Security Smells in Android

TL;DR

This paper identifies security vulnerabilities in Android apps through security code smells, explains how to mitigate them, and introduces a static analysis tool tested on thousands of apps to improve security practices.

Contribution

It provides a comprehensive review of Android security vulnerabilities, defines security code smells, and develops a static analysis tool for vulnerability detection.

Findings

The static analysis tool detects several vulnerabilities in approximately 46,000 apps.

Security code smells correlate with specific Android vulnerabilities.

Mitigating security smells can improve app security during development.

Abstract

The ubiquity of smartphones, and their very broad capabilities and usage, make the security of these devices tremendously important. Unfortunately, despite all progress in security and privacy mechanisms, vulnerabilities continue to proliferate. Research has shown that many vulnerabilities are due to insecure programming practices. However, each study has often dealt with a specific issue, making the results less actionable for practitioners. To promote secure programming practices, we have reviewed related research, and identified avoidable vulnerabilities in Android-run devices and the "security code smells" that indicate their presence. In particular, we explain the vulnerabilities, their corresponding smells, and we discuss how they could be eliminated or mitigated during development. Moreover, we develop a lightweight static analysis tool and discuss the extent to which it successfully detects several vulnerabilities in about 46,000 apps hosted by the official Android market.