Homework 3 - Case Study on Bypassing Simple Code Audits
This is the final case study of the quarter. It is due on the last day of
classes: Tuesday June 9th, just before midnight.
The purpose of this case study is to look at how a malicious programmer might
try to bypass simple code audits. This could allow a malicious app to be
approved to the Apple, Android, or MS Windows app stores for example.
Before You Begin Reading The References
Write 1 to 2 paragraphs summarizing how you think a malicious programmer might
bypass simple (e.g. quick) code audits. Use the techniques learned in class to
theorize how this might occur.
The References
Read the following scholarly references on bypassing simple code audits and
techniques to detect malicious apps that can be used along with simple code
audits to provide more adequate coverage:
- T. Wang, K. Lu, L. Lu, S. Chung and W. Lee, "Jekyll on iOS: When Benign
Apps Become Evil", Proceedings of the 22nd USENIX Security Symposium,
Washington, D.C., USA, August 14-16, 2013, [online]
Presentation,
Paper
- M. Ernst, R. Just, et. al, "Collaborative Verification of Information Flow
for a High-Assurance App Store", Proceedings of the 2014 ACM SIGSAC
Conference on Computer and Communications Security (CCS'14), 2014,
[online]
ACM Digital Library
(PDF download available on-campus)
- Y. Zhou, Z. Wang, W. Zhou, and X. Jiang, "Hey, You, Get Off of My Market:
Detecting Malicious Apps in Official and Alternative Android Markets,"
Proceedings of the 19th Annual Sympossium on Network and Distributed
System Security (NDSS 12), 2012, [online]
Paper
- A. Armando, G. Costa, L. Verderame, and A. Merlo, "Securing the "Bring Your
Own Device" Paradigm", IEEE Computer, Volume 47, Issue 6, June 2014,
pp. 48-56, [online]
IEEE Explore (PDF download available on-campus)
The Writeup
Turn in a writeup to Moodle that contains the following:
- Your 1-2 paragraphs that you wrote before reading the references
- A 1-2 paragraph summary of each of the four references
- Your responses to the following questions:
- Why is simple source code auditing ineffective at detecting malware?
When answering, consider the techniques that the Jekyll app used to
bypass the source code audit at the Apple Store.
- How do the additional techniques presented in the above references
differ from source code auditing?
- What might a malicious programmer try to do in order to bypass the
additional techniques?
- A 1-2 paragraph summary of why you think detecting malicious apps is
difficult.