A Comparative Study of Misapplied Crypto in Android and iOS Applications

Research output: Chapter in Book/Report/Conference proceedingConference contributionResearchpeer-review

Abstract

Many applications for Android and iOS process sensitive data and, therefore, rely on cryptographic APIs natively provided by the operating system. For this to be effective, essential rules need to be obeyed, as otherwise the attainable level of security would be weakened or entirely defeated. In this paper, we inspect the differences between Android and iOS concerning the proper usage of platform-specific APIs for cryptography. For both platforms, we present concrete strategies to detect critical mistakes and introduce a new framework for Android that excels in pinpointing the origin of problematic security attributes. Applied on real-world apps with cryptography, we find that out of 775 investigated apps that vendors distribute for both Android and iOS, 604 apps for iOS (78%) and 538 apps for Android (69%) suffer from at least one security misconception.
Original languageEnglish
Title of host publicationProceedings of the 16th International Joint Conference on e-Business and Telecommunications - Volume 2: SECRYPT
Place of PublicationPortugal
PublisherSciTePress
Pages96-108
Number of pages12
ISBN (Electronic)978-989-758-378-0,
DOIs
Publication statusPublished - 2019
Event16th International Conference on Security and Cryptography - Prague, Czech Republic
Duration: 26 Jul 201928 Jul 2019
http://www.secrypt.icete.org/?y=2019

Conference

Conference16th International Conference on Security and Cryptography
Abbreviated titleSECRYPT 2019
CountryCzech Republic
CityPrague
Period26/07/1928/07/19
Internet address

Fingerprint

Application programs
Application programming interfaces (API)
Cryptography
iOS (operating system)
Android (operating system)

Keywords

  • Static Analysis
  • Slicing
  • Android
  • iOS
  • Cryptography
  • Application Security

Cite this

Feichtner, J. (2019). A Comparative Study of Misapplied Crypto in Android and iOS Applications. In Proceedings of the 16th International Joint Conference on e-Business and Telecommunications - Volume 2: SECRYPT (pp. 96-108). Portugal: SciTePress. https://doi.org/10.5220/0007915300960108

A Comparative Study of Misapplied Crypto in Android and iOS Applications. / Feichtner, Johannes.

Proceedings of the 16th International Joint Conference on e-Business and Telecommunications - Volume 2: SECRYPT. Portugal : SciTePress, 2019. p. 96-108.

Research output: Chapter in Book/Report/Conference proceedingConference contributionResearchpeer-review

Feichtner, J 2019, A Comparative Study of Misapplied Crypto in Android and iOS Applications. in Proceedings of the 16th International Joint Conference on e-Business and Telecommunications - Volume 2: SECRYPT. SciTePress, Portugal, pp. 96-108, 16th International Conference on Security and Cryptography, Prague, Czech Republic, 26/07/19. https://doi.org/10.5220/0007915300960108
Feichtner J. A Comparative Study of Misapplied Crypto in Android and iOS Applications. In Proceedings of the 16th International Joint Conference on e-Business and Telecommunications - Volume 2: SECRYPT. Portugal: SciTePress. 2019. p. 96-108 https://doi.org/10.5220/0007915300960108
Feichtner, Johannes. / A Comparative Study of Misapplied Crypto in Android and iOS Applications. Proceedings of the 16th International Joint Conference on e-Business and Telecommunications - Volume 2: SECRYPT. Portugal : SciTePress, 2019. pp. 96-108
@inproceedings{59cd6725a2f04c02a3def2685b34cab1,
title = "A Comparative Study of Misapplied Crypto in Android and iOS Applications",
abstract = "Many applications for Android and iOS process sensitive data and, therefore, rely on cryptographic APIs natively provided by the operating system. For this to be effective, essential rules need to be obeyed, as otherwise the attainable level of security would be weakened or entirely defeated. In this paper, we inspect the differences between Android and iOS concerning the proper usage of platform-specific APIs for cryptography. For both platforms, we present concrete strategies to detect critical mistakes and introduce a new framework for Android that excels in pinpointing the origin of problematic security attributes. Applied on real-world apps with cryptography, we find that out of 775 investigated apps that vendors distribute for both Android and iOS, 604 apps for iOS (78{\%}) and 538 apps for Android (69{\%}) suffer from at least one security misconception.",
keywords = "Static Analysis, Slicing, Android, iOS, Cryptography, Application Security",
author = "Johannes Feichtner",
year = "2019",
doi = "10.5220/0007915300960108",
language = "English",
pages = "96--108",
booktitle = "Proceedings of the 16th International Joint Conference on e-Business and Telecommunications - Volume 2: SECRYPT",
publisher = "SciTePress",
address = "Portugal",

}

TY - GEN

T1 - A Comparative Study of Misapplied Crypto in Android and iOS Applications

AU - Feichtner, Johannes

PY - 2019

Y1 - 2019

N2 - Many applications for Android and iOS process sensitive data and, therefore, rely on cryptographic APIs natively provided by the operating system. For this to be effective, essential rules need to be obeyed, as otherwise the attainable level of security would be weakened or entirely defeated. In this paper, we inspect the differences between Android and iOS concerning the proper usage of platform-specific APIs for cryptography. For both platforms, we present concrete strategies to detect critical mistakes and introduce a new framework for Android that excels in pinpointing the origin of problematic security attributes. Applied on real-world apps with cryptography, we find that out of 775 investigated apps that vendors distribute for both Android and iOS, 604 apps for iOS (78%) and 538 apps for Android (69%) suffer from at least one security misconception.

AB - Many applications for Android and iOS process sensitive data and, therefore, rely on cryptographic APIs natively provided by the operating system. For this to be effective, essential rules need to be obeyed, as otherwise the attainable level of security would be weakened or entirely defeated. In this paper, we inspect the differences between Android and iOS concerning the proper usage of platform-specific APIs for cryptography. For both platforms, we present concrete strategies to detect critical mistakes and introduce a new framework for Android that excels in pinpointing the origin of problematic security attributes. Applied on real-world apps with cryptography, we find that out of 775 investigated apps that vendors distribute for both Android and iOS, 604 apps for iOS (78%) and 538 apps for Android (69%) suffer from at least one security misconception.

KW - Static Analysis

KW - Slicing

KW - Android

KW - iOS

KW - Cryptography

KW - Application Security

U2 - 10.5220/0007915300960108

DO - 10.5220/0007915300960108

M3 - Conference contribution

SP - 96

EP - 108

BT - Proceedings of the 16th International Joint Conference on e-Business and Telecommunications - Volume 2: SECRYPT

PB - SciTePress

CY - Portugal

ER -