<script type="text/javascript">
<!--
document.write('<div id="oa_widget"></div>');
document.write('<script type="text/javascript" src="https://www.openaire.eu/index.php?option=com_openaire&view=widget&format=raw&projectId=undefined&type=result"></script>');
-->
</script>

COPY SCRIPT

For further information contact us at helpdesk@openaire.eu

Security code smells in Android ICC

descriptionPublicationkeyboard_double_arrow_right Article , Preprint , Other literature type 14 Dec 2018Embargo end date: 01 Jan 2018 Switzerland English Publisher:Springer Science and Business Media LLCJournal:Empirical Software Engineering, volume 24, pages 3,046-3,076 (issn: 1382-3256, eissn: 1573-7616,

Authors: Pascal Gadient; Mohammad Ghafari; Patrick Frischknecht; Oscar Nierstrasz;

doi: 10.1007/s10664-018-9673-y , 10.7892/boris.126932 , 10.48550/arxiv.1811.12713

arXiv: http://arxiv.org/abs/1811.12713

Security code smells in Android ICC

- Summary
- Subjects
- Related research
  (5)
- Metrics

Abstract

Android Inter-Component Communication (ICC) is complex, largely unconstrained, and hard for developers to understand. As a consequence, ICC is a common source of security vulnerability in Android apps. To promote secure programming practices, we have reviewed related research, and identified avoidable ICC vulnerabilities in Android-run devices and the security code smells that indicate their presence. We explain the vulnerabilities and their corresponding smells, and we discuss how they can be eliminated or mitigated during development. We present a lightweight static analysis tool on top of Android Lint that analyzes the code under development and provides just-in-time feedback within the IDE about the presence of such smells in the code. Moreover, with the help of this tool we study the prevalence of security code smells in more than 700 open-source apps, and manually inspect around 15% of the apps to assess the extent to which identifying such smells uncovers ICC security vulnerabilities.

Accepted on 28 Nov 2018, Empirical Software Engineering Journal (EMSE), 2018

Country

Switzerland

Related Organizations

University of Bern
Switzerland

Keywords

Software Engineering (cs.SE), FOS: Computer and information sciences, Computer Science - Software Engineering, Computer Science - Cryptography and Security, 000 Computer science, knowledge & systems, Cryptography and Security (cs.CR)

5 Research products, page 1 of 1

DroidBench software on GitHub
IsRelatedTo
open-source-android-apps software on GitHub
IsRelatedTo
android-app-vulnerability-benchmarks software on Bitbucket
IsRelatedTo
cloc software on GitHub
IsRelatedTo
AndroidLintSecurityChecks software on GitHub
IsRelatedTo

Impact byBIP!

	citations This is an alternative to the "Influence" indicator, which also reflects the overall/total impact of an article in the research community at large, based on the underlying citation network (diachronically).	29
	popularity This indicator reflects the "current" impact/attention (the "hype") of an article in the research community at large, based on the underlying citation network.	Top 10%
	influence This indicator reflects the overall/total impact of an article in the research community at large, based on the underlying citation network (diachronically).	Top 10%
	impulse This indicator reflects the initial momentum of an article directly after its publication, based on the underlying citation network.	Top 10%