Stack Overflow Considered Harmful? The Impact of Copy Paste on Android Application Security. Fischer, F., Böttinger, K., Xiao, H., Stransky, C., Acar, Y., Backes, M., & Fahl, S. In 2017 IEEE Symposium on Security and Privacy (SP), pages 121–136, May, 2017. doi abstract bibtex Online programming discussion platforms such as Stack Overflow serve as a rich source of information for software developers. Available information include vibrant discussions and oftentimes ready-to-use code snippets. Previous research identified Stack Overflow as one of the most important information sources developers rely on. Anecdotes report that software developers copy and paste code snippets from those information sources for convenience reasons. Such behavior results in a constant flow of community-provided code snippets into production software. To date, the impact of this behaviour on code security is unknown. We answer this highly important question by quantifying the proliferation of security-related code snippets from Stack Overflow in Android applications available on Google Play. Access to the rich source of information available on Stack Overflow including ready-to-use code snippets provides huge benefits for software developers. However, when it comes to code security there are some caveats to bear in mind: Due to the complex nature of code security, it is very difficult to provide ready-to-use and secure solutions for every problem. Hence, integrating a security-related code snippet from Stack Overflow into production software requires caution and expertise. Unsurprisingly, we observed insecure code snippets being copied into Android applications millions of users install from Google Play every day. To quantitatively evaluate the extent of this observation, we scanned Stack Overflow for code snippets and evaluated their security score using a stochastic gradient descent classifier. In order to identify code reuse in Android applications, we applied state-of-the-art static analysis. Our results are alarming: 15.4% of the 1.3 million Android applications we analyzed, contained security-related code snippets from Stack Overflow. Out of these 97.9% contain at least one insecure code snippet.
@inproceedings{fischer_stack_2017,
title = {Stack {Overflow} {Considered} {Harmful}? {The} {Impact} of {Copy} {Paste} on {Android} {Application} {Security}},
shorttitle = {Stack {Overflow} {Considered} {Harmful}?},
doi = {10.1109/SP.2017.31},
abstract = {Online programming discussion platforms such as Stack Overflow serve as a rich source of information for software developers. Available information include vibrant discussions and oftentimes ready-to-use code snippets. Previous research identified Stack Overflow as one of the most important information sources developers rely on. Anecdotes report that software developers copy and paste code snippets from those information sources for convenience reasons. Such behavior results in a constant flow of community-provided code snippets into production software. To date, the impact of this behaviour on code security is unknown. We answer this highly important question by quantifying the proliferation of security-related code snippets from Stack Overflow in Android applications available on Google Play. Access to the rich source of information available on Stack Overflow including ready-to-use code snippets provides huge benefits for software developers. However, when it comes to code security there are some caveats to bear in mind: Due to the complex nature of code security, it is very difficult to provide ready-to-use and secure solutions for every problem. Hence, integrating a security-related code snippet from Stack Overflow into production software requires caution and expertise. Unsurprisingly, we observed insecure code snippets being copied into Android applications millions of users install from Google Play every day. To quantitatively evaluate the extent of this observation, we scanned Stack Overflow for code snippets and evaluated their security score using a stochastic gradient descent classifier. In order to identify code reuse in Android applications, we applied state-of-the-art static analysis. Our results are alarming: 15.4\% of the 1.3 million Android applications we analyzed, contained security-related code snippets from Stack Overflow. Out of these 97.9\% contain at least one insecure code snippet.},
booktitle = {2017 {IEEE} {Symposium} on {Security} and {Privacy} ({SP})},
author = {Fischer, F. and Böttinger, K. and Xiao, H. and Stransky, C. and Acar, Y. and Backes, M. and Fahl, S.},
month = may,
year = {2017},
