Understanding the Responsiveness of Mobile App Developers to Software Library Updates

ABSTRACT

This paper reports a longitudinal measurement study aiming to understand how mobile app developers are responsive to updates of software libraries over time. To quantify their responsiveness to library updates, we collected 21,046 Android apps, which equated 142,611 unique application package kit (APK) files, each corresponding to a different version of an app. The release dates of these APK files spanned across 9 years. The key findings we derived from our analysis are as follows. (1) We observed an undesirable level of responsiveness of app developers; 50% of library update adoptions by app developers were performed for more than 3 months after the release date of the library, and 50% of outdated libraries used in apps were retained for over 10 months. (2) Deploying a security fix campaign in the app distribution market effectively reduced the number of apps with unfixed vulnerabilities; however, CVE-numbered vulnerabilities (without a campaign) were prone to remain unfixed. (3) The responsiveness of app developers varied and depended on multiple factors, for example, popular apps with a high number of installations had a better response to library updates and, while it took 77 days on average for app developers to adopt version updates for advertising libraries, it took 237 days for updates of utility libraries to be adopted. We discuss practical ways to eliminate libraries with vulnerabilities and to improve the responsiveness of app developers to library updates.

References

1. AdColony, Inc. {n. d.}. AdColony - Elevating mobile advertising across today's hottest apps. Retrieved September 22, 2018 from https://www.adcolony.com/
2. Alessandro Aldini, Fabio Martinelli, Andrea Saracino, and Daniele Sgandurra. {n. d.}. Detection of repackaged mobile applications through a collaborative approach. Concurrency and Computation: Practice and Experience 27, 11 ({n. d.}), 2818--2838.
3. AppBrain. 2018. Google Play stats. Retrieved September 22, 2018 from http: //www.appbrain.com/stats/
4. Michael Backes, Sven Bugiel, and Erik Derr. 2016. Reliable Third-Party Library Detection in Android and Its Security Applications. In Proc. of ACM CCS, 2016. 356--367.
5. Gabriele Bavota, Mario Linares Vásquez, Carlos Eduardo Bernal-Cárdenas, Massimiliano Di Penta, Rocco Oliveto, and Denys Poshyvanyk. 2015. The Impact of API Change- and Fault-Proneness on the User Ratings of Android Apps. IEEE Transactions on Software Engineering 41, 4 (April 2015), 384--407.
6. Ben Manes. 2018. GitHub - Gradle Versions Plugin. Retrieved September 24, 2018 from https://github.com/ben-manes/gradle-versions-plugin
7. Ravi Bhoraskar, Seungyeop Han, Jinseong Jeon, Tanzirul Azim, Shuo Chen, Jaeyeon Jung, Suman Nath, Rui Wang, and David Wetherall. 2014. Brahmastra: Driving Apps to Test the Security of Third-Party Components.. In Proc. of USENIX Security, 2014. 1021--1036.
8. Theodore Book, Adam Pridgen, and Dan S. Wallach. 2013. Longitudinal Analysis of Android Ad Library Permissions. CoRR abs/1303.0857 (2013). arXiv:1303.0857 http://arxiv.org/abs/1303.0857
9. Bogdan Carbunar and Rahul Potharaju. 2015. A longitudinal study of the Google app market. In Proc of IEEE/ACM ASONAM, 2015. 242--249.
10. Kai Chen, Xueqiang Wang, Yi Chen, Peng Wang, Yeonjoon Lee, XiaoFeng Wang, Bin Ma, Aohui Wang, Yingjun Zhang, and Wei Zou. 2016. Following devil's footprints: Cross-platform analysis of potentially harmful libraries on android and ios. In Proc. of the IEEE SP, 2016. 357--376.
