一句话：对693个移动银行应用的安全性进行大规模实证研究，揭示漏洞理解偏差、检测工具局限及改进方向。
移动银行应用作为金融科技的代表被广泛采用，但作者先前在693个银行应用中发现数千个漏洞，表明其安全性不及预期。本文旨在理解这些应用的安全现状。方法上，作者用6个月追踪这些漏洞的报告与修补过程，审计4个最先进的漏洞检测工具在已修补漏洞上的表现，并与7家银行实体进行面对面或在线讨论，同时通过在线调查收集金融应用开发者的反馈。研究发现：(1) 人们对漏洞的理解不一致，严重性评级标准各异；(2) 最先进的工具在检测银行实体最关心的漏洞方面效果不佳；(3) 需要在多个方面付出更多努力来保护银行应用。作者认为该研究有助于弥合现有差距，激励银行实体、研究人员和政策制定者共同更好地解决安全问题。
Mobile banking apps, as one of the most contemporary FinTechs, have been widely adopted by banking entities to provide instant financial services. However, our recent work discovered thousands of vulnerabilities in 693 banking apps, which indicates these apps are not as secure as we expected. This motivates us to conduct this study for understanding the current security status of them. First, we take 6 months to track the reporting and patching procedure of these vulnerabilities. Second, we audit 4 state-of the-art vulnerability detection tools on those patched vulnerabilities. Third, we discuss with 7 banking entities via in-person or online meetings and conduct an online survey to gain more feedback from financial app developers. Through this study, we reveal that (1) people may have inconsistent understandings of the vulnerabilities and different criteria for rating severity; (2) state-of-the-art tools are not effective in detecting vulnerabilities that the banking entities most concern; and (3) more efforts should be endeavored in different aspects to secure banking apps. We believe our study can help bridge the existing gaps, and further motivate different parties, including banking entities, researchers and policy makers, to better tackle security issues altogether.
DOI 原文 ·
@inproceedings{paperbot4674,
title = {Are mobile banking apps secure? what can be improved?},
author = {Sen Chen and Ting Su and Lingling Fan and Guozhu Meng and Minhui Xue and Yang Liu and Lihua Xu},
booktitle = {FSE},
year = {2018},
doi = {10.1145/3236024.3275523}
}