keywords = {Android (operating system), Android Application Security, Android application security, Androids, Cryptography, Google, Google Play, Humanoid robots, Libraries, Software, Software Development, Stack Overflow, code security, code snippets, copy \& paste behavior, gradient methods, ieee\_mn, information source, online programming discussion platforms, pattern classification, production software, program diagnostics, security of data, software developers, software engineering, stack overflow, static analysis, stochastic gradient descent classifier, stochastic processes},
pages = {121--136},
}
Downloads: 0
{"_id":"cjm63RMkmXTr2Jw5Z","bibbaseid":"fischer-bttinger-xiao-stransky-acar-backes-fahl-stackoverflowconsideredharmfultheimpactofcopypasteonandroidapplicationsecurity-2017","author_short":["Fischer, F.","Böttinger, K.","Xiao, H.","Stransky, C.","Acar, Y.","Backes, M.","Fahl, S."],"bibdata":{"bibtype":"inproceedings","type":"inproceedings","title":"Stack Overflow Considered Harmful? The Impact of Copy Paste on Android Application Security","shorttitle":"Stack Overflow Considered Harmful?","doi":"10.1109/SP.2017.31","abstract":"Online programming discussion platforms such as Stack Overflow serve as a rich source of information for software developers. Available information include vibrant discussions and oftentimes ready-to-use code snippets. Previous research identified Stack Overflow as one of the most important information sources developers rely on. Anecdotes report that software developers copy and paste code snippets from those information sources for convenience reasons. Such behavior results in a constant flow of community-provided code snippets into production software. To date, the impact of this behaviour on code security is unknown. We answer this highly important question by quantifying the proliferation of security-related code snippets from Stack Overflow in Android applications available on Google Play. Access to the rich source of information available on Stack Overflow including ready-to-use code snippets provides huge benefits for software developers. However, when it comes to code security there are some caveats to bear in mind: Due to the complex nature of code security, it is very difficult to provide ready-to-use and secure solutions for every problem. Hence, integrating a security-related code snippet from Stack Overflow into production software requires caution and expertise. Unsurprisingly, we observed insecure code snippets being copied into Android applications millions of users install from Google Play every day. To quantitatively evaluate the extent of this observation, we scanned Stack Overflow for code snippets and evaluated their security score using a stochastic gradient descent classifier. In order to identify code reuse in Android applications, we applied state-of-the-art static analysis. Our results are alarming: 15.4% of the 1.3 million Android applications we analyzed, contained security-related code snippets from Stack Overflow. Out of these 97.9% contain at least one insecure code snippet.","booktitle":"2017 IEEE Symposium on Security and Privacy (SP)","author":[{"propositions":[],"lastnames":["Fischer"],"firstnames":["F."],"suffixes":[]},{"propositions":[],"lastnames":["Böttinger"],"firstnames":["K."],"suffixes":[]},{"propositions":[],"lastnames":["Xiao"],"firstnames":["H."],"suffixes":[]},{"propositions":[],"lastnames":["Stransky"],"firstnames":["C."],"suffixes":[]},{"propositions":[],"lastnames":["Acar"],"firstnames":["Y."],"suffixes":[]},{"propositions":[],"lastnames":["Backes"],"firstnames":["M."],"suffixes":[]},{"propositions":[],"lastnames":["Fahl"],"firstnames":["S."],"suffixes":[]}],"month":"May","year":"2017","keywords":"Android (operating system), Android Application Security, Android application security, Androids, Cryptography, Google, Google Play, Humanoid robots, Libraries, Software, Software Development, Stack Overflow, code security, code snippets, copy & paste behavior, gradient methods, ieee_mn, information source, online programming discussion platforms, pattern classification, production software, program diagnostics, security of data, software developers, software engineering, stack overflow, static analysis, stochastic gradient descent classifier, stochastic processes","pages":"121–136","bibtex":"@inproceedings{fischer_stack_2017,\n\ttitle = {Stack {Overflow} {Considered} {Harmful}? {The} {Impact} of {Copy} {Paste} on {Android} {Application} {Security}},\n\tshorttitle = {Stack {Overflow} {Considered} {Harmful}?