NLEU: A Semantic-based Taint Analysis for Vetting Apps in Android

To increase and maintain web application security, developers could use some different methods, one of them is static code analysis. This method could find security vulnerabilities inside a source code without the need of running the program. It could also be automated by using tools, which considered more efficient than manual reviews. One specific method which is commonly used in static code analysis is taint analysis. Taint analysis usually utilizes source code modeling to prepare the code for analysis process to detect any untrusted data flows into security sensitives computations. While this kind of analysis could be very helpful, static code analysis tool for Laravel-based web application is still quite rare, despite its popularity. Therefore, in this research, we want to know how static code (taint) analysis could be utilized to detect security vulnerabilities and how the projects (Laravel-based) should be modeled in order to facilitate this analysis. We then developed a static analysis tool, which models the application’s source code using AST and dictionary to be used as the base of the taint analysis. The tool first parsed the route file of Laravel project to get a list of controller files. Each file in that list would be parsed in order to build the source code representation, before actually being analyzed using taint analysis method. The experiments was done using this tool shows that the tools (with taint analysis) could detect 13 security vulnerabilities from 6 Laravel-based projects with one False Negative. An ineffective sanitizer was the suspected cause of this False Negative. This also shows that proposed modeling technique could be helpful in facilitating taint analysis in Laravel-based projects. For future development and studies, this tool should be tested with more Laravel and even other framework based web application with a wider range of security vulnerabilities.

The dramatic rise of Android application (app) marketplaces has significantly gained the success of convenience for mobile users. Consequently, with the advantage of numerous Android apps, Android malware seizes the opportunity to steal privacy-sensitive data by pretending to provide functionalities as benign apps do. To distinguish malware from millions of Android apps, researchers have proposed sophisticated static and dynamic analysis tools to automatically detect and classify malicious apps. Most of these tools, however, rely on manual configuration of lists of features based on permissions, sensitive resources, intents, etc., which are difficult to come by. To address this problem, we study real-world Android apps to mine hidden patterns of malware and are able to extract highly sensitive APIs that are widely used in Android malware. We also implement an automated malware detection system, MalPat, to fight against malware and assist Android app marketplaces to address unknown malicious apps. Comprehensive experiments are conducted on our dataset consisting of 31 185 benign apps and 15 336 malware samples. Experimental results show that MalPat is capable of detecting malware with a high $F_1$ score (98.24%) comparing with the state-of-the-art approaches.

As many malicious apps have been distributed in Android markets, it is urgent to fix the vulnerabilities exploited by these apps and develop effective mitigation methods. In this paper, we identify a common vulnerability in many Android apps. This vulnerability is rooted in an unprotected Android component, called "Activity". Utilizing this vulnerability, a malicious app can stealthily and cannily collect sensitive user data. To better understand this issue, we have built "ActivityHijacker", an app that can detect the right moment to hijack the Activity component and intercept a user's password while it is being inputted in real time. To assess the prevalence of this vulnerability, we further analyzed 8 Android OSs (version 2.x to 5.x) and 22 banking apps collected in January 2016 from various Android markets. Our results show that all these Android OSs and apps are susceptible to the vulnerability; 14 out of 22 banking apps can be hijacked without any prompts. We further present a mitigation mechanism that restricts the Activity component to authorized apps.

With the continuous growth in the usage of Android apps, ensuring their security has become critically important. An increasing number of malicious apps adopt anti-analysis techniques to evade security measures. Although some research has started to consider anti-runtime analysis (ARA), it is unfortunate that they have not systematically examined ARA techniques. Furthermore, the rapid evolution of ARA technology exacerbates the issue, leading to increasingly inaccurate analysis results. To effectively analyze Android apps, understanding their adopted ARA techniques is necessary. However, no systematic investigation has been conducted thus far. <p xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">In this paper, we conduct the first systematic study of the ARA implementations in a wide range of 117,270 Android apps (including both malicious and benign ones) collected between 2016 and 2023. Additionally, we propose a specific investigation tool named <small>ARAP</small> to assist this study by leveraging both static and dynamic analysis. According to the evaluation results, <small>ARAP</small> not only effectively identifies the ARA implementations in Android apps but also reveals many important findings. For instance, almost all apps have implemented at least one category of ARA technology (99.6% for benign apps and 97.0% for malicious apps).

