Android is widely used for the development and deployment of autonomous and smart systems, including software targeted for IoT and mobile devices. Security of such systems is an increasingly important concern.
Android relies on a permission model to secure the system's resources and apps. In Android, since the permissions are granted at the granularity of apps, and all components in an app inherit those permissions, an app's components are over-privileged, i.e., components are granted more privileges than they actually need. Systematic violation of least-privilege principle in Android is the root cause of many security vulnerabilities. To mitigate this issue, we have developed DELDroid, an automated system for determination of least privilege architecture in Android and its enforcement at runtime. A key contribution of DELDroid is the ability to limit the privileges granted to apps without modifying them. DELDroid utilizes static analysis techniques to extract the exact privileges each component needs. A Multiple-Domain Matrix representation of the system's architecture is then used to automatically analyze the security posture of the system and derive its least-privilege architecture. Our experiments on hundreds of real-world apps corroborate DELDroid's ability in effectively establishing the least-privilege architecture and its benefits in alleviating the security threats.
A Large-Scale Empirical Study on the Effects of Code Obfuscations on Android ...Mahmoud Hammad
The Android platform has been the dominant mobile platform in recent years resulting in millions of apps and security threats against those apps. Anti-malware products aim to protect smartphone users from these threats, especially from malicious apps. However, malware authors use code obfuscation on their apps to evade detection by anti-malware products. To assess the effects of code obfuscation on Android apps and anti-malware products, we have conducted a large-scale empirical study that evaluates the effectiveness of the top anti-malware products against various obfuscation tools and strategies. To that end, we have obfuscated 3,000 benign apps and 3,000 malicious apps and generated 73,362 obfuscated apps using 29 obfuscation strategies from 7 open-source, academic, and commercial obfuscation tools. The findings of our study indicate that (1) code obfuscation significantly impacts Android anti-malware products; (2) the majority of anti-malware products are severely impacted by even trivial obfuscations; (3) in general, combined obfuscation strategies do not successfully evade anti-malware products more than individual strategies; (4) the detection of anti-malware products depend not only on the applied obfuscation strategy but also on the leveraged obfuscation tool; (5) anti-malware products are slow to adopt signatures of malicious apps; and (6) code obfuscation often results in changes to an app’s semantic behaviors.
2013 Toorcon San Diego Building Custom Android Malware for Penetration TestingStephan Chenette
In this presentation Stephan will discuss some recent research that emerged he was asked to build malicious applications that bypassed custom security controls. He will walk through some of the basics of reversing malicious apps for android as well as common android malware techniques and methodologies. From the analysis of the wild android malware, he will discuss techniques and functionality to include when penetration testing against 3rd-party android security controls.
BIO
Stephan Chenette is the Director of Security Research and Development at IOActive where he conducts ongoing research to support internal and external security initiatives within the IOActive Labs. Stephan has been in involved in security research for the last 10 years and has presented at numerous conferences including: Blackhat, CanSecWest, RSA, EkoParty, RECon, AusCERT, ToorCon, SecTor, SOURCE, OWASP, B-Sides and PacSec. His specialty is in writing research tools for both the offensive and defensive front as well as investigating next generation emerging threats. He has released public analyses on various vulnerabilities and malware. Prior to joining IOActive, Stephan was the head security researcher at Websense for 6 years and a security software engineer for 4 years working in research and product development at eEye Digital Security.
Tech Report: On the Effectiveness of Malware Protection on AndroidFraunhofer AISEC
This document evaluates the effectiveness of malware protection on Android devices. It conducts tests on several Android antivirus apps using known malware samples and a newly developed proof of concept malware. The tests find that most antivirus apps can be easily evaded by making only trivial alterations to malware package files. The document aims to provide a more realistic assessment of the malware risk and the level of protection offered by antivirus software compared to traditional antivirus tests.
Bridging the Security Testing Gap in Your CI/CD PipelineDevOps.com
Are you struggling with application security testing? Do you wish it was easier, faster, and better? Join us to learn more about IAST, a next-generation application security tool that provides highly accurate, real-time vulnerability results without the need for application or source code scans. Learn how this nondisruptive tool can:
Run in the background and report vulnerabilities during functional testing, CI/CD, and QA activities.
Auto verify, prioritize and triage vulnerability findings in real time with 100% confidence.
Fully automate secure app delivery and deployment, without the need for extra security scans or processes.
Free up DevOps resources to focus on strategic or mission-critical tasks and contributions.
Revisiting Code Ownership and Its Relationship with Software Quality in the S...The University of Adelaide
This work was presented at The 38th International Conference on Software Engineering (ICSE2016).
Abstract: Code ownership establishes a chain of responsibility for modules in large software systems. Although prior work uncovers a link between code ownership heuristics and software quality, these heuristics rely solely on the authorship of code changes. In addition to authoring code changes, developers also make important contributions to a module by reviewing code changes. Indeed, recent work shows that reviewers are highly active in modern code review processes, often suggesting alternative solutions or providing updates to the code changes. In this paper, we complement traditional code ownership heuristics using code review activity. Through a case study of six releases of the large Qt and OpenStack systems, we find that: (1) 67%-86% of developers did not author any code changes for a module, but still actively contributed by reviewing 21%-39% of the code changes, (2) code ownership heuristics that are aware of reviewing activity share a relationship with software quality, and (3) the proportion of reviewers without expertise shares a strong, increasing relationship with the likelihood of having post-release defects. Our results suggest that reviewing activity captures an important aspect of code ownership, and should be included in approximations of it in future studies.
José Vila - ¿Otro parche más? No, por favor. [rooted2018]RootedCON
Sigue siendo una tendencia mayoritaria en el ámbito del desarrollo de software que el analizar la seguridad del producto se postergue a las últimas etapas del proceso. Uno de los motivos suele ser el impacto económico de contar con un ciclo seguro de desarrollo, pesa demasiado al inicio del proyecto y por tanto se descarta tener una metodología integrada durante todo el proceso.
Este planteamiento se está volviendo cada vez más en contra de los desarrolladores y demás actores implicados. Una vez lanzado el producto al mercado, acaban teniendo que invertir recursos inesperados por culpa de problemas de seguridad. Parches, hotfixes, actualizaciones… se convierten en la solución monótona que, lo que consigue es acabar dificultando la usabilidad del producto. Seguro que a todos se nos vienen nombres a la cabeza.
El propósito de esta presentación es el exponer la necesidad de integrar metodologías de seguridad desde las etapas más tempranas del ciclo de vida de sus productos, los beneficios de tener presente el desarrollo seguro de productos y mostrar buenas practicas que favorecen a la mejora de la seguridad de los productos, generando software de mayor calidad.
Y si esto ya te lo han contado en otra CON… ¿por qué no lo estás poniendo en práctica?
DevOps purists may chafe at the DevSecOps term given that security and other important practices are supposed to already be an integral part of routine DevOps workflows. But the reality is that security often gets more lip service than thoughtful and systematic integration into open source software sourcing, development pipelines, and operations processes--in spite of an increasing number of threats.
In this session, we’ll look at successful practices that distributed and diverse teams use to iterate rapidly. We’ll discuss how a container platform can serve as the foundation for DevSecOps in your organization. We'll also consider the risk management associated with integrating components from a variety of sources--a consideration that open source software has had to deal with since the beginning. Finally, we'll show ways by which automation and repeatable trusted delivery of code can be built directly into a DevOps pipeline.
Making the Strategic Shift to Open Source at Fujitsu Network CommunicationBlack Duck by Synopsys
Fujitsu Network Communications (FNC) is making a strategic shift to open source. They are using the open source Warrior Framework for automation. Warrior is a keyword and data driven framework that was originally developed by FNC. It supports the automation of multiple protocols and devices. FNC is now open sourcing Warrior to enhance it through collaborative development and align with their open strategy.
A Large-Scale Empirical Study on the Effects of Code Obfuscations on Android ...Mahmoud Hammad
The Android platform has been the dominant mobile platform in recent years resulting in millions of apps and security threats against those apps. Anti-malware products aim to protect smartphone users from these threats, especially from malicious apps. However, malware authors use code obfuscation on their apps to evade detection by anti-malware products. To assess the effects of code obfuscation on Android apps and anti-malware products, we have conducted a large-scale empirical study that evaluates the effectiveness of the top anti-malware products against various obfuscation tools and strategies. To that end, we have obfuscated 3,000 benign apps and 3,000 malicious apps and generated 73,362 obfuscated apps using 29 obfuscation strategies from 7 open-source, academic, and commercial obfuscation tools. The findings of our study indicate that (1) code obfuscation significantly impacts Android anti-malware products; (2) the majority of anti-malware products are severely impacted by even trivial obfuscations; (3) in general, combined obfuscation strategies do not successfully evade anti-malware products more than individual strategies; (4) the detection of anti-malware products depend not only on the applied obfuscation strategy but also on the leveraged obfuscation tool; (5) anti-malware products are slow to adopt signatures of malicious apps; and (6) code obfuscation often results in changes to an app’s semantic behaviors.
2013 Toorcon San Diego Building Custom Android Malware for Penetration TestingStephan Chenette
In this presentation Stephan will discuss some recent research that emerged he was asked to build malicious applications that bypassed custom security controls. He will walk through some of the basics of reversing malicious apps for android as well as common android malware techniques and methodologies. From the analysis of the wild android malware, he will discuss techniques and functionality to include when penetration testing against 3rd-party android security controls.
