Abstract:Recent years have experienced explosive growth of smartphone sales. Inevitably, the rise in the popularity of smartphones also makes them an attractive target for attacks. In light of these threats, current mobile platform providers have developed various server-side vetting processes to block malicious applications (“apps”). While helpful, they are still far from ideal in achieving their goals. To make matters worse, the presence of alternative (less-regulated) mobile marketplaces also opens up new attack vectors, which necessitate client-side solutions (e.g., mobile anti-virus software) to run on mobile devices. However, existing client-side solutions still exhibit limitations in their capability or deployability. In this paper, we present AirBag, a lightweight OS-level virtualization approach to enhance the popular Android platform and boost our defense capability against mobile malware infection. Assuming a trusted smartphone OS kernel and the fact that untrusted apps will be eventually installed onto users’ phones, AirBag is designed to isolate and prevent them from infecting our normal systems (e.g., corrupting the phone firmware) or stealthily leaking private information. More specifically, by dynamically creating an isolated runtime environment with its own dedicated namespace and virtualized system resources, AirBag not only allows for transparent execution of untrusted apps, but also effectively mediates their access to various system resources or phone functionalities (e.g., SMSs or phone calls). We have implemented a proof-of-concept prototype on three representative mobile devices, i.e., Google Nexus One, Nexus 7, and Samsung Galaxy S III. The evaluation results with a number of untrusted apps, including real-world mobile malware, demonstrate its practicality and effectiveness.

Potential Risks Arising from the Absence of Signature Verification in Miniapp Plugins.

Systematic Analysis of Security and Vulnerabilities in Miniapps

SoK: Decoding the Super App Enigma: The Security Mechanisms, Threats, and Trade-offs in OS-alike Apps

The Dark Forest: Understanding Security Risks of Cross-Party Delegated Resources in Mobile App-in-App Ecosystems

A Small Leak Will Sink Many Ships: Vulnerabilities Related to Mini Programs Permissions

Cross Miniapp Request Forgery

Identifying Cross-User Privacy Leakage in Mobile Mini-Apps at a Large Scale

Measuring the Leakage and Exploitability of Authentication Secrets in Super-apps: The WeChat Case

Do as You Say: Consistency Detection of Data Practice in Program Code and Privacy Policy in Mini-App

MiniScope: Automated UI Exploration and Privacy Inconsistency Detection of MiniApps via Two-phase Iterative Hybrid Analysis

AirBag: Boosting Smartphone Resistance to Malware Infection.

Owner-Centric Protection of Unstructured Data on Smartphones.

Don't Leak Your Keys: Understanding, Measuring, and Exploiting the AppSecret Leaks in Mini-Programs

Identity Confusion in WebView-based Mobile App-in-app Ecosystems

Uncovering and Exploiting Hidden APIs in Mobile Super Apps

Utilizing Large LanguageModels to Detect Privacy Leaks in Mini-App Code

SIMulation: Demystifying (insecure) Cellular Network Based One-Tap Authentication Services

Wemint:Tainting Sensitive Data Leaks in WeChat Mini-Programs

Characterizing Android App Signing Issues

Shared Account Problem in Super Apps.

TrustedDomain Compromise Attack in App-in-app Ecosystems