The physics of objects smaller than an atom was once a single specialty. It was called nuclear physics because its main concern was the nature and structure of atomic nuclei. But in the last decade or so a separation has taken place between the physicists who studied subatomic matter at very high energies, the so-called particle physicists, and nuclear physicists proper. The particle physicists took as their domain the nature and behavior of individual particles, rather than collective entities like a nucleus. They have gone on to higher and higher energies and ever more startling discoveries in their search for the most fundamental constituents of matter. Lately the particle physicists have experienced a certain frustration. They have been having a hard time trying to mate theory and experiment, and many of the objects they have discovered are so ephemeral that some of them are beginning to wonder whether they have anything to do with the structure of stable matter. The structure of nuclei is fundamental to the structure of stable matter, and if it ever becomes well understood, the age-old dream of making the elements one desires instead of depending on what nature gives might be a step nearer. And among the nuclear structure physicists, there is a feeling of hope and an expectation that old frustrations are about to be relieved. The nuclear physicists are building a new generation of particle accelerators, which, they expect, will give them an entirely new dimension of information about nuclear structure. Heretofore their experiments have concerned the nucleus as a whole. Now they want to study the nucleus in more detail. They want to see how small regions of it look and how individual nuclear particles behave and interact with each other within the nucleus. So far they have not had the energy available to get such data. Technology is now allowing them to build the machines that will do it. And those are now being built at several sites in the U.S., as well as in the Soviet Union, Switzerland and Canada. The machines are commonly called meson factories because one of their primary functions is the production of copious beams of pi and mu mesons with which to probe nuclei. In some cases they also yield protons and negative hydrogen ions, hydrogen atoms with an extra electron each. Each of these particles interacts in a different way with the particles in the nucleus, and each gives a different perspective on nuclear structure. Putting the perspectives together, physicists hope, will give a comprehensive picture. The meson factories bring nuclear structure physics into an energy range, hundreds of millions of electron volts, where the physics has not usually been done. The energy is necessary to get the detailed information, but achieving the energy was not the major technological stumbling block in the construction of meson factories; intensity was the problem. The particle beams have to be very intense-contain a large number of particles-to make enough of the desired reactions happen to get meaningful data. Gradual improvements in beam handling techniques have made the management of very intense beams possible, but they still give designers problems with radioactivity. There are unique problems in the handling of intensely radioactive material in targets, says Dr. R. L. Burman of Los Alamos Scientific Laboratory, speaking of the now-building Los Alamos Meson Physics Facility. The solution, he says, is to design a so-called

Tuberculosis (TB) remains one of the most serious infectious diseases in the world and the rate of new cases continues to increase. The development of cheap and simple methodologies capable of identifying TB causing agents belonging to the Mycobacterium tuberculosis Complex (MTBC), at point-of-need, in particular in resource-poor countries where the main TB epidemics are observed, is of paramount relevance for the timely and effective diagnosis and management of patients. TB molecular diagnostics, aimed at reducing the time of laboratory diagnostics from weeks to days, still require specialised technical personnel and labour intensive methods. Recent nanotechnology-based systems have been proposed to circumvent these limitations. Here, we report on a paper-based platform capable of integrating a previously developed Au-nanoprobe based MTBC detection assay-we call it "Gold on Paper". The Au-nanoprobe assay is processed and developed on a wax-printed microplate paper platform, allowing unequivocal identification of MTBC members and can be performed without specialised laboratory equipment. Upon integration of this Au-nanoprobe colorimetric assay onto the 384-microplate, differential colour scrutiny may be captured and analysed with a generic "smartphone" device. This strategy uses the mobile device to digitalise the intensity of the colour associated with each colorimetric assay, perform a Red Green Blue (RGB) analysis and transfer relevant information to an off-site lab, thus allowing for efficient diagnostics. Integration of the GPS location metadata of every test image may add a new dimension of information, allowing for real-time epidemiologic data on MTBC identification.

