Orchestration or Automation: Authentication Flaw Detection in Android Apps

Siqi Ma, Juanru Li, Surya Nepal, Diethelm Ostry, David Lo, Sanjay K. Jha, Robert H. Deng, Elisa Bertino

Abstract: Passwords are pervasively used to authenticate users’ identities in mobile apps. To secure passwords against attacks, protection is applied to the password authentication protocol (PAP). The implementation of the protection scheme becomes an important factor in protecting PAP against attacks. We focus on two basic protection in Android, i.e., SSL/TLS-based PAP and timestamp-based PAP. Previously, we proposed an automated tool, <small>GLACIATE</small> , to detect authentication flaws. We were curious whether orchestration (i.e., involving manual-effort) works better than automation. To answer this question, we propose an orchestrated approach, <small>AuthExploit</small> and compare its effectiveness <small>GLACIATE</small> . We study requirements for correct implementation of PAP and then apply <small>GLACIATE</small> to identify protection enhancements automatically. Through dependency analysis, <small>GLACIATE</small> matches the implementations against the abstracted flaws to recognise defective apps. To evaluate <small>AuthExploit</small> , we collected 1,200 Android apps from Google Play. We compared <small>AuthExploit</small> with the automation tool, <small>GLACIATE</small> , and two other orchestration tools, <inline-formula><tex-math notation="LaTeX">${\sf MalloDroid}$</tex-math></inline-formula> and <inline-formula><tex-math notation="LaTeX">${\sf SMV-Hunter}$</tex-math></inline-formula> . The results demonstrated that orchestration tools detect flaws more precisely although the F1 score of <small>GLACIATE</small> is higher than <small>AuthExploit</small> . Further analysis of the results reveals that highly popular apps and e-commerce apps are not more secure than other apps.