Finding flaws from password authentication code in Android apps

• Main Authors: MA, Siqi, BERTINO, Elisa, NEPAL, Surya, LI, Jianru, DIETHELM, Ostry, DENG, Robert H., JHA, Sanjay
• Format: text
• Language: English
• Published: Institutional Knowledge at Singapore Management University 2019
• Subjects: Authentication protocol flaws; Automated program analysis; Mobile application security; Password authentication protocol; Vulnerability detection; Information Security
• Online Access: https://ink.library.smu.edu.sg/sis_research/4511; https://ink.library.smu.edu.sg/context/sis_research/article/5514/viewcontent/esorics19.pdf
• Institution: Singapore Management University

Password authentication is widely used to validate users’ identities because it is convenient to use, easy for users to remember, and simple to implement. The password authentication protocol transmits passwords in plaintext, which makes the authentication vulnerable to eavesdropping and replay attacks, and several protocols have been proposed to protect against this. However, we find that secure password authentication protocols are often implemented incorrectly in Android applications (apps). To detect the implementation flaws in password authentication code, we propose GLACIATE, a fully automated tool combining machine learning and program analysis. Instead of creating detection templates/rules manually, GLACIATE automatically and accurately learns the common authentication flaws from a relatively small training dataset, and then identifies whether the authentication flaws exist in other apps. We collected 16,387 apps from Google Play for evaluation. GLACIATE successfully identified 4,105 of these with incorrect password authentication implementations. Examining these results, we observed that a significant proportion of them had multiple flaws in their authentication code. We further compared GLACIATE with the state-of-the-art techniques to assess its detection accuracy.