},\n\tdoi = {10.1109/SP.2017.31},\n\tabstract = {Online programming discussion platforms such as Stack Overflow serve as a rich source of information for software developers. Available information include vibrant discussions and oftentimes ready-to-use code snippets. Previous research identified Stack Overflow as one of the most important information sources developers rely on. Anecdotes report that software developers copy and paste code snippets from those information sources for convenience reasons. Such behavior results in a constant flow of community-provided code snippets into production software. To date, the impact of this behaviour on code security is unknown. We answer this highly important question by quantifying the proliferation of security-related code snippets from Stack Overflow in Android applications available on Google Play. Access to the rich source of information available on Stack Overflow including ready-to-use code snippets provides huge benefits for software developers. However, when it comes to code security there are some caveats to bear in mind: Due to the complex nature of code security, it is very difficult to provide ready-to-use and secure solutions for every problem. Hence, integrating a security-related code snippet from Stack Overflow into production software requires caution and expertise. Unsurprisingly, we observed insecure code snippets being copied into Android applications millions of users install from Google Play every day. To quantitatively evaluate the extent of this observation, we scanned Stack Overflow for code snippets and evaluated their security score using a stochastic gradient descent classifier. In order to identify code reuse in Android applications, we applied state-of-the-art static analysis. Our results are alarming: 15.4\\% of the 1.3 million Android applications we analyzed, contained security-related code snippets from Stack Overflow. Out of these 97.9\\% contain at least one insecure code snippet.},\n\tbooktitle = {2017 {IEEE} {Symposium} on {Security} and {Privacy} ({SP})},\n\tauthor = {Fischer, F. and Böttinger, K. and Xiao, H. and Stransky, C. and Acar, Y. and Backes, M. and Fahl, S.},\n\tmonth = may,\n\tyear = {2017},\n\tkeywords = {Android (operating system), Android Application Security, Android application security, Androids, Cryptography, Google, Google Play, Humanoid robots, Libraries, Software, Software Development, Stack Overflow, code security, code snippets, copy \\& paste behavior, gradient methods, ieee\\_mn, information source, online programming discussion platforms, pattern classification, production software, program diagnostics, security of data, software developers, software engineering, stack overflow, static analysis, stochastic gradient descent classifier, stochastic processes},\n\tpages = {121--136},\n}\n\n","author_short":["Fischer, F.","Böttinger, K.","Xiao, H.","Stransky, C.","Acar, Y.","Backes, M.","Fahl, S."],"key":"fischer_stack_2017","id":"fischer_stack_2017","bibbaseid":"fischer-bttinger-xiao-stransky-acar-backes-fahl-stackoverflowconsideredharmfultheimpactofcopypasteonandroidapplicationsecurity-2017","role":"author","urls":{},"keyword":["Android (operating system)","Android Application Security","Android application security","Androids","Cryptography","Google","Google Play","Humanoid robots","Libraries","Software","Software Development","Stack Overflow","code security","code snippets","copy & paste behavior","gradient methods","ieee_mn","information source","online programming discussion platforms","pattern classification","production software","program diagnostics","security of data","software developers","software engineering","stack overflow","static analysis","stochastic gradient descent classifier","stochastic processes"],"metadata":{"authorlinks":{}}},"bibtype":"inproceedings","biburl":"https://api.zotero.org/groups/2254174/items?key=We4UarDhnUp8Qz2xbddNaUTR&format=bibtex&limit=100","dataSources":["Jne4CJRPDJg88fZj3"],"keywords":["android (operating system)","android application security","android application security","androids","cryptography","google","google play","humanoid robots","libraries","software","software development","stack overflow","code security","code snippets","copy & paste behavior","gradient methods","ieee_mn","information source","online programming discussion platforms","pattern classification","production software","program diagnostics","security of data","software developers","software engineering","stack overflow","static analysis","stochastic gradient descent classifier","stochastic processes"],"search_terms":["stack","overflow","considered","harmful","impact","copy","paste","android","application","security","fischer","böttinger","xiao","stransky","acar","backes","fahl"],"title":"Stack Overflow Considered Harmful? The Impact of Copy Paste on Android Application Security","year":2017}