Abstract:Recent years have experienced explosive growth of smartphone sales. Inevitably, the rise in the popularity of smartphones also makes them an attractive target for attacks. In light of these threats, current mobile platform providers have developed various server-side vetting processes to block malicious applications (“apps”). While helpful, they are still far from ideal in achieving their goals. To make matters worse, the presence of alternative (less-regulated) mobile marketplaces also opens up new attack vectors, which necessitate client-side solutions (e.g., mobile anti-virus software) to run on mobile devices. However, existing client-side solutions still exhibit limitations in their capability or deployability. In this paper, we present AirBag, a lightweight OS-level virtualization approach to enhance the popular Android platform and boost our defense capability against mobile malware infection. Assuming a trusted smartphone OS kernel and the fact that untrusted apps will be eventually installed onto users’ phones, AirBag is designed to isolate and prevent them from infecting our normal systems (e.g., corrupting the phone firmware) or stealthily leaking private information. More specifically, by dynamically creating an isolated runtime environment with its own dedicated namespace and virtualized system resources, AirBag not only allows for transparent execution of untrusted apps, but also effectively mediates their access to various system resources or phone functionalities (e.g., SMSs or phone calls). We have implemented a proof-of-concept prototype on three representative mobile devices, i.e., Google Nexus One, Nexus 7, and Samsung Galaxy S III. The evaluation results with a number of untrusted apps, including real-world mobile malware, demonstrate its practicality and effectiveness.

Systematic Analysis and Detection of Misconfiguration Vulnerabilities in Android Smartphones

Systematic Detection of Capability Leaks in Stock Android Smartphones.

Detecting capability leaks in Android-based smartphones

Dissecting Android Malware: Characterization and Evolution

AirBag: Boosting Smartphone Resistance to Malware Infection.

Demystifying security and compatibility issues in Android Apps

Security Smells in Android

DroidAlarm: an all-sided static analysis tool for Android privilege-escalation malware.

Static Detection of Filesystem Vulnerabilities in Android Systems

Security Evaluation of Companion Android Applications in IoT: The Case of Smart Security Devices

Security Analysis for Android Applications Using Sensitive Path Identification

AnaDroid: Malware Analysis of Android with User-supplied Predicates

Mitigating Access Control Vulnerabilities through Interactive Static Analysis.

Automated, Dynamic Android App Vulnerability and Privacy Leak Analysis: Design Considerations, Required Components and Available Tools

An APP Sensitive Behaviors Detection Method Based on Android Kernel and Its Implementation

Open Source Android Vulnerability Detection Tools: A Survey

When program analysis meets mobile security: an industrial study of misusing Android internet sockets

AndroShield: Automated Android Applications Vulnerability Detection, a Hybrid Static and Dynamic Analysis Approach

SmartDroid: an automatic system for revealing UI-based trigger conditions in android applications.

NIVAnalyzer: A Tool for Automatically Detecting and Verifying Next-Intent Vulnerabilities in Android Apps

Demystifying Hidden Sensitive Operations in Android apps