Abstract:Recent years have experienced explosive growth of smartphone sales. Inevitably, the rise in the popularity of smartphones also makes them an attractive target for attacks. In light of these threats, current mobile platform providers have developed various server-side vetting processes to block malicious applications (“apps”). While helpful, they are still far from ideal in achieving their goals. To make matters worse, the presence of alternative (less-regulated) mobile marketplaces also opens up new attack vectors, which necessitate client-side solutions (e.g., mobile anti-virus software) to run on mobile devices. However, existing client-side solutions still exhibit limitations in their capability or deployability. In this paper, we present AirBag, a lightweight OS-level virtualization approach to enhance the popular Android platform and boost our defense capability against mobile malware infection. Assuming a trusted smartphone OS kernel and the fact that untrusted apps will be eventually installed onto users’ phones, AirBag is designed to isolate and prevent them from infecting our normal systems (e.g., corrupting the phone firmware) or stealthily leaking private information. More specifically, by dynamically creating an isolated runtime environment with its own dedicated namespace and virtualized system resources, AirBag not only allows for transparent execution of untrusted apps, but also effectively mediates their access to various system resources or phone functionalities (e.g., SMSs or phone calls). We have implemented a proof-of-concept prototype on three representative mobile devices, i.e., Google Nexus One, Nexus 7, and Samsung Galaxy S III. The evaluation results with a number of untrusted apps, including real-world mobile malware, demonstrate its practicality and effectiveness.

Capturing Information Flows inside Android and Qemu Environments

Detecting capability leaks in Android-based smartphones

Taming Information-Stealing Smartphone Applications (On Android)

AirBag: Boosting Smartphone Resistance to Malware Infection.

NDroid: Toward Tracking Information Flows Across Multiple Android Contexts.

Systematic Detection of Capability Leaks in Stock Android Smartphones.

Dissecting Android Malware: Characterization and Evolution

Parema: an Unpacking Framework for Demystifying VM-based Android Packers.

EXAMINER-PRO: Testing Arm Emulators Across Different Privileges

Data Flow Analysis on Android Platform with Fragment Lifecycle Modeling.

Analyzing Android Application in Real-Time at Kernel Level

System Call Dependence Graph Based Behavior Decomposition of Android Applications

App in the Middle

Flexible Installability of Android Apps with App-level Virtualization based Decomposition

Glassbox: Dynamic Analysis Platform for Malware Android Applications on Real Devices

FlowCog: Context-Aware Semantic Extraction and Analysis of Information Flow Leaks in Android Apps

A survey of android mobile platform security

Burn after Reading: Expunging Execution Footprints of Android Apps.

Demystifying security and compatibility issues in Android Apps

Android OS CASE STUDY

Droidlogger: Reveal Suspicious Behavior of Android Applications Via Instrumentation