Identifying Open-Source License Violation and 1-day Security Risk at Large Scale

著者: Ruian Duan, Ashish Bijlani, Meng Xu, Taesoo Kim, Wenke Lee - ACM SIGSAC Conference on Computer and Communications Security, CCS 2017 被引用: 121

With millions of apps available to users, the mobile app market is rapidly becoming very crowded. Given the intense competition, the time to market is a critical factor for the success and profitability of an app. In order to shorten the development cycle, developers often focus their efforts on the unique features and workflows of their apps and rely on third-party Open Source Software (OSS) for the common features. Unfortunately, despite their benefits, careless use of OSS can introduce significant legal and security risks, which if ignored can not only jeopardize security and privacy of end users, but can also cause app developers high financial loss. However, tracking OSS components, their versions, and interdependencies can be very tedious and error-prone, particularly if an OSS is imported with little to no knowledge of its provenance.