论文标题
安全气味在Android中
Security Smells in Android
论文作者
论文摘要
智能手机的普遍性及其非常广泛的功能和用法使这些设备的安全非常重要。不幸的是，尽管安全性和隐私机制取得了所有进展，但脆弱性仍在繁殖。研究表明，许多漏洞是由于编程不安全造成的。但是，每项研究经常处理一个特定的问题，从而使从业人员的结果降低了。为了促进安全的编程实践，我们已经审查了相关的研究，并确定了Android运行设备中的可避免的漏洞以及表明其存在的“安全密码气味”。特别是，我们解释了脆弱性，它们相应的气味，并讨论了如何在开发过程中消除或减轻它们。此外，我们开发了一种轻巧的静态分析工具，并讨论了它成功地检测到官方Android市场托管的大约46,000个应用程序中的几个漏洞的程度。
The ubiquity of smartphones, and their very broad capabilities and usage, make the security of these devices tremendously important. Unfortunately, despite all progress in security and privacy mechanisms, vulnerabilities continue to proliferate. Research has shown that many vulnerabilities are due to insecure programming practices. However, each study has often dealt with a specific issue, making the results less actionable for practitioners. To promote secure programming practices, we have reviewed related research, and identified avoidable vulnerabilities in Android-run devices and the "security code smells" that indicate their presence. In particular, we explain the vulnerabilities, their corresponding smells, and we discuss how they could be eliminated or mitigated during development. Moreover, we develop a lightweight static analysis tool and discuss the extent to which it successfully detects several vulnerabilities in about 46,000 apps hosted by the official Android market.
