CDRep: Automatic repair of cryptographic-misuses in Android applications

• Main Authors: MA, Siqi, LO, David, LI, Teng, DENG, Robert H.
• Format: text
• Language: English
• Published: Institutional Knowledge at Singapore Management University 2016
• Subjects: vulnerability detection; cryptographic misuse; automated program repair; Computer Sciences; Information Security; Software Engineering
• Online Access: https://ink.library.smu.edu.sg/sis_research/3733; https://ink.library.smu.edu.sg/context/sis_research/article/4735/viewcontent/CDRep_AsiaCCS_2016_afv.pdf
• Institution: Singapore Management University

Cryptography is increasingly being used in mobile applications to provide various security services; from user authentication, data privacy, to secure communications. However, there are plenty of mistakes that developers could accidentally make when using cryptography in their mobile apps and such mistakes can lead to a false sense of security. Recent research efforts indeed show that a significant portion of mobile apps in both Android and iOS platforms misused cryptographic APIs. In this paper, we present CDRep, a tool for automatically repairing cryptographic misuse defects in Android apps. We classify such defects into seven types and manually assemble the corresponding fix patterns based on the best practices in cryptographic implementations. CDRep consists of two phases, a detection phase which identifies defect locations in a mobile app and a repair phase which repairs the vulnerable app automatically. In our validation, CDRep is able to successfully repair 94.5% of 1,262 vulnerable apps. Furthermore, CDRep is lightweight, the average runtime to generate a patch is merely 19.3 seconds and the size of a repaired app increases by only 0.667% on average.