Up-To-Crash: Evaluating Third-Party Library Updatability on Android

Abstract

Buggy and flawed third-party libraries increase their host app's attack surface and put the users' privacy at risk. To avert this risk, libraries have to be kept updated to their newest versions by the app developers that integrate them into their projects. Recent researches revealed that the prevalence of outdated third-party libraries in Android apps is indeed a rampant problem, but also suggested that there is a great opportunity for drop-in replacements of outdated libraries, which would not even require cooperation by the app developers to update the libraries. However, all those conclusions are based on static app analysis, which can only provide an abstract view.In this work, we extend the updatability analysis to the runtime of apps. We implement a solution to update third-party libraries with drop-in replacements by their newer versions. To verify the feasibility of this developer-independent update mechanism, we dynamically test 3,000 real world apps for 3 popular libraries (78 library versions) for runtime failures stemming from incompatible library updates. To investigate the updatability of libraries in-depth, exploration enhanced dynamic testing is adopted to monitor the runtime behaviors of 15 apps before and after library updating. From our test, we find that the prior reported updatability rate is under real conditions overestimated by a factor of 1.57-2.06. Through root cause analysis, we find that the underlying problems prohibiting easy updates are intricate, such as deprecated functions, changed data structures, or entangled dependencies between different libraries and even the host app. We think our results not only put a more realistic light on the library updatability problem in Android, but also provide valuable insights for future solutions that provide automatic library updates or that try to support the app developers in better maintaining their external dependencies.

Vuln4Real: A Methodology for Counting Actually Vulnerable Dependencies

“…A user of a library can fix all vulnerabilities by accessing and modifying the code base of dependencies, but developers tend to avoid it [7]. Equally, 'simply updating' ain't so simple [8]. ment tools such as Apache Ivy 5 and Apache Maven 6 :…”

“…• A dependency is direct if it is directly invoked from the dependent library instance. • A dependency tree 8 is a representation of a software library instance and its dependencies where each node is a library instance and edges connect dependent library instances to their direct dependencies. • A transitive dependency is connected to the root library instance of a dependency tree through a path with more than one edge.…”

A Qualitative Study of Dependency Management and Its Security Implications

“…Developers are wary of updating their dependencies if they work as intended. A follow up quantitative study [20] found that the most likely reason that stops developers from updating dependencies are breaking changes due to deprecated functions, changed data structures, or entangled dependencies between different libraries and even the host app. Limited insights are provided on the developers' motivations for performing an update of each kind (functionality or security).…”

“…On the Android ecosystem, mobile app developers do not consider security as a top-priority task [11]. A later study by the same group [20] explained the reason behind it as a major clash with functionality: the 'easy' updates would actually break around 50% of dependent projects.…”

Up2Dep: Android Tool Support to Fix Insecure Code Dependencies

“…While during our evaluation, we did not consider transitive dependencies, we also have seen that the problems of transitive dependency with regards to library updatability is a corner case, e.g., only 2 instances of the false positives. Also existing research [28] on the updatability of third-party libraries shows that only 1.7% of the library API could be affected by this problem (referred to as entangled dependencies). Still we see a potential threat to the security of Android apps due to transitive dependencies.…”