BIO
Stephan Chenette is the Director of Security Research and Development at IOActive where he conducts ongoing research to support internal and external security initiatives within the IOActive Labs. Stephan has been in involved in security research for the last 10 years and has presented at numerous conferences including: Blackhat, CanSecWest, RSA, EkoParty, RECon, AusCERT, ToorCon, SecTor, SOURCE, OWASP, B-Sides and PacSec. His specialty is in writing research tools for both the offensive and defensive front as well as investigating next generation emerging threats. He has released public analyses on various vulnerabilities and malware. Prior to joining IOActive, Stephan was the head security researcher at Websense for 6 years and a security software engineer for 4 years working in research and product development at eEye Digital Security.
Tech Report: On the Effectiveness of Malware Protection on AndroidFraunhofer AISEC
This document evaluates the effectiveness of malware protection on Android devices. It conducts tests on several Android antivirus apps using known malware samples and a newly developed proof of concept malware. The tests find that most antivirus apps can be easily evaded by making only trivial alterations to malware package files. The document aims to provide a more realistic assessment of the malware risk and the level of protection offered by antivirus software compared to traditional antivirus tests.
Bridging the Security Testing Gap in Your CI/CD PipelineDevOps.com
Are you struggling with application security testing? Do you wish it was easier, faster, and better? Join us to learn more about IAST, a next-generation application security tool that provides highly accurate, real-time vulnerability results without the need for application or source code scans. Learn how this nondisruptive tool can:
Run in the background and report vulnerabilities during functional testing, CI/CD, and QA activities.
Auto verify, prioritize and triage vulnerability findings in real time with 100% confidence.
Fully automate secure app delivery and deployment, without the need for extra security scans or processes.
Free up DevOps resources to focus on strategic or mission-critical tasks and contributions.
Revisiting Code Ownership and Its Relationship with Software Quality in the S...The University of Adelaide
This work was presented at The 38th International Conference on Software Engineering (ICSE2016).
Abstract: Code ownership establishes a chain of responsibility for modules in large software systems. Although prior work uncovers a link between code ownership heuristics and software quality, these heuristics rely solely on the authorship of code changes. In addition to authoring code changes, developers also make important contributions to a module by reviewing code changes. Indeed, recent work shows that reviewers are highly active in modern code review processes, often suggesting alternative solutions or providing updates to the code changes. In this paper, we complement traditional code ownership heuristics using code review activity. Through a case study of six releases of the large Qt and OpenStack systems, we find that: (1) 67%-86% of developers did not author any code changes for a module, but still actively contributed by reviewing 21%-39% of the code changes, (2) code ownership heuristics that are aware of reviewing activity share a relationship with software quality, and (3) the proportion of reviewers without expertise shares a strong, increasing relationship with the likelihood of having post-release defects. Our results suggest that reviewing activity captures an important aspect of code ownership, and should be included in approximations of it in future studies.
José Vila - ¿Otro parche más? No, por favor. [rooted2018]RootedCON
Sigue siendo una tendencia mayoritaria en el ámbito del desarrollo de software que el analizar la seguridad del producto se postergue a las últimas etapas del proceso. Uno de los motivos suele ser el impacto económico de contar con un ciclo seguro de desarrollo, pesa demasiado al inicio del proyecto y por tanto se descarta tener una metodología integrada durante todo el proceso.
Este planteamiento se está volviendo cada vez más en contra de los desarrolladores y demás actores implicados. Una vez lanzado el producto al mercado, acaban teniendo que invertir recursos inesperados por culpa de problemas de seguridad. Parches, hotfixes, actualizaciones… se convierten en la solución monótona que, lo que consigue es acabar dificultando la usabilidad del producto. Seguro que a todos se nos vienen nombres a la cabeza.
El propósito de esta presentación es el exponer la necesidad de integrar metodologías de seguridad desde las etapas más tempranas del ciclo de vida de sus productos, los beneficios de tener presente el desarrollo seguro de productos y mostrar buenas practicas que favorecen a la mejora de la seguridad de los productos, generando software de mayor calidad.
Y si esto ya te lo han contado en otra CON… ¿por qué no lo estás poniendo en práctica?
DevOps purists may chafe at the DevSecOps term given that security and other important practices are supposed to already be an integral part of routine DevOps workflows. But the reality is that security often gets more lip service than thoughtful and systematic integration into open source software sourcing, development pipelines, and operations processes--in spite of an increasing number of threats.
In this session, we’ll look at successful practices that distributed and diverse teams use to iterate rapidly. We’ll discuss how a container platform can serve as the foundation for DevSecOps in your organization. We'll also consider the risk management associated with integrating components from a variety of sources--a consideration that open source software has had to deal with since the beginning. Finally, we'll show ways by which automation and repeatable trusted delivery of code can be built directly into a DevOps pipeline.
Making the Strategic Shift to Open Source at Fujitsu Network CommunicationBlack Duck by Synopsys
Fujitsu Network Communications (FNC) is making a strategic shift to open source. They are using the open source Warrior Framework for automation. Warrior is a keyword and data driven framework that was originally developed by FNC. It supports the automation of multiple protocols and devices. FNC is now open sourcing Warrior to enhance it through collaborative development and align with their open strategy.
This document discusses Indicators of Compromise (IOCs) related to APT1, a Chinese cyber espionage group. It provides links to download the IOCs and explains how they can be used with Mandiant tools like Redline and MIR to detect malware. The document also defines IOCs and describes how the included IOCs were developed and may differ from other Mandiant IOCs. It notes that the IOCs focus on detecting known malware families and may not find new variants.
Developers use Question and Answer (Q&A) websites to exchange knowledge and expertise. Stack Overflow is a popular Q&A website where developers discuss coding problems and share code examples. Although all Stack Overflow posts are free to access, code examples on Stack Overflow are governed by the Creative Commons Attribute-ShareAlike 3.0 Unported license that developers should obey when reusing code from Stack Overflow or posting code to Stack Overflow. In this talk, I will present the results of our recent study that investigated whether developers respect license terms when reusing code from Stack Overflow posts (and the other way around). We found 232 code snippets in 62 Android apps from a dataset of 399 Android apps, that were potentially reused from Stack Overflow, and 1,226 Stack Overflow posts containing code examples that are clones of code released in 68 Android apps, suggesting that developers may have copied the code of these apps to answer Stack Overflow questions. We investigated the licenses of these pieces of code and observed 1,279 cases of potential license violations (related to code posting to Stack overflow or code reuse from Stack overflow). These findings suggest that developers do not pay enough attention to copyright terms when reusing code from Stack Overflow or sharing code on Stack Overflow.
Proving the Security of Low-Level Software Components & TEEsAshley Zupkus
Learn how it is possible to prove low-level software component and TEE security, as well as the Goodix driver example demoed in the webinar.
Check out the webinar replay here: https://www.youtube.com/watch?v=nG3DlejBd3k
Visit our website trust-in-soft.com for more information!
This research is presented at the 12th Working Conference on Mining Software Repositories (MSR2015)
Abstract: Software code review is a well-established software quality practice. Recently, Modern Code Review (MCR) has been widely adopted in both open source and industrial projects. To evaluate the impact that characteristics of MCR practices have on software quality, this paper comparatively studies MCR practices in defective and clean source code files. We investigate defective files along two perspectives: 1) files that will eventually have defects (i.e., future-defective files) and 2) files that have historically been defective (i.e., risky files). Through an empirical study of 11,736 reviews of changes to 24,486 files from the Qt open source system, we find that both future-defective files and risky files tend to be reviewed less rigorously than their clean counterparts. We also find that the concerns addressed during the code reviews of both defective and clean files tend to enhance evolvability, i.e., ease future maintenance (like documentation), rather than focus on functional issues (like incorrect program logic). Our findings suggest that although functionality concerns are rarely addressed during code review, the rigor of the reviewing process that is applied to a source code file throughout a development cycle shares a link with its defect proneness.
Software composition analysis (SCA) is often sold as an easy win for application security, but ensuring that we have full visibility on the vulnerable components is a lot more challenging that it looks. The remediation costs can also stack up pretty quickly as we try to get rid of deeply nested vulnerable transitive dependencies.
Advanced red teaming all your badges are belong to usPriyanka Aash
The document is a presentation by Eric Smith and Josh Perrymon of LARES on red teaming and advanced RFID attacks. It begins with an introduction to red teaming and how it is used to test security measures. It then provides overviews of RFID technologies, traditional and advanced attacks against access control systems using RFID badges, and recommendations for risk mitigation and remediation. The presenters have extensive experience in security and red teaming and demonstrate attacks such as RFID cloning, privilege escalation, and blended attacks.
Sec4dev 2021 - Catch Me If You can : Continuous Delivery vs. Security AssuranceAbdessamad TEMMAR
DevOps and Continuous Delivery has changed how technology operates and how business is run, but security continues to struggle to catch-up with the velocity of change in this new world : it’s almost a cat-and-mouse game when it comes to spot security holes into code before delivering to production, and traditional manual security assessment just continue to be untenable as a way of working with modern agile teams.
The concept of DevSecOps can be the ultimate answer, but unfortunately most articles and vendor pitches about this subject are incredibly superficial, and it’s all about dumping existing/traditional security tools on developers, which adds more complexity and frustration without solving the real problem.
“Modern problems require modern solutions” : this talk explains the evolution of security tooling over the last years, and how they must change (or has changed) to match the macro trends and keep up with the shifting threat.
