Keynote: How to statically detect insecure uses of cryptography - at scale and with almost perfect precision

No ratings

Presented at RuhrSecBochum 2019 by

Prof. Bodden

Abstract. For decades, static code analysis has been notorious for being ineffective, due to high false positive rates. Yet, recent algorithmic breakthroughs have now given us the capability to build static analysis tools that not only rapidly analyze code bases with millions of lines of code, but also yield perfect precision in most practical cases.In this talk I will highlight the main ideas behind those breakthroughs and will demonstrate CogniCrypt, a recent practical security code analysis tool that makes us of this leap in technology. CogniCrypt (www.cognicrypt.de) is an official Eclipse project integrating with various IDEs and CI environments, which allows code developers to precisely pinpoint security-critical misuses of APIs, particularly crypto APIs. It currently supports the analysis of Java and Android projects, but a variant for C/C++ is in the works as well.I will conclude my talk with results from a large-scale study in which we applied CogniCrypt to security-sensitive Android apps and to all software artifacts on MavenCentral.