How to statically detect insecure uses of crypto...
summary
Describes algorithmic advances in static code analysis that reduce false positives and enable scalable, precise detection of API misuse. Presents CogniCrypt, an Eclipse-integrated tool for finding security-critical cryptography misuses in Java and Android (with C/C++ planned), and shares results from large-scale analyses of Android apps and Maven Central artifacts.
AI-written summary · about
chapters (15)
- 0:00Intro
- 1:35Outline
- 2:15Benefits of SAST in theory
- 5:36st Major challenge: Heap assignments and "Aliasing"
- 8:12nd Major challenge: Field-sensitivity
- 11:04Problem analysis: Field-sensitivity
- 12:323rd major challenge: context-sensitivity
- 14:04Problem analysis: Context-sensitivity
- 15:26Undecidability!
- 18:31Problem: program analysis is undecidable
- 22:37An Application Developer's World
- 27:30CogniCrypt's Code Generation
- 28:22CogniCrypt workflow
- 32:31Maven The Central Repository
- 33:44Analysis of Google Play: top banking/health/password apps
related talks
18mBeyond Static Pattern Matching? Rethinking Automatic Cryptographic API Misuse Detection(…)
46mStrengthening Java Apps: Best Practices in Secure Coding for Java Developers
01h 07mHow to attack (and secure) an Android app: an introduction
38mEffective Usage Analysis: Boosting Developer Productivity Via Innovative, Noise-reduced Vulnerability Analysis
17mStatic Detection and Automatic Exploitation of Intent Message Vulnerabilities in Android
01h 02mApisecure, 14 & 15 March 2023 - Ted Miracco, CEO at Approov & Attestation.
34mSecuring Android: Tackling Advanced Threats and Enhancing App Security
38mAdvanced Techniques for Protecting Android Apps