CRYLOGGER: Detecting Crypto Misuses Dynamically
CRYLOGGER: Detecting Crypto Misuses Dynamically
复制标题
DOI：
10.1109/sp40001.2021.00010
复制
发表时间：
2020-07
期刊：
影响因子：
--
通讯作者：
Luca Piccolboni;G. D. Guglielmo;L. Carloni;S. Sethumadhavan
中科院分区：
文献类型：
--
作者：
Luca Piccolboni;G. D. Guglielmo;L. Carloni;S. Sethumadhavan
加密(加密)算法是所有安全系统的基本组成部分：例如，加密散列函数和加密算法可以保证完整性和机密性等属性。然而，开发人员可以通过使用常量密钥和弱密码来滥用此类算法的应用程序编程接口(API)。本文介绍了第一个动态检测密码滥用的开源工具CRYLOGGER。CRYLOGGER记录在执行过程中传递给加密API的参数，并使用加密规则列表离线检查它们的合法性。我们比较了CRYLOGGER和CryptoGuard，CryptoGuard是检测密码滥用的最有效的静态工具之一。我们表明，我们的工具补充了CryptoGuard的结果，为结合静态和动态方法奠定了基础。我们分析了从Google Play商店下载的1780个流行的Android应用程序，表明CRYLOGGER可以动态和自动地检测数千个应用程序上的密码滥用。我们对28个Android应用程序进行了反向工程，并确认了CRYLOGGER标记的问题。我们还向应用程序开发人员披露了最严重的漏洞，并收集了他们的反馈。
Cryptographic (crypto) algorithms are the essential ingredients of all secure systems: crypto hash functions and encryption algorithms, for example, can guarantee properties such as integrity and confidentiality. Developers, however, can misuse the application programming interfaces (API) of such algorithms by using constant keys and weak passwords. This paper presents CRYLOGGER, the first open-source tool to detect crypto misuses dynamically. CRYLOGGER logs the parameters that are passed to the crypto APIs during the execution and checks their legitimacy offline by using a list of crypto rules. We compared CRYLOGGER with CryptoGuard, one of the most effective static tools to detect crypto misuses. We show that our tool complements the results of CryptoGuard, making the case for combining static and dynamic approaches. We analyzed 1780 popular Android apps downloaded from the Google Play Store to show that CRYLOGGER can detect crypto misuses on thousands of apps dynamically and automatically. We reverse-engineered 28 Android apps and confirmed the issues flagged by CRYLOGGER. We also disclosed the most critical vulnerabilities to app developers and collected their feedback.