论文标题
Crylogger：动态滥用加密货币
CRYLOGGER: Detecting Crypto Misuses Dynamically
论文作者
论文摘要
加密（加密）算法是所有安全系统的重要成分：例如，加密哈希功能和加密算法可以保证诸如完整性和机密性之类的属性。但是，开发人员可以使用恒定键和弱密码滥用此类算法的应用程序编程接口（API）。本文介绍了Crylogger，这是第一个动态滥用加密货币的开源工具。 CryLogger在执行过程中将传递给加密API的参数记录，并使用加密规则列表来检查其合法性。我们将Crylogger与CryptoGuard进行比较，Cryptoguard是检测加密货币滥用的最有效静态工具之一。我们表明，我们的工具补充了加密驱动器的结果，这是结合静态和动态方法的理由。我们分析了从Google Play商店下载的1780个受欢迎的Android应用程序，以表明Crylogger可以动态和自动地检测到数千个应用程序上的加密货币。我们反向设计器28 Android应用程序，并确认Crylogger标记的问题。我们还披露了应用程序开发人员的最关键漏洞并收集他们的反馈。
Cryptographic (crypto) algorithms are the essential ingredients of all secure systems: crypto hash functions and encryption algorithms, for example, can guarantee properties such as integrity and confidentiality. Developers, however, can misuse the application programming interfaces (API) of such algorithms by using constant keys and weak passwords. This paper presents CRYLOGGER, the first open-source tool to detect crypto misuses dynamically. CRYLOGGER logs the parameters that are passed to the crypto APIs during the execution and checks their legitimacy offline by using a list of crypto rules. We compare CRYLOGGER with CryptoGuard, one of the most effective static tools to detect crypto misuses. We show that our tool complements the results of CryptoGuard, making the case for combining static and dynamic approaches. We analyze 1780 popular Android apps downloaded from the Google Play Store to show that CRYLOGGER can detect crypto misuses on thousands of apps dynamically and automatically. We reverse-engineer 28 Android apps and confirm the issues flagged by CRYLOGGER. We also disclose the most critical vulnerabilities to app developers and collect their feedback.