As an example, this talk demonstrates how modern “lightweight” code analysis techniques, when combined with secure-by-default frameworks/patterns, can be used to easily detect potential holes within a code base, and provide accurate/fast feedbacks to developers.
Secure application deployment in the age of continuous deliveryTim Mackey
As presented at Open Source Open Standards (GovNet) (http://opensourceconference.co.uk/), this deck covers some of the material which operators of open source data centers and users of container and cloud technologies should be aware of when seeking to be security conscious.
Traditionally, when datacentre operators talk about application security, there has been a tendency to focus on issues related to key management, firewalls and data access. By contrast, application developers have a security focus which is more aligned with code analysis and fuzzing techniques. The reality is, secure application deployment principles extend from the infrastructure layer through the application and include how the application is deployed. With the prevalence of continuous deployment, it’s imperative to focus efforts on what attackers’ view as vulnerable; particularly in an environment where new exploits are being disclosed almost daily.
In this session we’ll present:
- How known vulnerabilities can make their way into production deployments
- How vulnerability impact is maximized
- A methodology for ensuring deployment of vulnerable code can be minimized
- A methodology to minimize the potential for vulnerable code to be redistributed
Open Source and Cyber Security: Open Source Software's Role in Government Cyb...Great Wide Open
This document summarizes the cybersecurity research agenda of the U.S. Department of Homeland Security Science and Technology Directorate. It discusses how DHS is focusing on areas like critical infrastructure security, open source software, cyber-physical systems, and new technology programs. The research aims to drive innovation in cybersecurity solutions through collaboration with academia, industry and open source communities to address evolving threats and transition technologies for real-world use.
DevSecCon Boston 2018: Building a practical DevSecOps pipeline for free by Je...DevSecCon
The document discusses building a practical DevSecOps pipeline for free. It promotes using Interactive Application Security Testing (IAST) and Runtime Application Self-Protection (RASP) tools to shift security left and implement security throughout the development, integration and operations phases. IAST can detect vulnerabilities during normal application use while RASP can prevent vulnerabilities from being exploited at runtime. The document advocates establishing a security workflow, ensuring instant security feedback, and building a security culture as part of DevSecOps. It also recommends the free and open source Contrast Community Edition as an IAST and RASP tool that can integrate with development tools and provide security testing without slowing down builds or developers.
Open Source Insight: NVD's New Look, Struts Vuln Ransomware & Google Open So...Black Duck by Synopsys
NIST redesigned the National Vulnerability Database with a much-needed, modernized look-and-feel — including a scrolling list of the latest scored vulnerabilities and a “visualization” section designed to provide different ways to look at the data.
First impression? While some kinks still need to be worked out (the site loads very slowly), it’s going to be much easier to find vulnerability and mitigation information in the NVD than in the past.
Testing in a Continuous Delivery Pipeline - Better, Faster, CheaperGene Gotimer
The continuous delivery pipeline is the process of taking new or changed features from developers, and getting features deployed into production and delivered quickly to the customer. Gene Gotimer says testing within continuous delivery pipelines should be designed so the earliest tests are the quickest and easiest to run, giving developers the fastest feedback. Successive rounds of testing lead to increased confidence that the code is a viable candidate for production and that more expensive tests—time, effort, cost—are justified. Manual testing is performed toward the end of the pipeline, leaving computers to do as much work as possible before people get involved. Although it is tempting to arrange the delivery pipeline in phases (e.g., functional tests, then acceptance tests, then load and performance tests, then security tests), this can lead to serious problems progressing far down the pipeline before they are caught. Gene shows how to arrange your tests so each round provides just enough testing to give you confidence that the next set of tests is worth the investment. He explores how to get the right types of testing into your pipeline at the right points.
Learn how this Black Duck customer tracks the potential impact of open source security vulnerabilities in all its products while ensuring the SDLC remains fast and agile.
Organizations of all sizes using automation and agile methodologies to improve the speed and reliability of their software development initiatives. In this session we will provide an overview and demonstrations of the various ways you can integrate Black Duck Hub with your CI/CD tools to manage open source risks throughout development.
Shift Risk Left: Security Considerations When Migrating Apps to the CloudBlack Duck by Synopsys
In this session, we'll start with the basics of application security for an environment where development teams are able to push code into production at will. We quickly cover the basics and move on to the advanced topics of tests and models for long-term application security. We'll cover real-world Black Duck CI examples including keeping apps up-to-date in Pivotal Cloud Foundry environments, and end with tips for advocating for long-term security structures.
Delivered at DevSecOps Days 2018, RSA Conference
j. Wolfgang Goerlich
About J. Wolfgang Goerlich
About J Wolfgang Goerlich
CBI (Creative Breakthroughs, Inc.)
Cyber Security Strategist
J Wolfgang Goerlich provides strategic guidance for securing development and DevOps programs in the healthcare, education, financial services, and energy. He is currently with CBI, a cyber security consultancy, as the VP for strategic security programs. Wolfgang also leads the CBI Academy teams, providing mentoring and coaching to the junior-level talent. Prior roles included VP for a managed security services provider, VP for an IT firm specializing in high speed high secure networks, and IT security officer and manager for a financial services firm. He is an active part of the security community; co-founding the Converge Detroit and organizing the BSides Detroit conferences. Wolfgang regularly advises on and presents on the topics of secure development life cycle, DevOps, risk management, incident response, business continuity, and more.
7 Reasons Your Applications are Attractive to AdversariesDerek E. Weeks
Presentation from 18 November 2014.
Software applications need to be delivered faster and across more platforms than ever. To build high quality software in short order, we’ve seen a dramatic shift from source code to component-based development, with open source and third party components providing the innovation and efficiency that developers need.
Unfortunately, our dependence on components is growing faster than our ability to secure them. These shared components are not top-of-mind when considering application risk. Worse yet, components are increasingly the preferred attack surface in today’s applications.
The combination of growing component usage, coupled with lack of security, requires us to urgently re-evaluate traditional application security approaches and identify practical next steps for closing this security gap.
So what’s the “neglected 90%,” why is it attractive to your adversaries and what can you do about it? Plenty. Here are 7 key points, for starters.
http://bit.ly/AHC_USAF
The How and Why of Container Vulnerability ManagementTim Mackey
As presented at OpenShift Commons Sept 8, 2016.
Cyber threats consistently rank as a high priority for data center operators and their reliability teams. As increasingly sophisticated attacks mount, the risk associated with a zero-day attack is significant. Traditional responses include perimeter monitoring and associated network defenses. Since those defenses are reactive to application issues attackers choose to exploit, it’s critical to have visibility into both what is in your container library, but also what the current state of vulnerability activity might be. Current vulnerability information for container images can readily be obtained by using the scan action on Atomic hosts in your OpenShift Container Platform.
In this session we’ll cover how an issue becomes a disclosed vulnerability, how to determine the risk associated with your container usage, and potential mitigation patterns you might choose to utilize to limit any potential scope of compromise.
Null Mumbai Meet_Android Reverse Engineering by Samrat Dasnullowaspmumbai
Android Reverse Engineering by Samrat Das
Abstract
• Intro to Reverse Engineering
• Short walkthough with Windows RE
• Introduction to Mobile Security Assessments
• Dalvik Virtual Machine vs JVM
• APK Walkthrough
• Components of Android
• Steps of Reverse Engineering Android Applications
• Hands-on demos on manual reversing of android apps
• Introduction to APPuse VM for droid assessments
• Detecting developer backdoors
• Creating Infected Android Applications
• Anti-Reversing | Obfuscation
Getting Started With Android Application Development [IndicThreads Mobile Ap...IndicThreads
Session Presented at 1st IndicThreads.com Conference On Mobile Application Development held on 19-20 November 2010 in Pune, India
WEB: http://M10.IndicThreads.com
------------
Speaker: Rohit Ghatol
Abstract:
This session looks at -
Introduction to Android
Android OS Capabilities
Building Blocks of Android
Use Case – Building Blocks and their Interaction for Gmail Client
Understanding Android UI
Challenges in building Android Application and Best Practices
Web Services Client
Database Vs File Vs Shared Preferences
Minimizing GC
Fetch online Vs Local Cache
Working in Background Threads
Building custom Widgets
This document discusses Indicators of Compromise (IOCs) related to APT1, a Chinese cyber espionage group. It provides links to download the IOCs and explains how they can be used with Mandiant tools like Redline and MIR to detect malware. The document also defines IOCs and describes how the included IOCs were developed and may differ from other Mandiant IOCs. It notes that the IOCs focus on detecting known malware families and may not find new variants.
Developers use Question and Answer (Q&A) websites to exchange knowledge and expertise. Stack Overflow is a popular Q&A website where developers discuss coding problems and share code examples. Although all Stack Overflow posts are free to access, code examples on Stack Overflow are governed by the Creative Commons Attribute-ShareAlike 3.0 Unported license that developers should obey when reusing code from Stack Overflow or posting code to Stack Overflow. In this talk, I will present the results of our recent study that investigated whether developers respect license terms when reusing code from Stack Overflow posts (and the other way around). We found 232 code snippets in 62 Android apps from a dataset of 399 Android apps, that were potentially reused from Stack Overflow, and 1,226 Stack Overflow posts containing code examples that are clones of code released in 68 Android apps, suggesting that developers may have copied the code of these apps to answer Stack Overflow questions. We investigated the licenses of these pieces of code and observed 1,279 cases of potential license violations (related to code posting to Stack overflow or code reuse from Stack overflow). These findings suggest that developers do not pay enough attention to copyright terms when reusing code from Stack Overflow or sharing code on Stack Overflow.
