Investigating weaknesses in Android certificate security

Daniel E. Krych; Stephen Lange-Maney; Patrick McDaniel; William Glodek

doi:10.1117/12.2177498

22 May 2015 Investigating weaknesses in Android certificate security

Daniel E. Krych, Stephen Lange-Maney, Patrick McDaniel, William Glodek

Proceedings Volume 9478, Modeling and Simulation for Defense Systems and Applications X; 947804 (2015) https://doi.org/10.1117/12.2177498
Event: SPIE Defense + Security, 2015, Baltimore, MD, United States

Abstract

Android's application market relies on secure certificate generation to establish trust between applications and their users; yet, cryptography is often not a priority for application developers and many fail to take the necessary security precautions. Indeed, there is cause for concern: several recent high-profile studies have observed a pervasive lack of entropy on Web-systems leading to the factorization of private keys.1 Sufficient entropy, or randomness, is essential to generate secure key pairs and combat predictable key generation. In this paper, we analyze the security of Android certificates. We investigate the entropy present in 550,000 Android application certificates using the Quasilinear GCD finding algorithm.1 Our results show that while the lack of entropy does not appear to be as ubiquitous in the mobile markets as on Web-systems, there is substantial reuse of certificates only one third of the certificates in our dataset were unique. In other words, we find that organizations frequently reuse certificates for different applications. While such a practice is acceptable under Google's specifications for a single developer, we find that in some cases the same certificates are used for a myriad of developers, potentially compromising Android's intended trust relationships. Further, we observed duplicate certificates being used by both malicious and non-malicious applications. The top 3 repeated certificates present in our dataset accounted for a total of 11,438 separate APKs. Of these applications, 451, or roughly 4%, were identified as malicious by antivirus services.

Citation Download Citation

Daniel E. Krych, Stephen Lange-Maney, Patrick McDaniel, and William Glodek "Investigating weaknesses in Android certificate security", Proc. SPIE 9478, Modeling and Simulation for Defense Systems and Applications X, 947804 (22 May 2015); https://doi.org/10.1117/12.2177498

ACCESS THE FULL ARTICLE

INSTITUTIONAL
Select your institution to access the SPIE Digital Library.

SELECT YOUR INSTITUTION

PERSONAL
Sign in with your SPIE account to access your personal subscriptions or to use specific features such as save to my library, sign up for alerts, save searches, etc.

PERSONAL SIGN IN

No SPIE Account? Create one

PURCHASE THIS CONTENT

SUBSCRIBE TO DIGITAL LIBRARY

50 downloads per 1-year subscription

Members: $195

Non-members: $335 ADD TO CART

25 downloads per 1 - year subscription

Members: $145

Non-members: $250 ADD TO CART

PURCHASE SINGLE ARTICLE

Includes PDF, HTML & Video, when available

Members: $17.00

Non-members: $21.00 ADD TO CART

PROCEEDINGS
9 PAGES

DOWNLOAD PAPER SAVE TO MY LIBRARY

GET CITATION

RIGHTS & PERMISSIONS

Get copyright permission Get copyright permission on Copyright Marketplace

KEYWORDS

Computer security

Cryptography

Information security

Analytical research

Algorithm development

Computer programming

Databases

Show All Keywords

Keywords/Phrases

Search In:

Publication Years