11. Erik Derr, Sven Bugiel, Sascha Fahl, Yasemin Acar, and Michael Backes. 2017. Keep Me Updated: An Empirical Study of Third-Party Library Updatability on Android. In Proc. of ACM CCS, 2017. 2187--2200.
12. Dion Hinchcliffe. 2017. The advent of the citizen developer. Retrieved September 22, 2018 from https://www.zdnet.com/article/ the-advent-of-the-citizen-developer/
13. Facebook, Inc. {n. d.}. Android SDK - Facebook for Developers. Retrieved September 22, 2018 from https://developers.facebook.com/docs/android/
14. F. Fischer, K. Böttinger, H. Xiao, C. Stransky, Y. Acar, M. Backes, and S. Fahl. 2017. Stack Overflow Considered Harmful? The Impact of Copy amp;Paste on Android Application Security. In Proc. of the IEEE SP, 2017. 121--136.
15. Fisher, Anne. 2017. How Companies Are Developing More Apps With Fewer Developers. Retrieved September 22, 2018 from http://fortune.com/2016/08/30/ quickbase-coding-apps-developers/
16. Forum of Incident Response and Security Teams. {n. d.}. Common Vulnerability Scoring System SIG. Retrieved September 22, 2018 from https://www.first.org/ cvss/
17. Forum of Incident Response and Security Teams. {n. d.}. Common Vulnerability Scoring System v3.0: Specification Document. Retrieved September 22, 2018 from https://www.first.org/cvss/specification-document
18. The Apache Software Foundation. {n. d.}. Apache Commons Collections Security Vulnerabilities. Retrieved September 22, 2018 from https://commons.apache. org/proper/commons-collections/security-reports.html
19. Yanick Fratantonio, Antonio Bianchi, William Robertson, Manuel Egele, Christopher Kruegel, Engin Kirda, and Giovanni Vigna. 2015. On the Security and Engineering Implications of Finer-Grained Access Controls for Android Developers and Users. In Proc. of DIMVA, 2015. 282--303.
20. Hugo Gonzalez, Natalia Stakhanova, and Ali A. Ghorbani. 2016. Measuring code reuse in Android apps. In Proc. of PST, 2016. 187--195.
21. Google Inc. 2018. App Security Improvement Program. https://developer.android. com/google/play/asi.html
22. Google, Inc. 2018. GitHub - google/gson: A Java serialization/deserialization library to convert Java Objects into JSON and back. Retrieved September 22, 2018 from https://sites.google.com/site/gson/
23. Google Play API 2012. Google Play API. Retrieved September 22, 2018 from https://github.com/egirault/googleplay-api
24. Michael C. Grace,Wu Zhou, Xuxian Jiang, and Ahmad-Reza Sadeghi. 2012. Unsafe Exposure Analysis of Mobile In-app Advertisements. In Proc. of ACM WISEC, 2012 (WISEC '12). 101--112.
25. Heqing Huang, Cong Zheng, Junyuan Zeng, Wu Zhou, Sencun Zhu, Peng Liu, Suresh Chari, and Ce Zhang. 2016. Android malware development on public malware scanning platforms: A large-scale data-driven study. In Proc. of IEEE Big Data, 2016. 1090--1099.
26. Yuta Ishii, Takuya Watanabe, Mitsuaki Akiyama, and Tatsuya Mori. 2016. Clone or Relative?: Understanding the Origins of Similar Android Apps. In Proc. of ACM IWSPA, 2016. 25--32.
27. Yuta Ishii, TakuyaWatanabe, Fumihiro Kanei, Yuta Takata, Eitaro Shioji, Mitsuaki Akiyama, Takeshi Yagi, Bo Sun, and Tatsuya Mori. 2017. Understanding the security management of global third-party Android marketplaces. In Proc. of ACM WAMA, 2017. 12--18.
28. Li Li, Tegawendé F Bissyandé, Jacques Klein, and Yves Le Traon. 2016. An Investigation into the Use of Common Libraries in Android Apps. In Proc. of SANER, 2016.
