Abstract:Native code is now commonplace within Android app packages where it co-exists and interacts with Dex bytecode through the Java Native Interface to deliver rich app functionalities. Yet, state-of-the-art static analysis approaches have mostly overlooked the presence of such native code, which, however, may implement some key sensitive, or even malicious, parts of the app behavior. This limitation of the state of the art is a severe threat to validity in a large range of static analyses that do not have a complete view of the executable code in apps. To address this issue, we propose a new advance in the ambitious research direction of building a unified model of all code in Android apps. The JuCify approach presented in this paper is a significant step towards such a model, where we extract and merge call graphs of native code and bytecode to make the final model readily-usable by a common Android analysis framework: in our implementation, JuCify builds on the Soot internal intermediate representation. We performed empirical investigations to highlight how, without the unified model, a significant amount of Java methods called from the native code are "unreachable" in apps' call-graphs, both in goodware and malware. Using JuCify, we were able to enable static analyzers to reveal cases where malware relied on native code to hide invocation of payment library code or of other sensitive code in the Android framework. Additionally, JuCify's model enables state-of-the-art tools to achieve better precision and recall in detecting data leaks through native code. Finally, we show that by using JuCify we can find sensitive data leaks that pass through native code.

Java Cryptography API Security Enhancement Based on Annotations

Research on security extensions based on Java 2 security architecture

From Struggle to Simplicity with a Usable and Secure API for Encryption in Java

Supporting secure programming in web applications through interactive static analysis.

Evaluation of Static Vulnerability Detection Tools with Java Cryptographic API Benchmarks

Embedding Secure Coding Instruction into the IDE: A Field Study in an Advanced CS Course.

CryptoExplorer: An Interactive Web Platform Supporting Secure Use of Cryptography APIs

Secure Coding Practices in Java: Challenges and Vulnerabilities

Interactive support for secure programming education.

Time to Separate from StackOverflow and Match with ChatGPT for Encryption

CRYLOGGER: Detecting Crypto Misuses Dynamically

Why Crypto-detectors Fail: A Systematic Evaluation of Cryptographic Misuse Detection Techniques

GNN-Based Code Annotation Logic for Establishing Security Boundaries in C Code

Leveraging Intel SGX to Create a Nondisclosure Cryptographic library

Finding Shrink Critical Section Refactoring Opportunities for the Evolution of Concurrent Code in Trustworthy Software

JuCify: A Step Towards Android Code Unification for Enhanced Static Analysis

Software Security analysis, static and dynamic testing in java and C environment, a comparative study

Cryptcoder: an Automatic Code Generator for Cryptographic Tasks in Ethereum Smart Contracts

Information Security in Health Care Centre Using Cryptography and Steganography

Jasmine: Scale Up JavaScript Static Security Analysis with Computation-based Semantic Explanation

MASC: A Tool for Mutation-Based Evaluation of Static Crypto-API Misuse Detectors