From base cases to backdoors: An Empirical Study of Unnatural Crypto-API Misuse
Victor Olaiya, Adwait Nadkarni
TL;DR
This work tackles the problem of non-trivial, unnatural crypto-API misuse in the wild, revealing that current detectors miss a broad range of real-world misuse patterns. It presents a large-scale qualitative study of 5,704 representative crypto-API invocations drawn from 20,508 Android mobile-IoT apps, and introduces a complexity-based sampling framework to cover diverse usage strata. The authors derive two taxonomies (restrictive and flexible) comprising 96 usage patterns and 17 key findings, including evasion tactics, evasive native-code usage, and misleading parameter handling. The study also shows that popular crypto-API detectors detect only a small fraction of these patterns, underscoring the need for detection approaches grounded in real-world usage and augmented by benchmarks and AI-assisted analysis. Overall, the paper provides foundational taxonomies, benchmarks, and design guidance to improve detection of rarely seen but impactful crypto-API misuse in practice.
Abstract
Tools focused on cryptographic API misuse often detect the most basic expressions of the vulnerable use, and are unable to detect non-trivial variants. The question of whether tools should be designed to detect such variants can only be answered if we know how developers use and misuse cryptographic APIs in the wild, and in particular, what the unnatural usage of such APIs looks like. This paper presents the first large-scale study that characterizes unnatural crypto-API usage through a qualitative analysis of 5,704 representative API invocations. We develop an intuitive complexity metric to stratify 140,431 crypto-API invocations obtained from 20,508 Android applications, allowing us to sample 5,704 invocations that are representative of all strata, with each stratum consisting of invocations with similar complexity/naturalness. We qualitatively analyze the 5,704 sampled invocations using manual reverse engineering, through an in-depth investigation that involves the development of minimal examples and exploration of native code. Our study results in two detailed taxonomies of unnatural crypto-API misuse, along with 17 key findings that show the presence of highly unusual misuse, evasive code, and the inability of popular tools to reason about even mildly unconventional usage. Our findings lead to four key takeaways that inform future work focused on detecting unnatural crypto-API misuse.