More Like this

1. Data Protection with SMSD Labware

   https://doi.org/10.1145/3287324.3293785  

   Shahriar, Hossain; Qian, Kai; Talukder, Md Arabin; Parizi, Reza (February 2019, Proc. of 50th ACM Technical Symposium on Computer Science Education (SIGCSE 2019))

   The majority of malicious mobile attacks take advantage of vulnerabilities in mobile applications, such as sensitive data leakage via inadvertent or side channel, unsecured sensitive data storage, data transmission, and many others. Most of these mobile vulnerabilities can be detected in the mobile software testing phase. However, most development teams often have virtually no time to address them due to critical project deadlines. To combat this, the more defect removal filters there are in the software development life cycle, the fewer defects that can lead to vulnerabilities will remain in the software product when it is released. As part of Secure Mobile Software Development (SMSD) project, we are currently developing capacity to address the lack of pedagogical materials and real world learning environment in secure mobile software development through effective, engaging, and investigative approaches. In this session, we provide details of a new implemented module named data protection. We also share our initial experience and feedback on the developed module. 

   more » « less
2. Mobile Software Security with Dynamic Analysis

   https://doi.org/10.1109/PRDC.2018.00039  

   Shahriar, Hossain; Qian, Kai; Talukder, Md Arabin; Lo, Dan; Patel, Nidhibahen (December 2018, Proc. of the 23rd IEEE Pacific Rim International Symposium on Dependable Computing (PRDC))

   The majority of malicious mobile attacks take advantage of vulnerabilities in mobile software (applications), such as sensitive data leakage, unsecured sensitive data storage, data transmission, and many others. Most of these vulnerabilities can be detected by analyzing the mobile software. In this paper, we describe a tainted dataflow approach to detect mobile software security vulnerability, particularly, SQL Injection. 

   more » « less
3. An Exploratory Analysis of Mobile Security Tools

   Shahriar, Hossain; Talukder, Md Arabin; Islam, Md Saiful (October 2019, Conference on Cybersecurity Education, Research and Practice)

   The growing market of the mobile application is overtaking the web application. Mobile application development environment is open source, which attracts new inexperienced developers to gain hands on experience with application development. However, the security of data and vulnerable coding practice is an issue. Among all mobile Operating systems such as, iOS (by Apple), Android (by Google) and Blackberry (RIM), Android dominates the market. The majority of malicious mobile attacks take advantage of vulnerabilities in mobile applications, such as sensitive data leakage via the inadvertent or side channel, unsecured sensitive data storage, data transition and many others. Most of these vulnerabilities can be detected during mobile application analysis phase. In this paper, we explore vulnerability detection for static and dynamic analysis tools. We also suggest limitations of the tools and future directions such as the development of new plugins. 

   more » « less
4. Enhancing Proactive Control Mobile and Web Software Security Education with Hands-on Labware

   Shahriar, Hossain; Qian, Kai; Shalan, Atef; Wu, Fan (July 2020, Proc. of 44th IEEE Conference on Computer, Software and Applications (COMPSAC))

   While the number of mobile and web applications is growing exponentially, the mobile and web security threat landscape is growing explosively. Malicious malware may attack vulnerable applications and obtain personal or enterprise confidential data anywhere and anytime. Most vulnerabilities should be addressed and fixed during the early stages of software development. However, many software development professionals lack the awareness of the importance of security vulnerabilities and the necessary knowledge and skills at the software development stage. This paper addresses the needs and challenges of the lack of pedagogical materials and real-world learning environment in ProActive Control for Software Security (PASS) through effective, engaging, and investigative authentic learning approaches. 

   more » « less
5. OWASP Risk Analysis Driven Security Requirements Specification for Secure Android Mobile Software Development

   https://doi.org/10.1109/DESEC.2018.8625114  

   Qian, Kai; Parizi, Reza M.; Lo, Dan (December 2018, 2018 IEEE Conference on Dependable and Secure Computing (DSC))

   The security threats to mobile applications are growing explosively. Mobile apps flaws and security defects open doors for hackers to break in and access sensitive information. Defensive requirements analysis should be an integral part of secure mobile SDLC. Developers need to consider the information confidentiality and data integrity, to verify the security early in the development lifecycle rather than fixing the security holes after attacking and data leaks take place. Early eliminating known security vulnerabilities will help developers increase the security of apps and reduce the likelihood of exploitation. However, many software developers lack the necessary security knowledge and skills at the development stage, and that's why Secure Mobile Software Development education is very necessary for mobile software engineers. In this paper, we propose a guided security requirement analysis based on OWASP Mobile Top ten security risk recommendations for Android mobile software development and its traceability of the developmental controls in SDLC. Building secure apps immune to the OWASP Mobile Top ten risks would be an effective approach to provide very useful mobile security guidelines. 

   more » « less