Patent application EP20175877A (EP), filed 2020-05-21
Publication number: EP3757840A1
Title: BINARY STATIC ANALYSIS OF APPLICATION STRUCTURE TO IDENTIFY VULNERABILITIES
Abstract: Described are methods and devices to identify vulnerabilities in a software package that includes two or more build files. The build files include at least an application file and one or more resource files. The method includes scanning the build files to identify strings. Strings that appear in one of the resource files and are not referenced in the application file are labelled orphaned. Strings that appear in the application file and are node defined in any of the resources files are labelled hardcoded. The identity of hardcoded and orphaned strings is output as potential vulnerabilities or data leakage points.
IPC codes: H04L  29/    06            A I
G06F  21/    57            A I
Claims: number: 1
text: A method of identifying vulnerabilities in a software package that includes two or more build files, the build files including at least an application file and one or more resource files, the method comprising:
number: 2
text: The method claimed in claim 1, further comprising classifying the identified strings and wherein outputting includes displaying at least some of the identified strings grouped by classification.
number: 3
text: The method claimed in claim 2, wherein classifications include at least one of uniform resource locators, email addresses, IP addresses, passphrases, or usernames.
number: 4
text: The method claimed in any preceding claim, wherein the outputting includes outputting a graphical user interface display containing respective lists of the orphaned strings and the hardcoded strings.
number: 5
text: The method claimed in any preceding claim, further comprising determining a build quality score for the software package.
number: 6
text: The method claimed in claim 5, wherein determining the build quality score includes determining the build quality score based on a count of orphaned strings and hardcoded strings.
number: 7
text: The method claimed in claim 6, wherein determining the build quality score is based on the count relative to a total string count or to a total size of the build files.
number: 8
text: The method claimed in any preceding claim, wherein the application file defines components and their interaction and the resource files contain definitions.
number: 9
text: The method claimed in claim 8, wherein the resource files include a string.xml file.
number: 10
text: The method claimed in any preceding claim, further comprising first determining that a platform on which the software package is based supports separation of concerns design principles.
number: 11
text: A computing device for identifying vulnerabilities in a software package that includes two or more build files, the build files including at least an application file and one or more resource files, the computing device comprising:
number: 12
text: A computer program which, when executed on a processor of a computing device, is configured to carry out the method of any one of claims 1 to 10.
Office action: search_report, dated 2020-12-30
Prior art cited: ref_id: WO2008047351A2
ref_type: patent
severity: background
ref_id: US2016259943A1
ref_type: patent
severity: background
ref_id: WO2008047351
ref_type: patent
severity: background
ref_id: US2016259943
ref_type: patent
severity: background
Final disposition: pending (2020-12-30)