Abstract:Recent years have experienced explosive growth of smartphone sales. Inevitably, the rise in the popularity of smartphones also makes them an attractive target for attacks. In light of these threats, current mobile platform providers have developed various server-side vetting processes to block malicious applications (“apps”). While helpful, they are still far from ideal in achieving their goals. To make matters worse, the presence of alternative (less-regulated) mobile marketplaces also opens up new attack vectors, which necessitate client-side solutions (e.g., mobile anti-virus software) to run on mobile devices. However, existing client-side solutions still exhibit limitations in their capability or deployability. In this paper, we present AirBag, a lightweight OS-level virtualization approach to enhance the popular Android platform and boost our defense capability against mobile malware infection. Assuming a trusted smartphone OS kernel and the fact that untrusted apps will be eventually installed onto users’ phones, AirBag is designed to isolate and prevent them from infecting our normal systems (e.g., corrupting the phone firmware) or stealthily leaking private information. More specifically, by dynamically creating an isolated runtime environment with its own dedicated namespace and virtualized system resources, AirBag not only allows for transparent execution of untrusted apps, but also effectively mediates their access to various system resources or phone functionalities (e.g., SMSs or phone calls). We have implemented a proof-of-concept prototype on three representative mobile devices, i.e., Google Nexus One, Nexus 7, and Samsung Galaxy S III. The evaluation results with a number of untrusted apps, including real-world mobile malware, demonstrate its practicality and effectiveness.

Mobile operating system encryption scheme based on virtual disk

AppShell: Making Data Protection Practical for Lost or Stolen Android Devices

Travelling the Hypervisor and SSD: A Tag-Based Approach Against Crypto Ransomware with Fine-Grained Data Recovery

AirBag: Boosting Smartphone Resistance to Malware Infection.

Design and Implementation of SecPod, A Framework for Virtualization-Based Security Systems.

The Research of Information Hiding Technology Based on Portable Executable File Format

Implementation of Disk Encrypt and Restore Technology Based on Single File System

Vacuum: An Efficient and Assured Deletion Scheme for User Sensitive Data on Mobile Devices

Design and Implementation of Waycryptic, a Versatile Cryptographic File System for Linux

Research and Implementation of New Encrypting File System

Techniques of File System Filter Driver-based and Security-enhanced Encryption System

Trusted Computing Base Using Virtualization Platform

DesktopToGo:Mobile Personal-Computing Based on User-Level Virtualization

vTrust: Remotely Executing Mobile Apps Transparently With Local Untrusted OS

The Block-based Mobile PDE Systems Are Not Secure -- Experimental Attacks

An Efficient Data Protection Architecture Based on Fragmentation and Encryption

Portable Desktop Applications Based on User-Level Virtualization 1

Research about Virtualization of ARM-Based Mobile Smart Devices

Implementation and Applications of Virtual Harddisk System

Mobile storage and charging device

Rethinking Block Storage Encryption with Virtual Disks