Modern photon counting X-ray detectors offer energy resolving capabilities for every single photon interacting in the sensor layer. This provides a new dimension of information which could and should be used to improve image quality. As the energy dependance of X-ray attenuation is a characteristic for the material, one can gain information on the composition of the object by analysis of the attenuation as a function of energy. One possibility is the material reconstruction, where the areal densities of chosen basis materials are obtained in projective geometry. For instance, this method could be used not only to distinguish and identify contrast agent from other highly absorbing regions, but also to gain quantitative information on the specific material. We have successfully applied this technique to computed tomography with Monte-Carlo simulated data and investigated the properties of this approach. Material selective images are presented and image quality properties are evaluated. The Signal Difference to Noise Ratio (SDNR) in the material-reconstructed and in the conventional CT images are compared.

The visual recognition of Android malicious applications (Apps) is mainly focused on the binary classification using grayscale images, while the multiclassification of malicious App families is rarely studied. If we can visualize the Android malicious Apps as color images, we will get more features than using grayscale images. In this paper, a method of color visualization for Android Apps is proposed and implemented. Based on this, combined with deep learning models, a multiclassifier for the Android malicious App families is implemented, which can classify 10 common malicious App families. In order to better understand the behavioral characteristics of malicious Apps, we conduct a comprehensive manual analysis for a large number of malicious Apps and summarize 1695 malicious behavior characteristics as customized features. Compared with the App classifier based on the grayscale visualization method, it is verified that the classifier using the color visualization method can achieve better classification results. We use four types of Android App features: classes.dex file, sets of class names, APIs, and customized features as input for App visualization. According to the experimental results, we find out that using the customized features as the color visualization input features can achieve the highest detection accuracy rate, which is 96% in the ten malicious families.

In Alibaba, we have seen a growing demand for tracing data flow for scenarios such as data leak detection, change governance, and data consistency checking. Static taint analysis is a technique for such problems, and many approaches are proposed for high scalability and precision. This paper shares our experience in applying taint analysis in Alibaba. In particular, we find that the state-of-the-art taint analysis tool, FlowDroid, does not work well in our cases because our applications make heavy use of libraries, native methods and enterprise-specific frameworks, which impose two major challenges, scalability and implicit dependency, to FlowDroid. This paper presents ANTaint to address these problems. ANTaint improves scalability by expanding the call graph and applying taint propagation on demand for libraries, which account for majority of the program execution but only a small fraction propagates taints. To improve accuracy, we ensure to build a sound call graph with its core part having certain accuracy, and providing a more precise taint propagation model. The practice of applying ANTaint in the company workload validates the idea. According to an experiment on 60 production cases, ANTaint is correct for 95% of the cases (precision: 95%, recall: 98%) while FlowDroid is 13%. ANTaint takes 65% less time and none of the cases run out of memory with 32 GB limitation.

As an important program analysis method, taint analysis technology has been widely used in the field of vulnerability detection. However, the existing dynamic taint analysis needs to design instruction-by-instruction taint propagation rules, which is expensive and has a high false positive rate for identifying the implicit control flow of the target program. In view of the above problems, this paper proposes a dynamic taint analysis method nnTaint based on neural network for the existing taint-guided fuzzing technology, which has the characteristics of low cost and low false positives. Comparing nnTaint with the existing taint analysis tools, the operation efficiency is improved by 10.9%-18.8% compared with the traditional taint analysis, which reduces the cost of the existing dynamic taint analysis technology to a certain extent. On the LAVA-M testing datasets and GNU binutils program, nnTaint improves the edge coverage by 4.7%-16% compared with the existing taint-guided fuzzing tools, effectively improving the implicit control flow recognition accuracy of the existing dynamic taint analysis. The results show that nnTaint can improve the efficiency and accuracy of existing dynamic taint analysis tools.

The taint propagation strategy is the core of the taint analysis technology. When the taint analysis toolsanalyses the target program, it needs to mark the target data according to the formulatedtaint propagation strategy. Formulating a reasonable strategy for taint propagation can effectively improve the accuracy of taint analysis. There are two difficulties in developing the taint propagation strategy, namely, alias analysis in static taint analysis and indirect jump in dynamic taint analysis. In our paper, we propose a taint propagation strategy at the intermediate representation language level, which can effectively improve the accuracy of taint propagation.

