SO{U}RCERER: Developer-Driven Security Testing Framework for Android Apps
This addresses security testing challenges for Android app developers, particularly in small to medium-scale teams, by providing a more actionable and less complex approach, though it appears incremental as it builds on existing methods like static analysis and threat modeling.
The paper tackles the problem of Android app developers struggling with security testing due to tool-driven approaches lacking context and process-driven ones being resource-intensive, proposing SO{U}RCERER, a framework that guides developers to identify assets, detect and prioritize vulnerabilities, and mitigate them, resulting in 24-61% fewer security warnings than standalone static analyzers in a case study on 36 mobile money apps.
Frequently advised secure development recommendations often fall short in practice for app developers. Tool-driven (e.g., using static analysis tools) approaches lack context and domain-specific requirements of an app being tested. App developers struggle to find an actionable and prioritized list of vulnerabilities from a laundry list of security warnings reported by static analysis tools. Process-driven (e.g., applying threat modeling methods) approaches require substantial resources (e.g., security testing team, budget) and security expertise, which small to medium-scale app dev teams could barely afford. To help app developers securing their apps, we propose SO{U}RCERER, a guiding framework for Android app developers for security testing. SO{U}RCERER guides developers to identify domain-specific assets of an app, detect and prioritize vulnerabilities, and mitigate those vulnerabilities based on secure development guidelines. We evaluated SO{U}RCERER with a case study on analyzing and testing 36 Android mobile money apps. We found that by following activities guided by SO{U}RCERER, an app developer could get a concise and actionable list of vulnerabilities (24-61% fewer security warnings produced by SO{U}RCERER than a standalone static analyzer), directly affecting a mobile money app's critical assets, and devise a mitigation plan. Our findings from this preliminary study indicate a viable approach to Android app security testing without being overwhelmingly complex for app developers.