Proving the Security of Low-Level Software Components & TEEsAshley Zupkus
Learn how it is possible to prove low-level software component and TEE security, as well as the Goodix driver example demoed in the webinar.
Check out the webinar replay here: https://www.youtube.com/watch?v=nG3DlejBd3k
Visit our website trust-in-soft.com for more information!
This research is presented at the 12th Working Conference on Mining Software Repositories (MSR2015)
Abstract: Software code review is a well-established software quality practice. Recently, Modern Code Review (MCR) has been widely adopted in both open source and industrial projects. To evaluate the impact that characteristics of MCR practices have on software quality, this paper comparatively studies MCR practices in defective and clean source code files. We investigate defective files along two perspectives: 1) files that will eventually have defects (i.e., future-defective files) and 2) files that have historically been defective (i.e., risky files). Through an empirical study of 11,736 reviews of changes to 24,486 files from the Qt open source system, we find that both future-defective files and risky files tend to be reviewed less rigorously than their clean counterparts. We also find that the concerns addressed during the code reviews of both defective and clean files tend to enhance evolvability, i.e., ease future maintenance (like documentation), rather than focus on functional issues (like incorrect program logic). Our findings suggest that although functionality concerns are rarely addressed during code review, the rigor of the reviewing process that is applied to a source code file throughout a development cycle shares a link with its defect proneness.
Software composition analysis (SCA) is often sold as an easy win for application security, but ensuring that we have full visibility on the vulnerable components is a lot more challenging that it looks. The remediation costs can also stack up pretty quickly as we try to get rid of deeply nested vulnerable transitive dependencies.
Advanced red teaming all your badges are belong to usPriyanka Aash
The document is a presentation by Eric Smith and Josh Perrymon of LARES on red teaming and advanced RFID attacks. It begins with an introduction to red teaming and how it is used to test security measures. It then provides overviews of RFID technologies, traditional and advanced attacks against access control systems using RFID badges, and recommendations for risk mitigation and remediation. The presenters have extensive experience in security and red teaming and demonstrate attacks such as RFID cloning, privilege escalation, and blended attacks.
Sec4dev 2021 - Catch Me If You can : Continuous Delivery vs. Security AssuranceAbdessamad TEMMAR
DevOps and Continuous Delivery has changed how technology operates and how business is run, but security continues to struggle to catch-up with the velocity of change in this new world : it’s almost a cat-and-mouse game when it comes to spot security holes into code before delivering to production, and traditional manual security assessment just continue to be untenable as a way of working with modern agile teams.
The concept of DevSecOps can be the ultimate answer, but unfortunately most articles and vendor pitches about this subject are incredibly superficial, and it’s all about dumping existing/traditional security tools on developers, which adds more complexity and frustration without solving the real problem.
“Modern problems require modern solutions” : this talk explains the evolution of security tooling over the last years, and how they must change (or has changed) to match the macro trends and keep up with the shifting threat.
As an example, this talk demonstrates how modern “lightweight” code analysis techniques, when combined with secure-by-default frameworks/patterns, can be used to easily detect potential holes within a code base, and provide accurate/fast feedbacks to developers.
Secure application deployment in the age of continuous deliveryTim Mackey
As presented at Open Source Open Standards (GovNet) (http://opensourceconference.co.uk/), this deck covers some of the material which operators of open source data centers and users of container and cloud technologies should be aware of when seeking to be security conscious.
Traditionally, when datacentre operators talk about application security, there has been a tendency to focus on issues related to key management, firewalls and data access. By contrast, application developers have a security focus which is more aligned with code analysis and fuzzing techniques. The reality is, secure application deployment principles extend from the infrastructure layer through the application and include how the application is deployed. With the prevalence of continuous deployment, it’s imperative to focus efforts on what attackers’ view as vulnerable; particularly in an environment where new exploits are being disclosed almost daily.
In this session we’ll present:
- How known vulnerabilities can make their way into production deployments
- How vulnerability impact is maximized
- A methodology for ensuring deployment of vulnerable code can be minimized
- A methodology to minimize the potential for vulnerable code to be redistributed
Open Source and Cyber Security: Open Source Software's Role in Government Cyb...Great Wide Open
This document summarizes the cybersecurity research agenda of the U.S. Department of Homeland Security Science and Technology Directorate. It discusses how DHS is focusing on areas like critical infrastructure security, open source software, cyber-physical systems, and new technology programs. The research aims to drive innovation in cybersecurity solutions through collaboration with academia, industry and open source communities to address evolving threats and transition technologies for real-world use.
DevSecCon Boston 2018: Building a practical DevSecOps pipeline for free by Je...DevSecCon
The document discusses building a practical DevSecOps pipeline for free. It promotes using Interactive Application Security Testing (IAST) and Runtime Application Self-Protection (RASP) tools to shift security left and implement security throughout the development, integration and operations phases. IAST can detect vulnerabilities during normal application use while RASP can prevent vulnerabilities from being exploited at runtime. The document advocates establishing a security workflow, ensuring instant security feedback, and building a security culture as part of DevSecOps. It also recommends the free and open source Contrast Community Edition as an IAST and RASP tool that can integrate with development tools and provide security testing without slowing down builds or developers.
Open Source Insight: NVD's New Look, Struts Vuln Ransomware & Google Open So...Black Duck by Synopsys
NIST redesigned the National Vulnerability Database with a much-needed, modernized look-and-feel — including a scrolling list of the latest scored vulnerabilities and a “visualization” section designed to provide different ways to look at the data.
First impression? While some kinks still need to be worked out (the site loads very slowly), it’s going to be much easier to find vulnerability and mitigation information in the NVD than in the past.
Testing in a Continuous Delivery Pipeline - Better, Faster, CheaperGene Gotimer
The continuous delivery pipeline is the process of taking new or changed features from developers, and getting features deployed into production and delivered quickly to the customer. Gene Gotimer says testing within continuous delivery pipelines should be designed so the earliest tests are the quickest and easiest to run, giving developers the fastest feedback. Successive rounds of testing lead to increased confidence that the code is a viable candidate for production and that more expensive tests—time, effort, cost—are justified. Manual testing is performed toward the end of the pipeline, leaving computers to do as much work as possible before people get involved. Although it is tempting to arrange the delivery pipeline in phases (e.g., functional tests, then acceptance tests, then load and performance tests, then security tests), this can lead to serious problems progressing far down the pipeline before they are caught. Gene shows how to arrange your tests so each round provides just enough testing to give you confidence that the next set of tests is worth the investment. He explores how to get the right types of testing into your pipeline at the right points.
Learn how this Black Duck customer tracks the potential impact of open source security vulnerabilities in all its products while ensuring the SDLC remains fast and agile.
Organizations of all sizes using automation and agile methodologies to improve the speed and reliability of their software development initiatives. In this session we will provide an overview and demonstrations of the various ways you can integrate Black Duck Hub with your CI/CD tools to manage open source risks throughout development.
Shift Risk Left: Security Considerations When Migrating Apps to the CloudBlack Duck by Synopsys
In this session, we'll start with the basics of application security for an environment where development teams are able to push code into production at will. We quickly cover the basics and move on to the advanced topics of tests and models for long-term application security. We'll cover real-world Black Duck CI examples including keeping apps up-to-date in Pivotal Cloud Foundry environments, and end with tips for advocating for long-term security structures.
Delivered at DevSecOps Days 2018, RSA Conference
j. Wolfgang Goerlich
About J. Wolfgang Goerlich
About J Wolfgang Goerlich
CBI (Creative Breakthroughs, Inc.)
Cyber Security Strategist
J Wolfgang Goerlich provides strategic guidance for securing development and DevOps programs in the healthcare, education, financial services, and energy. He is currently with CBI, a cyber security consultancy, as the VP for strategic security programs. Wolfgang also leads the CBI Academy teams, providing mentoring and coaching to the junior-level talent. Prior roles included VP for a managed security services provider, VP for an IT firm specializing in high speed high secure networks, and IT security officer and manager for a financial services firm. He is an active part of the security community; co-founding the Converge Detroit and organizing the BSides Detroit conferences. Wolfgang regularly advises on and presents on the topics of secure development life cycle, DevOps, risk management, incident response, business continuity, and more.
7 Reasons Your Applications are Attractive to AdversariesDerek E. Weeks
Presentation from 18 November 2014.
Software applications need to be delivered faster and across more platforms than ever. To build high quality software in short order, we’ve seen a dramatic shift from source code to component-based development, with open source and third party components providing the innovation and efficiency that developers need.
Unfortunately, our dependence on components is growing faster than our ability to secure them. These shared components are not top-of-mind when considering application risk. Worse yet, components are increasingly the preferred attack surface in today’s applications.
The combination of growing component usage, coupled with lack of security, requires us to urgently re-evaluate traditional application security approaches and identify practical next steps for closing this security gap.
So what’s the “neglected 90%,” why is it attractive to your adversaries and what can you do about it? Plenty. Here are 7 key points, for starters.
http://bit.ly/AHC_USAF
The How and Why of Container Vulnerability ManagementTim Mackey
As presented at OpenShift Commons Sept 8, 2016.
