SpanDex: Secure Password Tracking for Android
Date: August 2014
Publication: 23rd USENIX Security Symposium, SEC '14
Source 1: https://www.usenix.org/system/files/conference/usenixsecurity14/sec14-paper-cox.pdf
Source 2: http://www.cs.duke.edu/~lpcox/spandex.pdf
Abstract or Summary:
This paper presents SpanDex, a set of extensions to Androidís Dalvik virtual machine that ensures apps do not leak usersí passwords. The primary technical challenge addressed by SpanDex is precise, sound, and efficient handling of implicit information flows (e.g., information transferred by a programís control flow). SpanDex handles implicit flows by borrowing techniques from symbolic execution to precisely quantify the amount of information a processí control flow reveals about a secret. To apply these techniques at runtime without sacrificing performance, SpanDex runs untrusted code in a data-flow sensitive sandbox, which limits the mix of operations that an app can perform on sensitive data. Experiments with a SpanDex prototype using 50 popular Android apps and an analysis of a large list of leaked passwords predicts that for 90% of users, an attacker would need over 80 login attempts to guess their password. Today the same attacker would need only one attempt for all users.
PasswordResearch.com Note: Additional unlisted author: Sai Cheemalapati. Video and audio recordings of paper presentation available here: https://www.usenix.org/conference/usenixsecurity14/technical-sessions/presentation/cox
Do you have additional information to contribute regarding this research paper? If so, please email firstname.lastname@example.org with the details.