References of "Massacci, Fabio"
     in
Bookmark and Share    
Full Text
Peer Reviewed
See detailA Screening Test for Disclosed Vulnerabilities in FOSS Components
Dashevskyi, Stanislav UL; Brucker, Achim D.; Massacci, Fabio

in IEEE Transactions on Software Engineering (2018)

Detailed reference viewed: 92 (8 UL)
Full Text
Peer Reviewed
See detailTowards Black Box Testing of Android Apps
Zhauniarovich, Yury; Philippov, Anton; Gadyatskaya, Olga UL et al

in Proc. of Software Assurance Workshop at the 10th International Conference on Availability, Reliability and Security (ARES) (2015, August)

Many state-of-art mobile application testing frameworks (e.g., Dynodroid, EvoDroid) enjoy Emma or other code coverage libraries to measure the coverage achieved. The underlying assumption for these ... [more ▼]

Many state-of-art mobile application testing frameworks (e.g., Dynodroid, EvoDroid) enjoy Emma or other code coverage libraries to measure the coverage achieved. The underlying assumption for these frameworks is availability of the app source code. Yet, application markets and security researchers face the need to test third-party mobile applications in the absence of the source code. There exists a number of frameworks both for manual and automated test generation that address this challenge. However, these frameworks often do not provide any statistics on the code coverage achieved, or provide coarse-grained ones like a number of activities or methods covered. At the same time, given two test reports generated by different frameworks, there is no way to understand which one achieved better coverage if the reported metrics were different (or no coverage results were provided). To address these issues we designed a framework called BBOXTESTER that is able to generate code coverage reports and produce uniform coverage metrics in testing without the source code. Security researchers can automatically execute applications exploiting current stateof- art tools, and use the results of our framework to assess if the security-critical code was covered by the tests. In this paper we report on design and implementation of BBOXTESTER and assess its efficiency and effectiveness. [less ▲]

Detailed reference viewed: 110 (1 UL)
Full Text
Peer Reviewed
See detailStaDynA: Addressing the Problem of Dynamic Code Updates in the Security Analysis of Android Applications
Zhauniarovich, Yury; Ahmad, Maqsood; Gadyatskaya, Olga UL et al

in Proceedings of CODASPY '15 (2015, March)

Static analysis of Android applications can be hindered by the presence of the popular dynamic code update techniques: dynamic class loading and reflection. Recent Android malware samples do actually use ... [more ▼]

Static analysis of Android applications can be hindered by the presence of the popular dynamic code update techniques: dynamic class loading and reflection. Recent Android malware samples do actually use these mechanisms to conceal their malicious behavior from static analyzers. These techniques defuse even the most recent static analyzers that usually operate under the "closed world" assumption (the targets of reflective calls can be resolved at analysis time; only classes reachable from the class path at analysis time are used at runtime). Our proposed solution allows existing static analyzers to remove this assumption. This is achieved by combining static and dynamic analysis of applications in order to reveal the hidden/updated behavior and extend static analysis results with this information. This paper presents design, implementation and preliminary evaluation results of our solution called StaDynA. [less ▲]

Detailed reference viewed: 92 (0 UL)
Full Text
Peer Reviewed
See detailGoCoMM: a governance and compliance maturity model
Gheorghe, Gabriela UL; Neuhaus, Stephan; Massacci, Fabio et al

in GoCoMM: a governance and compliance maturity model (2009)

Detailed reference viewed: 49 (3 UL)