Cardpliance: PCI-DSS Compliance of Android Applications

Samin Yaseer Mahmud, Akhil Acharya, Benjamin Andow, William Enck, and Bradley Reaves

Proceedings of the USENIX Security Symposium, 2020

Static analysis can automatically check PCI-DSS compliance of Android apps; 1.67% of 358 popular apps improperly store card numbers or verification codes.

Abstract

Smartphones and their applications have become a predominant way of computing, and it is only natural that they have become an important part of financial transaction technology. However, applications asking users to enter credit card numbers have been largely overlooked by prior studies, which frequently report pervasive security and privacy concerns in the general mobile application ecosystem. Such applications are particularly security-sensitive, and they are subject to the Payment Card Industry Data Security Standard (PCI DSS). In this paper, we design a tool called Cardpliance, which bridges the semantics of the graphical user interface with static program analysis to capture relevant requirements from PCI DSS. We use Cardpliance to study 358 popular applications from Google Play that ask the user to enter a credit card number. Overall, we found that 1.67% of the 358 applications are not compliant with PCI DSS, with vulnerabilities including improperly storing credit card numbers and card verification codes. These findings paint a largely positive picture of the state of PCI DSS compliance of popular Android applications.

Citation (IEEE)

S. Y. Mahmud, A. Acharya, B. Andow, W. Enck, and B. Reaves, “Cardpliance: PCI-DSS Compliance of Android Applications,” in Proceedings of the USENIX Security Symposium, 2020.

BibTeX

@inproceedings{maa+20,
  author = {Mahmud, Samin Yaseer and Acharya, Akhil and Andow, Benjamin and Enck, William and {Bradley Reaves}},
  booktitle = {Proceedings of the {USENIX} Security Symposium},
  date = {2020-08},
  title = {Cardpliance: {PCI-DSS} Compliance of {Android} Applications},
}