Cyber threats consistently rank as a high priority for data center operators and their reliability teams. As increasingly sophisticated attacks mount, the risk associated with a zero-day attack is significant. Traditional responses include perimeter monitoring and associated network defenses. Since those defenses are reactive to application issues attackers choose to exploit, it’s critical to have visibility into both what is in your container library, but also what the current state of vulnerability activity might be. Current vulnerability information for container images can readily be obtained by using the scan action on Atomic hosts in your OpenShift Container Platform.
In this session we’ll cover how an issue becomes a disclosed vulnerability, how to determine the risk associated with your container usage, and potential mitigation patterns you might choose to utilize to limit any potential scope of compromise.
Null Mumbai Meet_Android Reverse Engineering by Samrat Dasnullowaspmumbai
Android Reverse Engineering by Samrat Das
Abstract
• Intro to Reverse Engineering
• Short walkthough with Windows RE
• Introduction to Mobile Security Assessments
• Dalvik Virtual Machine vs JVM
• APK Walkthrough
• Components of Android
• Steps of Reverse Engineering Android Applications
• Hands-on demos on manual reversing of android apps
• Introduction to APPuse VM for droid assessments
• Detecting developer backdoors
• Creating Infected Android Applications
• Anti-Reversing | Obfuscation
Getting Started With Android Application Development [IndicThreads Mobile Ap...IndicThreads
Session Presented at 1st IndicThreads.com Conference On Mobile Application Development held on 19-20 November 2010 in Pune, India
WEB: http://M10.IndicThreads.com
------------
Speaker: Rohit Ghatol
Abstract:
This session looks at -
Introduction to Android
Android OS Capabilities
Building Blocks of Android
Use Case – Building Blocks and their Interaction for Gmail Client
Understanding Android UI
Challenges in building Android Application and Best Practices
Web Services Client
Database Vs File Vs Shared Preferences
Minimizing GC
Fetch online Vs Local Cache
Working in Background Threads
Building custom Widgets
Profiling Multicore Systems to Maximize Core Utilization mentoresd
Profiling Multicore Systems to Maximize Core Utilization – Colin Walls
Underutilization of cores in a multicore system can be considered a bug. As your system incorporates more cores, you need to make sure that all the cores are being utilized fully. Un-expected inter-actions between processes, the operating system, and resources can prevent cores from delivering peak performance. In this session explore how to profile what each core is doing, which processes are running on each core, and understand where core utilization falls below optimum values.
This document discusses the use of Robot Operating System 2 (ROS 2) and Data Distribution Service (DDS) for smart manufacturing. ROS 2 is an open-source robotics middleware that has gained popularity for use in mobile robots, industrial robots, and autonomous vehicles. It allows for distributed, decentralized control through the use of DDS as its underlying middleware for data distribution. The document outlines the history and releases of ROS 2, its advantages over a centralized ROS 1 architecture, and examples of its use in industrial applications such as multiple autonomous guided vehicles (AGVs) and 5G factory networks.
1. FlowDroid is a static taint analysis system that precisely tracks sensitive data flows in Android apps. It models lifecycles, callbacks, and asynchronous execution to handle Android complexity.
2. An evaluation on 39 benchmark apps found FlowDroid had higher precision and recall than commercial tools. It also detected all leaks in a vulnerable app with no false positives/negatives.
3. FlowDroid analyzes app bytecode, configurations, and models execution to detect data leaks from sources like contacts to sinks like advertising. Its context, field, object and flow sensitivities improve precision over prior work.
International Journal of Engineering Research and Applications (IJERA) is an open access online peer reviewed international journal that publishes research and review articles in the fields of Computer Science, Neural Networks, Electrical Engineering, Software Engineering, Information Technology, Mechanical Engineering, Chemical Engineering, Plastic Engineering, Food Technology, Textile Engineering, Nano Technology & science, Power Electronics, Electronics & Communication Engineering, Computational mathematics, Image processing, Civil Engineering, Structural Engineering, Environmental Engineering, VLSI Testing & Low Power VLSI Design etc.
From reactive toproactive mobile securityMobileSoft
"From reactive toproactive mobile security" by Eric Boddenwith with Siegfried Rasthofer, Steven Arzt,Marc Miltenberger and Michael Pradel.
MobileSoft2017, Buenos Aires, Argentina, 2017.
The document provides an overview of an Android architecture presentation. It discusses key topics like the Android virtual machine, application stack and framework, core libraries, and the main components of an Android application. For application components, it covers the AndroidManifest file, activities and their lifecycle, intents, application resources including strings and drawables, and localization. It provides examples and code snippets for many of these topics. It also lists additional topics that will be covered in part two of the presentation, such as preferences, app widgets, services, and content providers.
The document provides an overview of what is required to develop Android applications, including the latest Java Development Kit (JDK), Android Software Development Kit (SDK), an integrated development environment (IDE) like Eclipse, and the Android Development Tools (ADT) plugin for Eclipse. It describes downloading and installing each component, and explains their basic functions. The JDK is needed to compile Java code, the SDK contains libraries and tools, the IDE provides an interface for writing code, and the ADT plugin integrates Android development capabilities into Eclipse. It also outlines the typical project folder structure and key files like the AndroidManifest.xml.
Presentation at Android Builders Summit 2012.
Based on the experience of working with ODM companies and SoC vendors, this session would discuss how to figure out the performance hotspot of certain Android devices and then improve in various areas including graphics and boot time. This session consists of the detailed components which seem to be independent from each other in traditional view. However, the situation changes a lot in Android system view since everything is coupled in a mass. Three frequently mentioned items in Android engineering are selected as the entry points: 2D/3D graphics, runtime, and boot time. Audience: Developers who work on Android system integration and platform enablement.
Pursue the Attackers – Identify and Investigate Lateral Movement Based on Beh...CODE BLUE
The document discusses methods for identifying and investigating lateral movement by attackers during security incidents. It describes common tools and techniques used by attackers during different stages of an advanced persistent threat (APT) incident, including initial investigation, internal reconnaissance, spreading infection, and deleting evidence. The document analyzes logs and commands from past APT attacks to identify patterns in attacker behavior that can help with incident response. It notes that default system logs often do not provide enough information, so additional logging of events, processes, and network connections may be needed to fully trace attacker activities within a target network.
DockerCon EU 2015: The Missing Piece: when Docker networking unleashing soft ...Docker, Inc.
Presented by Adrien Blind, DevOps Coach, Socîeté Générale and Laurent Grangeau, Solutions Architect, Finaxys
Docker now provides several building blocks, combining engine, clustering, and componentization, while the new networking and service features enable many new usecases such as multi-tenancy.
In this session, you will first discover the new experimental networking and service features expected soon, and then drift rapidly to software architecture, explaining how a complete Docker stack unleashes microservices paradigms.
The document discusses the Android application framework. It includes core libraries that provide functionality like media playback, 2D/3D graphics, and SQLite. The Dalvik VM was used before Android 5 but has been replaced by ART, which uses ahead-of-time compilation. The framework includes activities, intents, services, and content providers as important app components. It also handles notifications, audio/video output, and surfaces using managers. Fragments allow dividing an activity's UI.
Android is a Linux-based architecture. In addition to the original Linux driver, Android need other additional device driver, like Android Logger, Binder, Low Memory killer, Power Management for android(wakelock), ASHMEM, etc out of which ashmem ,logger and binder are all character device drivers.
Building Microservices with the 12 Factor App Pattern on AWSAmazon Web Services
by Chris Hein, Partner Solutions Architect, AWS
Microservices architectures make applications easier to scale and faster to develop, enabling innovation and accelerating time-to-market for new features. But building containerized microservices across multiple teams means you need well-defined, guiding methodologies for software design and implementation. In this talk we’ll discuss architectural best practices for building containerized microservices on AWS, and how traditional software design patterns evolve in the context of containers. We will deep-dive into Martin Fowler’s principles of microservices and map them to the twelve-factor app pattern and real-life considerations. If you are building or in the process of building microservices on AWS, don’t miss this session.
Enabling Enterprise-wide OT Data access with Matrikon Data Broker.pdfJohn Archer
Highlights on new partnership between Red Hat and Matrikon for supporting OPC-UA on Red Hat edge infrastructure including bare metal, VMs and containers deployments for Matrikon Data Broker
Lecture 2(b) Android Internals A Quick OverviewAhsanul Karim
The document provides an overview of Android internals including:
1. What is Android and the Android software stack consisting of the Linux kernel, native libraries, Android runtime, application framework, and applications.
2. The Android SDK which includes APIs, development tools, emulator, documentation, and sample code to develop Android applications.
3. The features of the Android SDK including connectivity, location, maps, multimedia, sensors, storage, and graphics APIs.
4. The application build process which uses tools like dx and aapt to compile code and resources into an .apk file.
5. How applications run in a secure sandbox on Android using Linux users and processes, with each app running in isolation in its own
Building Microservices with the 12 Factor App Pattern on AWSAmazon Web Services
This document discusses 12 factor application principles for building microservices and outlines best practices for microservice architecture. It covers 12 factors like codebase, dependencies, configuration, backing services, port binding, concurrency, disposability, and others. It also discusses microservice principles like componentization, decentralization, treating services as products not projects, and infrastructure automation. The document provides examples of how to structure user signup as independent microservices that communicate asynchronously through events.
