![](bg8.png)
single aspects like ECB usage on Android point into
the right direction. Our detailed analysis in finding
causes of the ECB usage on Android brought us to the
conclusion that this flaw is mostly introduced through
the usage of third party libraries during app develop-
ment. The app developers themselves are mostly not
directly responsible for misconfigured cryptography.
The trend shows that on custom code insecure cryp-
tographic modes have been removed more often than
they were newly introduced, which is a positive de-
velopment.
As future work, we see two actions to further im-
prove the situation. As a short term action, we’ll try to
reach out to developers of widely used libraries with
flaws to update their libraries. But this does not tackle
the problem on the long term. Developers currently
have little means to get insights to the security and pri-
vacy aspects of their used third party libraries. Third
party library sites like mavencentral.com only show
CVEs for direct vulnerabilities but not lighter secu-
rity or privacy issues. We aim to deliver such data
for common libraries and provide such information to
developers. App stores and development IDEs could
process such information and highlight flaws to de-
velopers during app development. We believe that
with such tight integration most flaws can easily be
avoided.
ACKNOWLEDGEMENTS
This research work was supported by the National
Research Center for Applied Cybersecurity ATHENE
and the Hessian Ministry of the Interior and Sports.
REFERENCES
Acar, Y., Backes, M., Fahl, S., Garfinkel, S., Kim, D.,
Mazurek, M. L., and Stransky, C. (2017). Comparing
the usability of cryptographic apis. In IEEE Sympo-
sium on Security and Privacy (SP).
Braga, A. and Dahab, R. (2016a). Mining cryptography
misuse in online forums. In IEEE International Con-
ference on Software Quality, Reliability and Security
Companion.
Braga, A. and Dahab, R. (2016b). Mining cryptography
misuse in online forums. In 2016 IEEE International
Conference on Software Quality, Reliability and Secu-
rity Companion.
Chatzikonstantinou, A., Ntantogian, C., Karopoulos, G.,
and Xenakis, C. (2016). Evaluation of cryptogra-
phy usage in android applications. In Proceedings of
the 9th EAI International Conference on Bio-Inspired
Information and Communications Technologies (For-
merly BIONETICS). ICST.
Egele, M., Brumley, D., Fratantonio, Y., and Kruegel, C.
(2013). An empirical study of cryptographic misuse
in android applications. CCS. ACM.
Feichtner, J., Missmann, D., and Spreitzer, R. (2018). Auto-
mated binary analysis on ios: A case study on crypto-
graphic misuse in ios applications. WiSec ’18. ACM.
Fischer, F., Böttinger, K., Xiao, H., Stransky, C., Acar, Y.,
Backes, M., and Fahl, S. (2017). Stack overflow con-
sidered harmful? the impact of copy&paste on an-
droid application security. In 2017 IEEE Symposium
on Security and Privacy (SP).
Gao, J., Kong, P., Li, L., Bissyandé, T. F., and Klein, J.
(2019). Negative results on mining crypto-api usage
rules in android apps. In 2019 IEEE/ACM 16th In-
ternational Conference on Mining Software Reposito-
ries.
Hazhirpasand, M., Ghafari, M., Krüger, S., Bodden, E., and
Nierstrasz, O. (2019). The impact of developer experi-
ence in using java cryptography. In 2019 ACM/IEEE
International Symposium on Empirical Software En-
gineering and Measurement.
Lam, P., Bodden, E., Lhoták, O., and Hendren, L. (2011).
The soot framework for java program analysis: a ret-
rospective.
Lazar, D., Chen, H., Wang, X., and Zeldovich, N. (2014).
Why does cryptographic software fail? a case study
and open problems. In Proceedings of 5th Asia-Pacific
Workshop on Systems, APSys ’14. ACM.
Meng, N., Nagy, S., Yao, D. D., Zhuang, W., and Argoty,
G. A. (2018). Secure coding practices in java: Chal-
lenges and vulnerabilities. ICSE ’18. ACM.
Shoshitaishvili, Y., Wang, R., Hauser, C., Kruegel, C.,
and Vigna, G. (2015). Firmalice - automatic detec-
tion of authentication bypass vulnerabilities in binary
firmware.
Shoshitaishvili, Y., Wang, R., Salls, C., Stephens, N.,
Polino, M., Dutcher, A., Grosen, J., Feng, S., Hauser,
C., Kruegel, C., and Vigna, G. (2016). Sok: (state of)
the art of war: Offensive techniques in binary analysis.
Stephens, N., Grosen, J., Salls, C., Dutcher, A., Wang, R.,
Corbetta, J., Shoshitaishvili, Y., Kruegel, C., and Vi-
gna, G. (2016). Driller: Augmenting fuzzing through
selective symbolic execution.
Vallée-Rai, R., Co, P., Gagnon, E., Hendren, L., Lam, P.,
and Sundaresan, V. (1999). Soot - a java bytecode op-
timization framework. CASCON ’99, page 13. IBM
Press.
Wang, X., Yin, Y., and Yu, H. (2005). Finding collisions in
the full sha-1.
Wickert, A.-K., Baumgärtner, L., Breitfelder, F., and
Mezini, M. (2021). Python Crypto Misuses in the
Wild. ACM.
Tracing Cryptographic Agility in Android and iOS Apps
45