English (United Kingdom)

https://curated-unify.zendy.io/wp-json/zendy-region/v1/featured_content/oa?rat=en

https://curated-unify.zendy.io/wp-json/zendy-region/v1/highlighted_journal/

Global: Zendy Plus annual

Presents the access of premium content as premium feature

Premium Content

Presents the keyphrase highlighting as premium feature

Keyphrase Highlighting

Presents the summarisation as premium feature

Summarisation

Insights

Presents the pdf analysis as premium feature

PDF Analysis

Presents the zaia usage as premium feature

ZAIA

Global: Zendy Plus monthly

Global: Zendy Tools annual

Global: Zendy Tools monthly

Global: Zendy Free Plan

The misunderstanding and incorrect configurations of cryptographic primitiveshave exposed severe security vulnerabilities to attackers. Due to thepervasiveness and diversity of cryptographic misuses, a comprehensive andaccurate understanding of how cryptographic misuses can undermine the securityof an Android app is critical to the subsequent mitigation strategies but alsochallenging. Although various approaches have been proposed to detectcryptographic misuse in Android apps, studies have yet to focus on estimatingthe security risks of cryptographic misuse. To address this problem, we presentan extensible framework for deciding the threat level of cryptographic misusein Android apps. Firstly, we propose a general and unified specification forrepresenting cryptographic misuses to make our framework extensible and developadapters to unify the detection results of the state-of-the-art cryptographicmisuse detectors, resulting in an adapter-based detection tool chain for a morecomprehensive list of cryptographic misuses. Secondly, we employ amisuse-originating data-flow analysis to connect each cryptographic misuse to aset of data-flow sinks in an app, based on which we propose a quantitativedata-flow-driven metric for assessing the overall risk of the app introduced bycryptographic misuses. To make the per-app assessment more useful for appvetting at the app-store level, we apply unsupervised learning to predict andclassify the top risky threats to guide more efficient subsequent mitigation.In the experiments on an instantiated implementation of the framework, weevaluate the accuracy of our detection and the effect of data-flow-driven riskassessment of our framework. Our empirical study on over 40,000 apps and theanalysis of popular apps reveal important security observations on the realthreats of cryptographic misuse in Android apps.

CryptoEval: Evaluating the Risk of Cryptographic Misuses in Android Apps with Data-Flow Analysis