SpanDex: Secure Password Tracking for Android
Authors: Landon P. Cox, Peter Gilbert, Geoffrey Lawler, Valentin Pistol, Ali Razeen, Bi Wu

Date: August 2014
Publication: 23rd USENIX Security Symposium, SEC '14
Publisher: USENIX
Source 1:
Source 2:

Abstract or Summary:
This paper presents SpanDex, a set of extensions to Androidís Dalvik virtual machine that ensures apps do not leak usersí passwords. The primary technical challenge addressed by SpanDex is precise, sound, and efficient handling of implicit information flows (e.g., information transferred by a programís control flow). SpanDex handles implicit flows by borrowing techniques from symbolic execution to precisely quantify the amount of information a processí control flow reveals about a secret. To apply these techniques at runtime without sacrificing performance, SpanDex runs untrusted code in a data-flow sensitive sandbox, which limits the mix of operations that an app can perform on sensitive data. Experiments with a SpanDex prototype using 50 popular Android apps and an analysis of a large list of leaked passwords predicts that for 90% of users, an attacker would need over 80 login attempts to guess their password. Today the same attacker would need only one attempt for all users. Note: Additional unlisted author: Sai Cheemalapati. Video and audio recordings of paper presentation available here:

Do you have additional information to contribute regarding this research paper? If so, please email with the details.

<-- Back to Authentication Research Paper Index

[Home] [About Us] [News] [Research]

Copyright © 2019