More Apps More Problems
0 likes234 views
The document discusses risk and defines it as the possibility of loss or injury. It then discusses crowd sourcing security testing and outlines some of the current inadequate solutions such as expensive security consultants, tools that don't scale, and developers who prioritize functionality over security. The document then summarizes the results of analyzing over 53,000 Android applications, finding most request GPS and contact permissions and lists the top third party libraries used. It concludes by proposing a whitelisting approach to security testing using static analysis and an unbiased third party.
More Apps More Problems
- 4. Risk - noun `risk The possibility of loss or injury
- 5. • • • • • • • • • • • • • • • • • • • • •
- 6. • • • • • • • • • • • • • • • • •
- 10. • • • • •
- 11. • • • • • •
- 12. • • • • •
- 13. • • • • • • •
- 17. • • • • • •
- 18. • • • •
- 19. • ‣ ‣ • ‣ ‣
- 20. • ‣ • ‣ ‣
- 26. • ‣ ‣ •
- 30. Crowd Sourced Current Solutions Inadequate Internal Teams Developers Dev Site A Dev Site B Security Consultants • Very expensive • In short supply iPhone • Time to results too long Dev Site C Apps Crowd Internal Sourcing Tools • Do not scale across sites Open 3rd Party • Very high noise ratio Source Open Software Software Vendors • Can not test 3rd party code Source SYMC MSFT • Separation of duties issue Outsourced Developers Offshore • Do not know how to write Oracle secure code Provider • Prioritize time-to-ship, functionality over security Processes • Difficult to implement Eastern China • Years to fine tune Europe India • Low adoption (< 1% of US Contractors companies CMMI Level 5 certified) Unknown Skills
- 31. 53,000 Applications Analyzed Android Market: ~48,000 3rd Party Markets: ~5,000 Permissions Requested Average: 3 Most Requested: 117 Top “Interesting” Permissions GPS information: 24% (11,929) Read Contacts: 8% (3,626) Send SMS: 4% (1,693) Receive SMS: 3% (1262) Record Audio: 2% (1100) Read SMS: 2% (832) Process Out Calls: 1% (323) Use Credentials : 0.5% (248)
- 33. 52,000 Applications Analyzed • Android Market: • 3rd Party Markets: Third Party Libraries • Total Third Party Libraries: • Top Shared Libraries - - - - - - - -
- 35. • • ‣ • •
- 36. • • •
- 37. Whitelisting • Conduct static analysis of candidate applications • Create a whitelist • Use an unbiased 3rd party • Enforcement via mobile policy