Title: Stack Overflow Considered Harmful? The Impact of Copy&Paste on Android Application Security,
Abstract: Online programming discussion platforms such as Stack Overflow serve as a
rich source of information for software developers. Available information
include vibrant discussions and oftentimes ready-to-use code snippets.
Anecdotes report that software developers copy and paste code snippets from
those information sources for convenience reasons. Such behavior results in a
constant flow of community-provided code snippets into production software. To
date, the impact of this behaviour on code security is unknown. We answer this
highly important question by quantifying the proliferation of security-related
code snippets from Stack Overflow in Android applications available on Google
Play. Access to the rich source of information available on Stack Overflow
including ready-to-use code snippets provides huge benefits for software
developers. However, when it comes to code security there are some caveats to
bear in mind: Due to the complex nature of code security, it is very difficult
to provide ready-to-use and secure solutions for every problem. Hence,
integrating a security-related code snippet from Stack Overflow into production
software requires caution and expertise. Unsurprisingly, we observed insecure
code snippets being copied into Android applications millions of users install
from Google Play every day. To quantitatively evaluate the extent of this
observation, we scanned Stack Overflow for code snippets and evaluated their
security score using a stochastic gradient descent classifier. In order to
identify code reuse in Android applications, we applied state-of-the-art static
analysis. Our results are alarming: 15.4% of the 1.3 million Android
applications we analyzed, contained security-related code snippets from Stack
Overflow. Out of these 97.9% contain at least one insecure code snippet.