Automated Tool Support for Repairing Security Bugs in Android Mobile Applications

Abstract

While many advanced cryptography algorithms are available to developers, using corresponding APIs is challenging. The misuse of cryptography APIs often causes vulnerability issues. This paper presents an approach for Finding and Repairing Bugs based on security patterns (FireBugs), which focuses on security vulnerabilities---misuse of cryptographic APIs in Android apps. In our evaluation, we investigated 2,800 Android app repositories to evaluate our approach by applying FireBugs to 200 Android apps that use javax.crypto APIs to implement security functionalities.