Know What’s in Your Containers! Manage and Secure all Open Source that Compos...DevOps.com
Automation and containerization can help you build faster and deliver continuously, but can also make managing what’s inside your containers challenging. By integrating Black Duck with Red Hat OpenShift Enterprise, you can scan all images that materialize into OpenShift automatically regardless of registry source. This integration provides visibility into all of the 3rd party open source software that compose your containers. Images and Pods are labelled with Black Duck vulnerability and policy information and are continuously updated as new vulnerabilities are published.
Join experts from Black Duck by Synopsys and Red Hat as we explore how to build containers safely without sacrificing agility, visibility, or control. In this webinar we will:
Discuss the Container Security Tool Landscape
How Synopsys fits in Software Quality
Why Open Source Management Matters
Black Duck Architecture
Black Duck OpsSight 2.0 Integration Architecture
Black Duck OpsSight Demonstration
This document summarizes a presentation on reverse engineering obfuscated Android applications. It discusses reverse engineering techniques like static and dynamic analysis. It covers analyzing the Android application package (APK) file format and tools like apktool, smali, baksmali, and dex2jar. Common obfuscation techniques like string encryption, call hiding using reflection, and native code are also summarized. The document concludes by recommending further reading on tools and the arms race between attackers and defenders applying obfuscation.
Similar to DELDroid: Determination & Enforcement of Least Privilege Architecture in AnDroid (20)
SOCRadar's Aviation Industry Q1 Incident Report is out now!
The aviation industry has always been a prime target for cybercriminals due to its critical infrastructure and high stakes. In the first quarter of 2024, the sector faced an alarming surge in cybersecurity threats, revealing its vulnerabilities and the relentless sophistication of cyber attackers.
SOCRadar’s Aviation Industry, Quarterly Incident Report, provides an in-depth analysis of these threats, detected and examined through our extensive monitoring of hacker forums, Telegram channels, and dark web platforms.
Measures in SQL (SIGMOD 2024, Santiago, Chile)Julian Hyde
SQL has attained widespread adoption, but Business Intelligence tools still use their own higher level languages based upon a multidimensional paradigm. Composable calculations are what is missing from SQL, and we propose a new kind of column, called a measure, that attaches a calculation to a table. Like regular tables, tables with measures are composable and closed when used in queries.
SQL-with-measures has the power, conciseness and reusability of multidimensional languages but retains SQL semantics. Measure invocations can be expanded in place to simple, clear SQL.
To define the evaluation semantics for measures, we introduce context-sensitive expressions (a way to evaluate multidimensional expressions that is consistent with existing SQL semantics), a concept called evaluation context, and several operations for setting and modifying the evaluation context.
A talk at SIGMOD, June 9–15, 2024, Santiago, Chile
Authors: Julian Hyde (Google) and John Fremlin (Google)
https://doi.org/10.1145/3626246.3653374
Essentials of Automations: The Art of Triggers and Actions in FMESafe Software
In this second installment of our Essentials of Automations webinar series, we’ll explore the landscape of triggers and actions, guiding you through the nuances of authoring and adapting workspaces for seamless automations. Gain an understanding of the full spectrum of triggers and actions available in FME, empowering you to enhance your workspaces for efficient automation.
We’ll kick things off by showcasing the most commonly used event-based triggers, introducing you to various automation workflows like manual triggers, schedules, directory watchers, and more. Plus, see how these elements play out in real scenarios.
Whether you’re tweaking your current setup or building from the ground up, this session will arm you with the tools and insights needed to transform your FME usage into a powerhouse of productivity. Join us to discover effective strategies that simplify complex processes, enhancing your productivity and transforming your data management practices with FME. Let’s turn complexity into clarity and make your workspaces work wonders!
8 Best Automated Android App Testing Tool and Framework in 2024.pdfkalichargn70th171
Regarding mobile operating systems, two major players dominate our thoughts: Android and iPhone. With Android leading the market, software development companies are focused on delivering apps compatible with this OS. Ensuring an app's functionality across various Android devices, OS versions, and hardware specifications is critical, making Android app testing essential.
Neo4j - Product Vision and Knowledge Graphs - GraphSummit ParisNeo4j
Dr. Jesús Barrasa, Head of Solutions Architecture for EMEA, Neo4j
Découvrez les dernières innovations de Neo4j, et notamment les dernières intégrations cloud et les améliorations produits qui font de Neo4j un choix essentiel pour les développeurs qui créent des applications avec des données interconnectées et de l’IA générative.
Revolutionizing Visual Effects Mastering AI Face Swaps.pdfUndress Baby
The quest for the best AI face swap solution is marked by an amalgamation of technological prowess and artistic finesse, where cutting-edge algorithms seamlessly replace faces in images or videos with striking realism. Leveraging advanced deep learning techniques, the best AI face swap tools meticulously analyze facial features, lighting conditions, and expressions to execute flawless transformations, ensuring natural-looking results that blur the line between reality and illusion, captivating users with their ingenuity and sophistication.
Web:- https://undressbaby.com/
Odoo ERP software
Odoo ERP software, a leading open-source software for Enterprise Resource Planning (ERP) and business management, has recently launched its latest version, Odoo 17 Community Edition. This update introduces a range of new features and enhancements designed to streamline business operations and support growth.
The Odoo Community serves as a cost-free edition within the Odoo suite of ERP systems. Tailored to accommodate the standard needs of business operations, it provides a robust platform suitable for organisations of different sizes and business sectors. Within the Odoo Community Edition, users can access a variety of essential features and services essential for managing day-to-day tasks efficiently.
This blog presents a detailed overview of the features available within the Odoo 17 Community edition, and the differences between Odoo 17 community and enterprise editions, aiming to equip you with the necessary information to make an informed decision about its suitability for your business.
Atelier - Innover avec l’IA Générative et les graphes de connaissancesNeo4j
Atelier - Innover avec l’IA Générative et les graphes de connaissances
Allez au-delà du battage médiatique autour de l’IA et découvrez des techniques pratiques pour utiliser l’IA de manière responsable à travers les données de votre organisation. Explorez comment utiliser les graphes de connaissances pour augmenter la précision, la transparence et la capacité d’explication dans les systèmes d’IA générative. Vous partirez avec une expérience pratique combinant les relations entre les données et les LLM pour apporter du contexte spécifique à votre domaine et améliorer votre raisonnement.
Amenez votre ordinateur portable et nous vous guiderons sur la mise en place de votre propre pile d’IA générative, en vous fournissant des exemples pratiques et codés pour démarrer en quelques minutes.
Most important New features of Oracle 23c for DBAs and Developers. You can get more idea from my youtube channel video from https://youtu.be/XvL5WtaC20A
E-commerce Development Services- Hornet DynamicsHornet Dynamics
For any business hoping to succeed in the digital age, having a strong online presence is crucial. We offer Ecommerce Development Services that are customized according to your business requirements and client preferences, enabling you to create a dynamic, safe, and user-friendly online store.
SMS API Integration in Saudi Arabia| Best SMS API ServiceYara Milbes
Discover the benefits and implementation of SMS API integration in the UAE and Middle East. This comprehensive guide covers the importance of SMS messaging APIs, the advantages of bulk SMS APIs, and real-world case studies. Learn how CEQUENS, a leader in communication solutions, can help your business enhance customer engagement and streamline operations with innovative CPaaS, reliable SMS APIs, and omnichannel solutions, including WhatsApp Business. Perfect for businesses seeking to optimize their communication strategies in the digital age.
GraphSummit Paris - The art of the possible with Graph TechnologyNeo4j
Sudhir Hasbe, Chief Product Officer, Neo4j
Join us as we explore breakthrough innovations enabled by interconnected data and AI. Discover firsthand how organizations use relationships in data to uncover contextual insights and solve our most pressing challenges – from optimizing supply chains, detecting fraud, and improving customer experiences to accelerating drug discoveries.
A Study of Variable-Role-based Feature Enrichment in Neural Models of CodeAftab Hussain
Understanding variable roles in code has been found to be helpful by students
in learning programming -- could variable roles help deep neural models in
performing coding tasks? We do an exploratory study.
- These are slides of the talk given at InteNSE'23: The 1st International Workshop on Interpretability and Robustness in Neural Software Engineering, co-located with the 45th International Conference on Software Engineering, ICSE 2023, Melbourne Australia
UI5con 2024 - Keynote: Latest News about UI5 and it’s EcosystemPeter Muessig
Learn about the latest innovations in and around OpenUI5/SAPUI5: UI5 Tooling, UI5 linter, UI5 Web Components, Web Components Integration, UI5 2.x, UI5 GenAI.
Recording:
https://www.youtube.com/live/MSdGLG2zLy8?si=INxBHTqkwHhxV5Ta&t=0
What is Master Data Management by PiLog Groupaymanquadri279
PiLog Group's Master Data Record Manager (MDRM) is a sophisticated enterprise solution designed to ensure data accuracy, consistency, and governance across various business functions. MDRM integrates advanced data management technologies to cleanse, classify, and standardize master data, thereby enhancing data quality and operational efficiency.
DELDroid: Determination & Enforcement of Least Privilege Architecture in AnDroid
1. DELDroid: Determination & Enforcement
of Least Privilege Architecture in AnDroid
Mahmoud Hammad
Software Engineering Ph.D. Candidate
Mahmoud Hammad, Hamid Bagheri, and Sam Malek
IEEE International Conference on Software Architecture (ICSA 2017)
Gothenburg, Sweden, April 2017. 3/22/2017
2. 2
Android in the market
Source: International Data Corporation (IDC)
8. LP in Android documentation
The Android system implements the principle of least privilege. That is, each app, by
default, has access only to the components that it requires to do its work and no more.
