The Mobile Standards and Analysis research extends CERT Secure Coding Standards and our software analysis ( SCALe) research and development to mobile platforms, including Android, iOS (iPhone and iPad), and Windows Phone 8. Most of our work so far has been for the Android platform.
Mobile Standards and Analysis research began with a focus on the Android platform, because it dominates the worldwide smartphone market. Our approach includes research and development of secure coding rules and guidelines for Android apps, plus research and development of compliance-checkers with respect to secure coding rules and guidelines.
Our team is currently enhancing an Android app set analyzer we developed that looks for taint flows, where a data source is sensitive, and a dataflow containing it can reach a sink. The research challenge we focus on is to develop an analysis to determine taint flow endpoints with the following (sometimes conflicting) goals in mind: precision, soundness, speed, and conservation of memory/disk space.
As part of the work on the taint flow checker, we designed and implemented a novel taint flow analyzer for sets of apps. It combines and augments the existing Android dataflow analyses of
FlowDroid (which analyzes for intra-component taint flows) and
Epicc (which analyzes inter-component intent communication) to track both inter-component and intra-component dataflow in a set of Android applications. The two phases of the analysis are
The most recent enhancements made to DidFail are described in the technical report, Making DidFail Succeed: Enhancing the CERT Static Taint Analyzer for Android App Sets. Our most recent blog post about DidFail, An Enhanced Tool for Securing Android Apps, explains how an enterprise system could incorporate DidFail into its IT systems, and describes the DidFail improvements we are currently working on. Our initial paper, Android Taint Flow Analysis for App Sets (from the SOAP 2014 workshop), describes our analysis method, implementation, and experimental results. The initial analyzer is described in extended detail in Amar Bhosale's Master's thesis, Precise Static Analysis of Taint Flow for Android Application Sets.
DidFail is freely available. Read the instructions for downloading and building all versions from the source code. The instructions also include a pointer to an older, binary version of DidFail.
We are continuing to develop and improve the Android app set taint flow checker; if you are interested, please contact us for more information.
Some characteristics of the Android operating system and apps are listed below. These and many additional characteristics of this mobile platform must be considered to securely code for the platform.
We were recently awarded a grant for a new research project for iOS that will start in Fall 2014. In this research project, we will extend our mobile platform work to iOS by developing additional analysis for the static analyzer associated with Clang to check for violations of a prioritized list of secure coding rules. Clang has been integrated into Apple's XCode IDE, which is the primary tool for developing software for iOS and OS X. Catching rule violations early would prevent these errors from propagating throughout the code base and would allow developers to learn secure coding techniques while programming. New checkers would be submitted into the main trunk of Clang and integrated into XCode (as well as any other IDEs that support Clang integration) improving software security for all developers who use Clang.
Separately from that funded project, in the future we also would like to develop more analyses against unchecked guidelines in The CERT Oracle Secure Coding Standard for Java and integrate many of these analyses into Eclipse and/or Oracle JDeveloper so that analysis results would be immediately available to Android platform developers.
We are poised to expand this research; if you are interested, please contact us for more information.
Some characteristics of the iOS (iPhone and iPad) operating system and its apps are listed below. These and many additional characteristics of this mobile platform must be considered to create securely coded apps for it.
Potential collaborators and others interested in Windows Phone 8 secure coding research projects are invited to contact us.
Some characteristics of the Windows Phone 8 operating system and its apps are listed below. These and many additional characteristics of this mobile platform must be considered to securely code for it.
Contribute to the CERT Secure Coding Standards wiki to help develop Android standards that work in the real world.