Finding flaws from password authentication code in Android apps

摘要: Password authentication is widely used to validate users’ identities because it convenient use, easy for users remember, and simple implement. The password protocol transmits passwords in plaintext, which makes the vulnerable eavesdropping replay attacks, several protocols have been proposed protect against this. However, we find that secure are often implemented incorrectly Android applications (apps). To detect implementation flaws code, propose GLACIATE, a fully automated tool combining machine learning program analysis. Instead of creating detection templates/rules manually, GLACIATE automatically accurately learns common from relatively small training dataset, then identifies whether exist other apps. We collected 16,387 apps Google Play evaluation. successfully identified 4,105 these with incorrect implementations. Examining results, observed significant proportion them had multiple their code. further compared state-of-the-art techniques assess its accuracy.