This creates a very secure environment in which an app cannot access parts of the
system for which it is not given permission.
Android security mechanisms treat apps as the minimum security entities 8
9. Security Consequences
• Hard to comprehend the security posture of an Android system
• Increases the attack surface
• Cause many security vulnerabilities
• Privilege escalation attack
• Hidden Inter-Component Communication (ICC) attack
9
24. Multiple Domain Matrix (MDM)
• MDM models a complex system with multiple domains
• Each domain is modeled as a Design Structure Matrix (DSM)
• DSM and MDM are very effective in capturing and analyzing the
architecture of a complex system
24
38. Implementation details
• DELDRoid is a Java application
• input : set of apps
• output: LP architecture and ECA rules
• The enforcement mechanism implemented in the AOSP version 6 (Marshmallow)
• Privilege Manager introduced a new package in the Android runtime
• This package does not affect the existing apps
• Other components are modified such as ActivityManager and ContextWrapper
• Installed on Android emulator and Nexus 5X phone
38
39. Evaluation
• RQ1: How effective is DELDroid in reducing the attack surface?
• RQ2: How effective is DELDroid in detecting and preventing attacks in
real-world apps?
• RQ3: What is the performance of DELDroid?
39
45. RQ2: Attacks detection and prevention
• 54 malicious and vulnerable apps
• The steps and inputs required to create the attacks are known
• The dataset contains
• 18 privilege escalation attacks
• 24 hidden ICC attacks through dynamic class loading
• Detection: DELDroid analyzes the derived LP architecture
• Prevention: manually exercise the apps to create the attacks
45
48. • Execution time of running DELDroid on the 10 bundles, repeated 33 times
RQ3: Performance – design time
Recovery
(min)
LP Determination
(sec)
Analysis
(sec)
ECA Rules
(sec)
Average per
bundle
69.5 ± 2.7 1.61 ± 0.69 0.002 ± 0.001 0.45 ± 0.99
48
49. • A script that sends 363 requests to an Android system
• Each request causes the system to perform an ICC transaction
• On average, DELDroid takes 25 ± 10 milliseconds to check an intercepted ICC
RQ3: Performance – run time
49
51. Threats to validity
• Not all hidden ICC communications are malicious
• Previous study proposed a technique that check the integrity of the loaded code [1]
• Static analysis tools cannot effectively analyze obfuscated apps
• integrating dynamic analysis techniques
[1] S. Poeplau et al. Execute this! analyzing unsafe and maliciousdynamic code loading in android applications. In NDSS, SanDiego, California, February 2014.
51
52. Conclusion
• DELDroid is an automated approach for determining and enforcing the LP
architecture for an Android system
• The LP architecture narrows the attack surface and thwarts certain security
attacks
• Experimental results show
• between 97% to 99% attack surface reduction
• detecting and preventing security attacks (97% precision and 100% recall)
• negligible runtime performance overhead
52
Editor's Notes
In this presentation, I will talk about DELDroid, our automated system for determination and enforcement of least privilege architecture in Android.
As you may know, Android is the most predominant mobile platform with 87% market share. Which means 87% of the smarphone users are running Android platform.
One of the main reasons that people are attracted to smartphone devices is the abundant number of apps in the app stores.
For example, Google play app store contains more than 2.6 million apps as of Dec. 2016, and there are numerous other app stores.
Unfortunately, the number of malicious Android apps is increasing exponentially, as you can see in this figure.
In fact, Android platform is the most targeted mobile platform not only because of its popularity, it is one reason, but also because the Android platform is not secure enough.
I am saying that because, if you, as a user, installs an Android application, such as Messaging app or FunGame app, each app consists of several components, different screens, called Activities in Android, different services that run in the background, or different database components.
If an app asks for permissions to access the various system resources, such as SMS permission in the messaging app or Location permission in the FunGame app, Android grants permissions at the granularity of applications. Therefore, all components in an application are granted the same permissions that are granted to their parent application.
Keep in your mind that, not all components in an app are developed by the app’s developer. For example, if an app includes an advertisement library, payment processing library, or social networking library, these libraries they add components to the app, yet Android treats all components in an app alike and grant them the same permissions that are granted to their parent app.
Therefore, almost all components have more permissions than they actually need. They can use these permissions to access the various system resources.
So, this is the first issue, that components have more permissions than they actually need.
The second issue is that, Android promotes component-based development in which components can communicate with one another either inside one app or across apps with no restrictions in most cases. As long a component is not set to private, all components from various apps can communicate with it.
Components can communicate with one another using event messages called Intents. Either explicit Intent, in which the target component is explicitly specified or implicit Intent in which the action to be performed is specified. For example, a component can send an implicit Intent to all components that can open html file or play a music file.
Again, since Android grants privileges at the granularity of apps, almost all components have more communication privileges than they actually need.
So we have these two issues, components have more permissions than they actually need, and components have more communication privileges than they actually need.
And These two issues form our research problem.
Which is components are over-privileged and violate the well established least-privilege security principle. This security principle promotes for granting each component that exact privileges it needs to fulfil its task.
This shows that Android security mechanisms treat applications as the minimum security entities and cannot distinguish between their components.
https://developer.android.com/guide/components/fundamentals.html
This systematic violation of least privilege security principle has many security consequences. among them, it makes comprehending the security posture of an Android system tedious and error prone, not only for a security architect, but also for security analysis tools that need to examine all possible communications and all allowed permissions in an Android system to understand the risk it poses.
Also, it increases the attack surface of an Android system. So if a component is compromised, the impact might be severe due to the extra privileges that component has.
Moreover, this violation is the root cause of many security vulnerabilities such as privilege escalation attack and hidden Inter-Component-Communication ICC attacks. In the next two slides, I will describe each vulnerabilit individually.
Privilege escalation or permission re-delegation is an attack in which a component performs a privileged task on behalf of an unprivileged component.
In Android, a component can define its provided capabilities using an object called Intent filter. For example, a component can say I can send a text message or I can open html file, etc. And Android uses these information to match the implicit Intent with the component that can handle it.
In this Android system, the Sender component provides an interface to send text messages upon receiving an Intent from another component. So, once Sender receives Intent i1, it extracts the phone number and the message body and uses the SMS permission to send a text message.
In this system, the Sender service is a vulnerable component in which it does not check if the calling component has SMS permission before sending a text message. So this is the missing code in this service. In this situation, another component such as LevelUp can communicate with the Sender using implicit Intent i3 to send a text message without having an SMS permission. This communication results in leaking the user’s location to a premium rate number.
A more sophisticated attack is the hidden ICC attack. Instead of LevelUp directly communicating with the Sender to send a text message, it can leverage a dynamic class loading feature which allows LevelUp to download a JAR file from external sources, such as SD card or remote web server, then LevelUp can load and executes the contained codes in that JAR file. So the loaded code can use the location permission to determine the user’s location and creates an implicit Intent, i3, that LevelUp can use to communicate with the Sender service. Again, the LevelUp can send text messages to any premium rate number without having SMS permission.
This hidden ICC attack is not detected by static analysis tools, the tools that analyze applications source code or bytecode without running them, since the code that allows LevelUp to communicate with Sender is not part of the FunGame app, neither its source code nor its bytecode.
Additionally, dynamic analysis techniques, the techniques that run and monitor the execution of the applications, cannot effectively detect such vulnerability, especially if the app incorporates complicated evasion tactics such as timing-bombs. Execute the malicious code on Saturday at 3am.
In this presentation, I will use this Android system as a running example to illustrate
our approach and then present experimental results of DELDroid and conclude the presentation.
This figure depicts our approach, DELDroid, an automated system for determination of least-privilege architecture, an architecture that grants each component the exact privileges it needs to fulfill its task, then it enforces it at runtime.
Our approach consists of 5 steps:
the first step takes a set of Android apps packages, APK files, and statically extracts information from them
the second step derives the original system architecture, an architecture that shows the current privileges each component has as allowed or as permitted by Android platform. The permissions that each component is granted and the communication privileges each component has.
the third step determines the exact privileges each component needs to fulfil its task and models that in an architecture called least-privilege architecture
The fourth step analyzes the security posture of the Android system in light of the determined LP architecture to check if the system is vulnerable to privilege escalation attacks and reports that. Then, a security architect can further adapt or modify the determined architecture.
LP Enforcer transforms the determined least-privilege architecture to a set of Event-Condition-Action rules. Each rule reads as follows: when an event occurs, check a condition, if it holds, executes the action.
Then our Privilege Manager layer in our modified version of Android enforces the ECA rules at runtime.
Now let’s see how each step works in light of our running example.
Again, the first step takes a set of Android applications’ packages or APK files and leverages several static analysis tools to extract information from these applications.
Each Android package or APK file contains a configuration file called manifest file and the app’s bytecode. The manifest file contains information about the components in the app, their properties such as their types and the capabilities that each component defines using Intent Filters, and the permissions that the application asks for. So, in our example, the Messaging app is granted the SMS permission and all of its components are granted it as well. Same thing for the FunGame application.
The bytecode contains information about the used permissions, for example, the Sender service uses the SMS permission through calling the sensitive SMS APIs. Therefore, the Sender service uses the SMS permission.
The enforced permissions are the permissions that a component requires from the calling components to have. Remember the checkCallingPermisssion API, if the Sender service used that code, the SMS permission would be an enforced permission by the Sender service. And also there is another way of enforcing permissions in Android in which an app can create a permission and uses that permission for self-protecting. In our running example none of the components is enforcing a permission and hence this domain is empty.
