Abstract:A study is presented that examines the distribution and the usage of some unsafe functions that are known to cause security vulnerabilities in 15 software systems, written in C/C++. The systems are commonly used for mobile computing, and they comprise almost six million lines of code. A tool that uses a static analysis approach is applied to each system, and the number of calls to unsafe functions is determined and tabulated. The results show that vulnerable functions such as strcmp, strlen, and memcpy represent the vast majority of used unsafe functions that are banned by many companies (e.g., Microsoft) in the studied systems. This fact can help software trainers better design and plan training courses and materials on secure coding practices for software developers. Additionally, findings can help software engineers to conduct more effective refactoring processes that help to clean software systems from vulnerable code, and focus primarily on the removal of vulnerable code with higher usage for better outcomes. The historical data for a number of systems, subset, is presented over a five-year period. The data shows that few of the systems examined are increasing the number of unsafe function calls over time. This is somewhat contradictory to the literature, which claims that the use of vulnerable functions is decreasing in software systems. This fact demands that more attention and effort from software engineering and mobile computing communities be put towards addressing this phenomenon.

Security mechanisms for mobile code in evolutionary networks

Information Security Problem Research Based on Game Theory

An Instance-Oriented Security Mechanism in Grid-Based Mobile Agent System

Secure Grid-Based Mobile Agent Platform By Instance-Oriented Delegation

A Hybrid Security Framework of Mobile Code

Bargain Security Model Based on Mobile Agent

Evolving Defense Mechanism for Future Network Security

Security Problems Analysis and Solving Policy Design for Mobile Agents Running Platform

Integrated Coverage Control and Security Connectivity in Mobile Sensor Networks

Security of mobile agents: a new concept of the integrity protection

Endogenous Security Common Problems and Solutions of the Mobile Communication Networks

An Approach for Modeling and Analyzing Code Mobility.

On the Evolution of Mobile Computing Software Systems and C/C++ Vulnerable Code: Empirical Investigation

A Study on the Authorization Access Mechanism of Java Mobile Code

A Study of Key Security Threats and Countermeasures in Mobile Agent Systems

Substitution Encryption Algorithm Study for Embedded Mobile Code Protection

STUDY ON MOBILE APPLICATIONS CODE PROTECTION STATUS AND TECHNIQUES

Rethinking Permission Enforcement Mechanism on Mobile Systems.

A security architecture model for mobile computing

Evolutionary Trust Scheme of Certificate Game in Mobile Cloud Computing

PECULIARITIES OF INFORMATION SECURITY IN MOBILE DEVICES RUNNING THE ANDROID OPERATING SYSTEM