Leaky Apps: Large-scale Analysis of Secrets Distributed in Android and iOS Apps
David Schmidt, Sebastian Schrittwieser, Edgar R. Weippl
2025Year
3Top-tier citations
Abstract
Mobile apps store various types of secrets to support their functionalities. These include API keys, and cryptographic material to authenticate users and access backend services. Once distributed, attackers can reverse-engineer the apps, and these secrets become accessible, posing risks such as data leaks, and service abuse.
Ask about this paper
Your agent reads all of it.
Lune indexed this paper to the last equation, along with the top-tier papers that cite it. Ask a question and the answer quotes them.
Your agent calls
Luneget_paper_fulltext
Free to start. No credit card required.
Terminal
Install the CLIlune papers fulltext 029dc83b-8be9-4e81-bf60-6b3a6fa91047Cited by top-tier papers3
- Hidden Secrets in the arXiv: Discovering, Analyzing, and Preventing Unintentional Information Disclosure in Source Files of Scientific PreprintsJan Pennekamp, Johannes Lohmöller, David Schütte, Joscha Loos et al.S&P 2026 · 1 citation
- Secrets Unlocked: Evaluating LLMs for Secrets Detection in Android AppsMarco Alecci, Jordan Samhi, Tegawendé F. Bissyandé, Jacques KleinISSTA 2026
- Plain Text, Plain Risks: Measuring HTTP Inclusion in Android WebViews at ScalePhilipp Beer, Sebastian Roth, Martina Lindorfer, Marco SquarcinaUSENIX Security 2026
Builds on20
- Reliable Third-Party Library Detection in Android and its Security ApplicationsMichael Backes, Sven Bugiel, Erik DerrCCS 2016 · 345 citations
- 50 Ways to Leak Your Data: An Exploration of Apps' Circumvention of the Android Permissions SystemJoel Reardon, Álvaro Feal, Primal Wijesekera, Amit Elazari Bar On et al.USENIX Security 2019 · 196 citations
- Obfuscation-Resilient Privacy Leak Detection for Mobile Apps Through Differential AnalysisAndrea Continella, Yanick Fratantonio, Martina Lindorfer, Alessandro Puccetti et al.NDSS 2017 · 131 citations
- How Bad Can It Git? Characterizing Secret Leakage in Public GitHub RepositoriesMichael Meli, Matthew R. McNiece, Bradley ReavesNDSS 2019 · 130 citations
- Why Does Your Data Leak? Uncovering the Data Leakage in Cloud from Mobile AppsChaoshun Zuo, Zhiqiang Lin, Yinqian ZhangS&P 2019 · 123 citations
Related papers
- Keys on Doormats: Exposed API Credentials on the WebNurullah Demir, Yash Vekaria, Georgios Smaragdakis, Zakir DurumericCCS 2026 · 2 citations
- Credit Karma: Understanding Security Implications of Exposed Cloud Services through Automated Capability InferenceXueqiang Wang, Yuqiong Sun, Susanta Nanda, XiaoFeng WangUSENIX Security 2023
- A Large-Scale Empirical Study of Secret Key Leakage in Hugging Face SpacesShaoxuan Yun, Yuchao Zhang, Zhikun Shi, Liu Wang et al.ICSE 2026
- What Challenges Do Developers Face About Checked-in Secrets in Software Artifacts?Setu Kumar Basak, Lorenzo Neil, Bradley Reaves, Laurie A. WilliamsICSE 2023 · 9 citations
- A First Look at Security and Privacy Risks in the RapidAPI EcosystemSong Liao, Long Cheng, Xiapu Luo, Zheng Song et al.CCS 2024 · 3 citations
