A Study of Static Analysis Tools to Detect Vulnerabilities of Branchless Banking Applications in Developing Countries
Fahad Ibrar, Hamza Saleem, Sam Castle, Muhammad Zubair Malik · 2017
The ubiquity of smart phones and their prevalence among the underprivileged has enabled the delivery of financial services to previously unbanked through digital means. At the same time it has exposed the same people to security vulnerabilities of digital infrastructure. In this paper, we analyze 10 Android Digital Financial Services (DFS) applications using static analysis tools and present results to show that off-the-shelf static bug checking tools, can be useful in finding many critical security bugs in DFS applications. Our findings also show that DFS applications from developing countries have more vulnerabilities in application specific code compared with DFS applications from developed countries. However, we observe that general purpose static analysis tools have low specificity for DFS specific bugs, such as the vulnerabilities in the use of cryptography and networking, and there is a need to develop better bug detection tools.