29. Menghao Li, Wei Wang, Pei Wang, Shuai Wang, Dinghao Wu, Jian Liu, Rui Xue, and Wei Huo. 2017. Libd: Scalable and precise third-party library detection in Android markets. In Proc. of ICSE, 2017. 335--346.
30. Ziang Ma, Haoyu Wang, Yao Guo, and Xiangqun Chen. 2016. LibRadar: fast and accurate detection of third-party libraries in Android apps. In Proc. of IEEE/ACM ICSE, 2016. 653--656.
31. Tyler McDonnell, Baishakhi Ray, and Miryung Kim. 2013. An Empirical Study of API Stability and Adoption in the Android Ecosystem. In Proc. of IEEE ICSME, 2013. 70--79.
32. Stuart McIlroy, Nasir Ali, and Ahmed E Hassan. 2016. Fresh apps: an empirical study of frequently-updated mobile apps in the Google play store. Empirical Software Engineering 21, 3 (2016), 1346--1370.
33. MITRE Corporation. 2018. CVE - Common Vulnerabilities and Exposures (CVE). Retrieved September 22, 2018 from https://cve.mitre.org/
34. The Hacker News. 2014. Facebook SDK Vulnerability Puts Millions of Smart- phone Users' Accounts at Risk. https://thehackernews.com/2014/07/ facebook-sdk-vulnerability-puts.html
35. I. J. Mojica Ruiz, M. Nagappan, B. Adams, T. Berger, S. Dienst, and A. E. Hassan. 2014. Impact of Ad Libraries on Ratings of Android Mobile Apps. IEEE Software 31, 6 (Nov 2014), 86--92.
36. Israel J Mojica Ruiz, Meiyappan Nagappan, Bram Adams, Thorsten Berger, Steffen Dienst, and Ahmed E Hassan. 2016. Analyzing ad library updates in android apps. IEEE Software 33, 2 (2016), 74--80.
37. Vincent F. Taylor and Ivan Martinovic. 2017. To Update or Not to Update: Insights From a Two-Year Study of Android App Evolution. In Proc. of ASIA CCS, 2017. 45--57.
38. Tom Preston-Werner. {n. d.}. Semantic Versioning 2.0.0. Retrieved September 22, 2018 from https://semver.org
39. U.S. National Institute of Standards and Technology. 2017. CVE-2014--8889 Detail. Retrieved September 22, 2018 from https://nvd.nist.gov/vuln/detail/ CVE-2014--8889
40. U.S. National Institute of Standards and Technology. 2017. CVE-2016--2402 Detail. Retrieved September 22, 2018 from https://nvd.nist.gov/vuln/detail/ CVE-2016--2402
41. U.S. National Institute of Standards and Technology. 2018. National Vulnerability Database. Retrieved September 22, 2018 from https://nvd.nist.gov/
42. Nicolas Viennot, Edward Garcia, and Jason Nieh. 2014. A Measurement Study of Google Play. In Proc. of SIGMETRICS, 2014 (SIGMETRICS '14). 221--233.
43. TakuyaWatanabe, Mitsuaki Akiyama, Fumihiro Kanei, Eitaro Shioji, Yuta Takata, Bo Sun, Yuta Ishi, Toshiki Shibahara, Takeshi Yagi, and Tatsuya Mori. 2017. Understanding the Origins of Mobile App Vulnerabilities: A Large-scale Measurement Study of Free and Paid Apps. In Proc. of MSR, 2017. 14--24.
44. Daoyuan Wu, Ximing Liu, Jiayun Xu, David Lo, and Debin Gao. 2017. Measuring the Declared SDK Versions and Their Consistency with API Calls in Android Apps. In Proc. of WASA, 2017. 678--690.
45. Yuan Zhang, Jiarun Dai, Xiaohan Zhang, Sirong Huang, Zhemin Yang, Min Yang, and Hao Chen. 2018. Detecting third-party libraries in Android applications with high precision and recall. In Proc. of SANER, 2018. 141--152.
46. Yajin Zhou, Lei Wu, Zhi Wang, and Xuxian Jiang. 2015. Harvesting Developer Credentials in Android Apps. In Proc. of ACM WiSec, 2015. Article 23, 23:1-- 23:12 pages.

Index Terms

• Security and privacy

  • Software and application security

    • Software security engineering