KASTroid: A Static Taint Analysis Framework for Kotlin-Based Android Applications

We introduce KASTroid¹, a static taint analysis framework designed to detect information leakage vulnerabilities in Kotlin-based Android applications, with a focus on insecure usage of broadcasts. As Kotlin increasingly replaces Java as the preferred language for Android development, ensuring the security of inter-component communication, particularly through broadcasts, is critical. KASTroid employs a novel static analysis approach to identify tainted flows arising from unsafe broadcast practices, such as the use of implicit broadcasts via sendBroadcast, which can expose sensitive user data to unauthorized applications. We evaluated KASTroid on a dataset of 1,716 Kotlin Android applications and found that over 70% of broadcasts are implicit, posing significant privacy risks. To demonstrate the framework’s effectiveness, we present a case study on a previous version of AndroidAPS, a medical application, where KASTroid identified unsafe broadcast usage that could leak sensitive information to other local applications. Our findings highlight the importance of secure broadcast practices and demonstrate KASTroid’s ability to assist developers in detecting and remedying such vulnerabilities.