This paper presents F4F (Framework For Frameworks), a system for effective taint analysis of framework-based web applications. Most modern web applications utilize one or more web frameworks, which provide useful abstractions for common functionality. Due to extensive use of reflective language constructs in framework implementations, existing static taint analyses are often ineffective when applied to framework-based applications. While previous work has included ad hoc support for certain framework constructs, adding support for a large number of frameworks in this manner does not scale from an engineering standpoint. F4F employs an initial analysis pass in which both application code and configuration files are processed to generate a specification of framework-related behaviors. A taint analysis engine can leverage these specifications to perform a much deeper, more precise analysis of framework-based applications. Our specification language has only a small number of simple but powerful constructs, easing analysis engine integration. With this architecture, new frameworks can be handled with no changes to the core analysis engine, yielding significant engineering benefits. We implemented specification generators for several web frameworks and added F4F support to a state-of-the-art taint-analysis engine. In an experimental evaluation, the taint analysis enhanced with F4F discovered 525 new issues across nine benchmarks, a harmonic mean of 2.10X more issues per benchmark. Furthermore, manual inspection of a subset of the new issues showed that many were exploitable or reflected bad security practice.

Blockchain technology and its applications are gaining popularity day by day. It is a ground-breaking technology that allows users to communicate without the need of a trusted middleman. A smart contract (self-executable code) is deployed on the blockchain and auto executes due to a triggering condition. In a no-trust contracting environment, smart contracts can establish trust among parties. Terms and conditions embedded in smart contracts will be imposed immediately when specified criteria have been fulfilled. Due to this, the malicious assailants have a special interest in smart contracts. Blockchains are immutable means if some transaction is deployed or recorded on the blockchain, it becomes unalterable. Thus, smart contracts must be analyzed to ensure zero security vulnerabilities or flaws before deploying the same on the blockchain because a single vulnerability can lead to the loss of millions. For analyzing the security vulnerabilities of smart contracts, various analysis tools have been developed to create safe and secure smart contracts. This paper presents a systematic review on Ethereum smart contracts analysis tools. Initially, these tools are categorized into static and dynamic analysis tools. Thereafter, different sources code analysis techniques are studied such as taint analysis, symbolic execution, and fuzzing techniques. In total, 86 security analysis tools developed for Ethereum blockchain smart contract are analyzed regardless of tool type and analysis approach. Finally, the paper highlights some challenges and future recommendations in the field of Ethereum smart contracts.

Static code analysis is widely used to support the development of high-quality software. It helps developers detect potential bugs and security vulnerabilities in a program's source code without executing it. While the potential benefits of static analysis tools are beyond question, their usability is often criticised and prevents software developers from using static analysis to its full potential. In the past decade, researchers have studied developer needs and contrasted them to available static analysis tool functionalities. In this paper, we summarize the main design challenges for building usable static analysis tools, and show that they revolve around the notion of explainability, which is a subarea of usability. We present existing analysis tools and current research in static analysis usability, and detail how they approach those challenges. This leads us to proposing potential lines of future work in explainability for static analysis, namely turning static analysis tools into assistants and teachers.

Static analyzers have become increasingly popular both as developer tools and as subjects of empirical studies. Whereas static analysis tools exist for disparate programming languages, the bulk of the empirical research has focused on the popular Java programming language. In this paper, we investigate to what extent some known results about using static analyzers for Java change when considering C#-another popular object-oriented language. To this end, we combine two replications of previous Java studies. First, we study which static analysis tools are most widely used among C# developers, and which warnings are more commonly reported by these tools on open-source C# projects. Second, we develop and empirically evaluate EagleRepair: a technique to automatically fix code in response to static analysis warnings; this is a replication of our previous work for Java [20]. Our replication indicates, among other things, that 1) static code analysis is fairly popular among C# developers too; 2) Re-Sharper is the most widely used static analyzer for C#; 3) several static analysis rules are commonly violated in both Java and C# projects; 4) automatically generating fixes to static code analysis warnings with good precision is feasible in C#. The EagleRepair tool developed for this research is available as open source.