Many Android App Developers Don’t Follow Basic Cryptography Rules

guest · Sep 8, 2020

Many Android App Developers Don’t Follow Basic Cryptography Rules
In some cases, the bugs were introduced by the deployment of popular Android libraries
September 8, 2020
https://www.technadu.com/android-app-developers-dont-follow-basic-cryptography-rules/197770/

A team of researchers from Columbia University has decided to mass-test 1,780 Android applications, sampling the most popular ones from 33 Play Store categories. The team focused on the cryptography aspect of the apps’ code, and whether or not the developers followed basic rules in the field. Not only many of them didn’t, but most of the developers didn’t bother to fix anything even after the researchers contacted them.

The researchers contacted the developers behind the 306 unsafe apps, some of which have more than 100 million downloads. Of the 306 developers, only 18 answered the email, and from there, only a subset of eight developers took the discussion further.
Click to expand...

All in all, there was nothing fixed, neither on the libraries nor on the apps, so all of the discovered flaws remain.
A notable aspect of this report is that we’re talking about top-rated and highly popular apps whose development teams should have the financial resources to employ security and cryptography experts.

[...] CRYLOGGER has been made available on GitHub.
Click to expand...

CRYLOGGER: Detecting Crypto Misuses Dynamically

This paper presents CRYLOGGER, the first open-source tool to detect crypto misuses dynamically. CRYLOGGER logs the parameters that are passed to the crypto APIs during the execution and checks their legitimacy offline by using a list of crypto rules. We compare CRYLOGGER with CryptoGuard, one of the most effective static tools to detect crypto misuses.
Click to expand...

Log in or Sign up

Many Android App Developers Don’t Follow Basic Cryptography Rules

guest Guest

Log in or Sign up

Many Android App Developers Don’t Follow Basic Cryptography Rules

guest Guest

Useful Searches