CryptoLint

CryptoLint




Mobile application developers are using cryptography in their products to protect sensitive data like passwords, short messages, documents etc.  Quite commonly developers are prone to errors while implementing security standards and using cryptography primitives. Exactly this is in the article "An Empirical Study of Cryptographic Misuse in AndroidApplications". The study tested Android applications from Google Play marketplace which had security and cryptographic implementations. To define what is secure and what is misused the paper mentions standard notions of security referring to IND-CPA (Indistinguishability under chosen-plaintext attack) security. Study was conducted in light-weight static analysis approach using a tool called CryptoLint which is based upon the Androguard Android program analysis framework. Study showed that from 11,748 cryptographic implementations in Android applications 10,327 programs were using cryptography inappropriately which is 88% of the total sum.

Basis for these numbers are that developers are breaking set of rules and principles which protect IND-CPA security property. CryptoLint checks for 6 common rules without which system cannot be secure:
  1. Do not use ECB (Electronic Codebook) mode for encryption.
  2. Do not use a non-random IV (Initialization vector) for CBC (Cipher Block Chaining) encryption. 
  3. Do not use constant encryption keys.
  4. Do not use constant salts for PBE (Password-based encryption).
  5. Do not use fewer than 1,000 iterations for PBE.
  6. Do not use static seeds to seed SecureRandom 
The way CryptoLint works to check these rules is static program slicing by which tool identifies flows between cryptographic keys, initialization vectors, salts and other cryptographic material and operations. CryptoLint computes static program slices that terminate in calls to cryptographic APIs, and then extracts the necessary information from these slices. Since CryptoLint was created when Android Jelly Bean 4.3 was latest version it was designed to target specifically Dalvik bytecode. From this low-level representation it is translated into intermediate representation which group semantically similar instructions and creates control flow graphs for all methods and super control flow graphs to extract information about types. Subsequently it uses static programing slicing to conclude how are specific variables changed and then evaluates whether the security rules are applied.

 CryptoLint doesnt work on native code so it can not evaluate cryptographic primitives that are invoked in that manner. It also cannot detect variance in implementations of cryptography algorithms such as specifying first block of the message at random value while using constant Initialization vector in CBC mode. Also CryptoLint can in no way detect security vulnerabilities of already defined cryptographic protocols.

Very common misuse that CryptoLint detected and is easily mitigated is default mode in cryptographic libraries (such as BouncyCastle) which is set to ECB so developers when encrypting messages rarely define more then the type of algorithm they wish to use.

For the final note CryptoLint is a good tool with interesting new approach using static program slicing to identify data flows and recognize misuses in cryptographic algorithms, but the project has not been continued and is currently outdated and there is no source available. Still the basic idea can be used and adjusted to newer systems and it seems to be very useful for fast checking basic vulnerabilities of the system which can be exploited by more detailed analysis.

download file now