confidence: 95%

Section: Research Questionsmentioning

confidence: 99%

See 2 more Smart Citations

Understanding the Evolution of Android App Vulnerabilities

Gao

Kong

et al. 2021

IEEE Trans. Rel.

View full text Add to dashboard Cite

show abstract

“…Issue: Many third-party libraries are unsafe by design i.e., introduce vulnerabilities and compromise user data [37]. Consequently, the ramification of adopting such libraries could be manifold.…”

Section: • Untrustworthy Librariesmentioning

confidence: 99%

Security Smells in Android

Ghafari

Gadient

Nierstrasz

2017

2017 IEEE 17th International Working Conference on Source Code Analysis and Manipulation (SCAM)

View full text Add to dashboard Cite

The ubiquity of smartphones, and their very broad capabilities and usage, make the security of these devices tremendously important. Unfortunately, despite all progress in security and privacy mechanisms, vulnerabilities continue to proliferate.Research has shown that many vulnerabilities are due to insecure programming practices. However, each study has often dealt with a specific issue, making the results less actionable for practitioners.To promote secure programming practices, we have reviewed related research, and identified avoidable vulnerabilities in Android-run devices and the security code smells that indicate their presence. In particular, we explain the vulnerabilities, their corresponding smells, and we discuss how they could be eliminated or mitigated during development. Moreover, we develop a lightweight static analysis tool and discuss the extent to which it successfully detects several vulnerabilities in about 46 000 apps hosted by the official Android market.

show abstract