Automatic On-Device Mitigation for Crypto API Misuse

Location: TU Wien, FAV Hörsaal 2 (Favoritenstr. 9-11)

Date & Time: 2024-06-11; 14:00 - 15:00

Abstract: Misuse of cryptographic APIs remains one of the most common flaws in Android applications. The complexity of cryptographic APIs frequently overwhelms developers. This can lead to mistakes that leak sensitive user data to trivial attacks. Despite herculean efforts by platform provider Google, countermeasures introduced so far were not successful in preventing these flaws. Users remain at risk until an effective systemic mitigation has been found.
We propose a practical solution that mitigates crypto API misuse in compiled Android applications. It enables users to protect themselves against misuse exploitation until the research community has identified an effective long-term solution. CryptoShield consists of generic mitigation procedures for the most critical crypto API misuse scenarios and an implementation that autonomously extends protection onto all applications on an unrooted Android device. Our on-device CryptoShield Agent injects an instrumentation module into application packages, where it can intercept crypto API calls for detecting misuse and applying mitigations. Our solution was designed for real-world applicability. It retains the update flow through Google Play and can be integrated into existing MDM infrastructure.
As a demonstration of CryptoShield’s efficiency and efficacy, we conduct automated (1604 apps) and manual (99 apps) analyses on the most popular applications from Google Play, as well as measurements on synthetic benchmarks. Our solution mitigates crypto API misuse in 96 % of all vulnerable apps, while retaining full functionality for 92 % of all apps. On-device instrumentation takes roughly 11 seconds per application package on average, with minimal impact on package size (5 %) and negligible runtime overhead (571 ms on average app launches, 101 ms worst-case mitigation overhead per crypto API call).

Bio: Florian Draschbacher is a PhD student and university assistant at Institute of Applied Information Processing and Communications. Besides his main research focus on detecting and mitigating security vulnerabilities in mobile applications, he is avidly following any new developments revolving around mobile computing. This fascination has also lead him to participate in the mGov4EU project between 2021 and 2022 and to teaching IAIK’s Mobile Security course since 2021.