In addition to that, this step extracts the latent Intents in the app’s bytecode. Therefore, Intent i1 and i2 are statically extracted from the app’s bytecode and placed in this table. Notice that neither the location permission usage nor the Intent i3 are statically extracted since they are not part of the app’s bytecode. They are part of the dynamically loaded code and hence they are not part of this table. The ID column in this table contains auto generated numbers for later use.
This step analyzes the privileges each component has in terms of permissions it has and communication privileges it has, and it represents that in an architecture called the original system architecture. So this architecture shows how Android manages the components’ privileges.
Our approach uses Multiple Domain Matrix to model the architecture.
MDM is a matrix representation of a complex system with multiple domains. Each domain is modeled as Design Structured Matrix or Dependency Structure Matrix DSM.
DSM and MDM are very effective tools in capturing and analyzing the architecture of a complex system. Let’s see an example.
Suppose that we have this system that consists of three tasks where task 1 depends on Task 2, Task 2 depends on Task 3, etc. We can represent this system using DSM where each non-empty cell represent a dependency between the element in the row to the element in the column.
Now, if we need to model another domain in this system, where a task is assigned to a person, for example Task 1 is assigned to person 1, task 2 is assigned to both person 1 and 2, in this case, we can use a MDM to represent the system with two domain.
So in our approach we borrowed this concept to represent the architecture of an Android system with multiple domains.
Regarding to our running example where by default all components in an app are granted the same permissions that are granted to their parent apps and components can communicate with one another, this would be the derived original architecture represented as MDM with 4 domain.
The communication domain shows that the component in the row is allowed to communicate with the component in the column.
Permission granted domain shows the granted permissions for each component. Since all components in an app are granted the same permissions, all components in the Messaging app are granted the SMS permissions. The permission usage are the directly used permissions by each component and the permission enforcement domain are the enforced permissions by each component as described in the table of the first step.
Privilege Reducer step determines the exact privileges each component needs to fulfil its task and models that in an architecture called LP architecture in a MDM.
For our running example, this is the determined LP architecture. The communication domain shows the needed communications that each component needs as determined by the Intents that each components creates and uses.
For example, the Composer component is allowed to communicate with the Sender component since there is an Intent, i1. Same thing for the communication between Main and LevelUp.
Notice that, the communication between LevelUp and Sender is not part of the LP architecture since the code that creates the Intent, i3, is not part of the FunGame’s bytecode.
Permission granted domain shows the granted permissions for each component. Sender component is granted the SMS permission since it uses this permission to send text messages. On the other hand, Composer component is granted this permission since it communicates with the Sender that uses this permission and its app, Messaging app, is granted this permission. In this case, the Composer component has a legitimate reason to hold this permission.
So what DELDroid did so far, it derived the original architecture and determined the LP architecture of an Android system. As you can see it reduced both the communication domain and the permission granted domain.
Now, once DELDroid determined the LP architecture, the next step, Security Analyzer, analyzes the architecture for any potential privilege escalation attacks and report them, so a security architect can further manages the privileges.
It worths mentioning that DELDroid can be configured to remove any communication marked as potential privilege escalation attack until a security architect decides otherwise.
As a concrete example, let’s assume that LevelUp does not use dynamic class loading to communicate with the Sender component, instead it creates an implicit Intent and uses it to communicate with the Sender to leak the user’s location via a text message. In this case, the Location usage and the Intent i3 is part of the FunGame’s bytecode and hence it is statically extracted.
This architecture would be the determined LP architecture for this Android system. The LP architecture allows the LevelUp to communicate with the Sender and grants LevelUp the location permission.
Now, the LP Analyzer step automatically checks each communication and once it sees that there is a communication between LevelUp and Sender, in which Sender uses SMS permission without enforcing it and LevelUp does not have this permission, it marks this communication as potential privilege escalation attack.
Then a security architect can further adapt or modify the architecture.
Once the LP architecture is determined, this step transforms the architecture to a set of Event-Condition-Action or ECA rules that capture the architecture.
Back to our running example where LevelUp uses dynamic class loading to conduct a hidden ICC attack. For this Android system, this is the determined LP architecture. Since LevelUp is not allowed to communicate with all components in the Messaging application, this step creates this ECA rule that prevents LevelUp from communicating with all components in the Messaging app.
So, enforcing this ECA rule at runtime would prevent LevelUp from communicating with the Sender service and hence preventing the hidden ICC attack.
Similarly, the LevelUp is not granted the Location permission in this architecture, therefore, this step creates this ECA rule that would prevent LevelUp from accessing the Location service.
The generated ECA rules are enforced using the Privilege Manager Layer, a layer that we have added to the Android platform. This layer contains two components and the ECA rules repository.
ICC Monitor component intercepts each ICC transaction and vet it against the stored ECA rules.
Resource Monitor component intercepts each resource access request and checks it the requester component has a permission to access the requested resources.
Let’s take a look at the DELDroid’s evaluation results.
We have implemented DELDroid as a java application that takes a set of Android apps as input and generates a LP architecture and a set of rules that capture the architecture.
The enforcement mechanisms implemented in the AOSP version 6.
The privilege manager introduces a new package but this package does not affect the existing apps.
Finally, we have successfully installed our modified Android version on Android emulator and Android Nexus 5X device.
(S36)
Our evaluation address these thre research questions.
(1) The effectiveness of DELDroid in reducing the attack surface,
(2) the ability of our approach in detecting and preventing security attacks, and
(3) the performance overhead of our DELDroid
To perform the evaluation, we have downloaded apps from various repositories as you can see from the upper table. 370 benign apps from Google play store; 335 vulnerable apps identified by a previous study, and 225 malicious apps drawn from various repositories shown in the green table.
To answer the RQ1, we created 10 bundles each containing 30 randomly selected apps from the 3 datasets. Each bundle contains 24 benign, 3 malicious, and 3 vulnerable apps. This table shows the structure of each bundle in terms of the number of components, Intents, and Intent Filters.
This table shows the attack surface reduction in the communication domain. For example, the possible communications in Bundle 1 is 99% reduced from over 29K to only 42 inter app communications (IAC).
Similarly, the permission granted domain is also reduced by 97%.
As I presented before in step 4, once the LP architecture is determined, DELDroid analyzes it for any potential privilege escalation vulnerabilities.
This table depicts the number of the potential privilege escalation vulnerabilities in bith, the original and the LP architectures.
For example, in Bundle 5, there are more than 26 thousand potential privilege escalation vulnerabilities and only 2 of them are in the LP architecture.
These numbers show the effectiveness of our approach in reducing the attack surface of Android system.
To answer the second research question, we used 54 apps with known vulnerabilities and the steps to generate the attacks.
The dataset contains 18 privilege escalation attack and 24 hidden ICC attacks. We manually checked and confirmed the correctness of their implementation.
For the determination, DELDroid determined and analyzed the LP architecture for this dataset and reported the detected potential privilege escalation attacks.
For the prevention study, we manually installed these apps and exercised them while enforcing the determined LP architecture to see if DELDroid prevented the attacks or not.
DELDroid detected 19 communications as privilege escalation attacks. 18 of them are true positive and 1 is false positive.
Our manual inspection of the FP case showed that this was due to the shortcomings of the used static analysis tools. In particular, since the static analysis tools we relied upon are not path sensitive, they tend to over-approximate the behavior of Android architecture and hence leads to such FP.
Overall, the precision is 94.7% and the recall is 100%
Remember we have 18 privilege escalation attacks and 24 hidden ICC attacks, so the total is 42 attacks. DELDroid prevented all the 19 detected privilege escalation attacks and all the 24 hidden ICC attacks. Therefore, the precision is 97.7% and 100% recall.
These high accuracy numbers show the ability of our approach in detecting and preventing certain security attacks.
Last experiment, we measured the performance of DELDroid. We ran this experiment on the 10 bundles repeated 33 times to achieve high confident. On average, it takes about 70 minutes to statically analyze the apps and determines the LP architecture. The vast majority of the time is spent in the static analysis tools.
For measuring the runtime performance overhead, we sent 363 request to an Android system, each request causes the system to perform an ICC transaction of some sort, then we measured the time it takes to check each ICC transaction. On average, it takes 25 milliseconds.
This time cannot perceive as delay by the users, as Android documentation stated that the user starts noticing delays after 100-200 ms.
These experimental results corroborate DELDroid’s effectiveness in reducing the attack surface and its ability to detect and prevent security attacks in a negligible time.
Some limitation of DELDroid: not all hidden ICC communication are malicious, although a previous study showed that benign developers, even for the top 50 apps, are not infallible of mistakenly use this feature such as downloading a code from http servers rather than https.
They proposed an enhancement to the Android kernel to check the integrity of the loaded code before executing it. So we can integrate such a technique in our approach.
Our approach also has some limitations inherited from the use of of the static analysis tools such as their ineffectiveness to analyze an obfuscated code. Therefore, we are planning to integrate dynamic analysis approaches to discover the architecture.
I have presented DELDroid, an automated system for determining and enforcing the least privilege architecture of an Android system without the need to modify the apps.
Our experimental results show the effectiveness of our approach in reducing the attack surface and the ability of our approach in detecting and preventing certain security attack in a negligible time. Moreover, our approach allows a security architect to adapt or modify the architecture and enforces it while the system is running.