The document discusses risk and defines it as the possibility of loss or injury. It then discusses crowd sourcing security testing and outlines some of the current inadequate solutions such as expensive security consultants, tools that don't scale, and developers who prioritize functionality over security. The document then summarizes the results of analyzing over 53,000 Android applications, finding most request GPS and contact permissions and lists the top third party libraries used. It concludes by proposing a whitelisting approach to security testing using static analysis and an unbiased third party.

4. Risk - noun `risk
The possibility of loss or injury

5. • •
• •
• •
• •
• •
• •
• •
•
•
•
•
•
•
•

6. • •
• •
• •
• •
• •
• •
•
•
•
•
•

10. •
•
•
•
•

11. •
•
•
•
•
•

12. •
•
•
•
•

13. •
•
•
•
•
•
•

17. •
•
•
•
•
•

18. •
•
•
•

19. •
‣
‣
•
‣
‣

20. •
‣
•
‣
‣

26. •
‣
‣
•

30. Crowd Sourced Current Solutions Inadequate
Internal Teams Developers
Dev Site A Dev Site B
Security Consultants
• Very expensive
• In short supply
iPhone • Time to results too long
Dev Site C Apps
Crowd
Internal Sourcing Tools
• Do not scale across sites
Open 3rd Party • Very high noise ratio
Source Open Software Software Vendors • Can not test 3rd party code
Source SYMC MSFT • Separation of duties issue
Outsourced
Developers
Offshore • Do not know how to write
Oracle secure code
Provider
• Prioritize time-to-ship,
functionality over security
Processes
• Difficult to implement
Eastern China • Years to fine tune
Europe India • Low adoption (< 1% of US
Contractors companies CMMI Level 5
certified)
Unknown
Skills

31. 53,000 Applications Analyzed
 Android Market: ~48,000
 3rd Party Markets: ~5,000
Permissions Requested
 Average: 3
 Most Requested: 117
Top “Interesting” Permissions
 GPS information: 24% (11,929)
 Read Contacts: 8% (3,626)
 Send SMS: 4% (1,693)
 Receive SMS: 3% (1262)
 Record Audio: 2% (1100)
 Read SMS: 2% (832)
 Process Out Calls: 1% (323)
 Use Credentials : 0.5% (248)

33. 52,000 Applications Analyzed
• Android Market:
• 3rd Party Markets:
Third Party Libraries
• Total Third Party Libraries:
• Top Shared Libraries
-
-
-
-
-
-
-
-

35. •
•
‣
•
•

36. •
•
•

37. Whitelisting
• Conduct static analysis of candidate applications
• Create a whitelist
• Use an unbiased 3rd party
• Enforcement via mobile policy