Abstract:Recent years have experienced explosive growth of smartphone sales. Inevitably, the rise in the popularity of smartphones also makes them an attractive target for attacks. In light of these threats, current mobile platform providers have developed various server-side vetting processes to block malicious applications (“apps”). While helpful, they are still far from ideal in achieving their goals. To make matters worse, the presence of alternative (less-regulated) mobile marketplaces also opens up new attack vectors, which necessitate client-side solutions (e.g., mobile anti-virus software) to run on mobile devices. However, existing client-side solutions still exhibit limitations in their capability or deployability. In this paper, we present AirBag, a lightweight OS-level virtualization approach to enhance the popular Android platform and boost our defense capability against mobile malware infection. Assuming a trusted smartphone OS kernel and the fact that untrusted apps will be eventually installed onto users’ phones, AirBag is designed to isolate and prevent them from infecting our normal systems (e.g., corrupting the phone firmware) or stealthily leaking private information. More specifically, by dynamically creating an isolated runtime environment with its own dedicated namespace and virtualized system resources, AirBag not only allows for transparent execution of untrusted apps, but also effectively mediates their access to various system resources or phone functionalities (e.g., SMSs or phone calls). We have implemented a proof-of-concept prototype on three representative mobile devices, i.e., Google Nexus One, Nexus 7, and Samsung Galaxy S III. The evaluation results with a number of untrusted apps, including real-world mobile malware, demonstrate its practicality and effectiveness.

Building trusted path on untrusted device drivers for mobile devices

Dtee: A Declarative Approach to Secure IoT Applications Using TrustZone

DriverJar: Lightweight Device Driver Isolation for ARM

AirBag: Boosting Smartphone Resistance to Malware Infection.

A Trustenclave-Based Architecture for Ensuring Run-Time Security in Embedded Terminals

Armlock: Hardware-Based Fault Isolation For Arm

vTrust: Remotely Executing Mobile Apps Transparently With Local Untrusted OS

Trusted Computing Base Using Virtualization Platform

STBEAT: Software Update on Trusted Environment Based on ARM TrustZone

Downgrade Attack on TrustZone

Independent Credible: Secure Communication Architecture of Android Devices Based on TrustZone

Shattered Trust: When Replacement Smartphone Components Attack

Template for Preparation of Manuscripts for Tsinghua Science and Technology

App Developer Centric Trusted Execution Environment

On Runtime Software Security of TrustZone-M based IoT Devices

Minimum Viable Device Drivers for ARM TrustZone

TrustToken, a Trusted SoC solution for Non-Trusted Intellectual Property (IP)s

Software Abstractions for Trusted Sensors

LEAP: TrustZone Based Developer-Friendly TEE for Intelligent Mobile Apps

Enabling Secure and Usable Mobile Application: Revealing the Nuts and Bolts of software TPM in todays Mobile Devices

Secure Mobile Payment Via Trusted Computing