The popularity and adoption of smart phones has greatly stimulated the spread of mobile malware, especially on the popular platforms such as Android. In light of their rapid growth, there is a pressing need to develop effective solutions. However, our defense capability is largely constrained by the limited understanding of these emerging mobile malware and the lack of timely access to related samples. In this paper, we focus on the Android platform and aim to systematize or characterize existing Android malware. Particularly, with more than one year effort, we have managed to collect more than 1,200 malware samples that cover the majority of existing Android malware families, ranging from their debut in August 2010 to recent ones in October 2011. In addition, we systematically characterize them from various aspects, including their installation methods, activation mechanisms as well as the nature of carried malicious payloads. The characterization and a subsequent evolution-based study of representative families reveal that they are evolving rapidly to circumvent the detection from existing mobile anti-virus software. Based on the evaluation with four representative mobile security software, our experiments show that the best case detects 79.6% of them while the worst case detects only 20.2% in our dataset. These results clearly call for the need to better develop next-generation anti-mobile-malware solutions.

/pdf/dissecting-android-malware-characterization-and-evolution-2euhdmm33o.pdf

Dissecting Android Malware: Characterization and Evolution

Mobile malware is rapidly becoming a serious threat. In this paper, we survey the current state of mobile malware in the wild. We analyze the incentives behind 46 pieces of iOS, Android, and Symbian malware that spread in the wild from 2009 to 2011. We also use this data set to evaluate the effectiveness of techniques for preventing and identifying mobile malware. After observing that 4 pieces of malware use root exploits to mount sophisticated attacks on Android phones, we also examine the incentives that cause non-malicious smartphone tinkerers to publish root exploits and survey the availability of root exploits.

/pdf/a-survey-of-mobile-malware-in-the-wild-18gj2rthl8.pdf

A survey of mobile malware in the wild

Programming question and answer (QA questions in some topics lead to discussions in other topics; and the topics gaining the most popularity over time are web development (especially jQuery), mobile applications (especially Android), Git, and MySQL.

/pdf/what-are-developers-talking-about-an-analysis-of-topics-and-1uk58lpy70.pdf

What are developers talking about? An analysis of topics and trends in Stack Overflow

Nowadays, mobile devices are an important part of our everyday lives since they enable us to access a large variety of ubiquitous services. In recent years, the availability of these ubiquitous and mobile services has significantly increased due to the different form of connectivity provided by mobile devices, such as GSM, GPRS, Bluetooth and Wi-Fi. In the same trend, the number and typologies of vulnerabilities exploiting these services and communication channels have increased as well. Therefore, smartphones may now represent an ideal target for malware writers. As the number of vulnerabilities and, hence, of attacks increase, there has been a corresponding rise of security solutions proposed by researchers. Due to the fact that this research field is immature and still unexplored in depth, with this paper we aim to provide a structured and comprehensive overview of the research on security solutions for mobile devices. This paper surveys the state of the art on threats, vulnerabilities and security solutions over the period 2004-2011, by focusing on high-level attacks, such those to user applications. We group existing approaches aimed at protecting mobile devices against these classes of attacks into different categories, based upon the detection principles, architectures, collected data and operating systems, especially focusing on IDS-based models and tools. With this categorization we aim to provide an easy and concise view of the underlying model adopted by each approach.

/pdf/a-survey-on-security-for-mobile-devices-29lf2mr79f.pdf

A Survey on Security for Mobile Devices

Security is oftentimes centrally managed. An alternative trend of using collaboration in order to improve security has gained momentum over the past few years. Collaborative security is an abstract concept that applies to a wide variety of systems and has been used to solve security issues inherent in distributed environments. Thus far, collaboration has been used in many domains such as intrusion detection, spam filtering, botnet resistance, and vulnerability detection. In this survey, we focus on different mechanisms of collaboration and defense in collaborative security. We systematically investigate numerous use cases of collaborative security by covering six types of security systems. Aspects of these systems are thoroughly studied, including their technologies, standards, frameworks, strengths and weaknesses. We then present a comprehensive study with respect to their analysis target, timeliness of analysis, architecture, network infrastructure, initiative, shared information and interoperability. We highlight five important topics in collaborative security, and identify challenges and possible directions for future research. Our work contributes the following to the existing research on collaborative security with the goal of helping to make collaborative security systems more resilient and efficient. This study (1) clarifies the scope of collaborative security, (2) identifies the essential components of collaborative security, (3) analyzes the multiple mechanisms of collaborative security, and (4) identifies challenges in the design of collaborative security.

/pdf/collaborative-security-a-survey-and-taxonomy-43p8xo3t4g.pdf

Collaborative Security: A Survey and Taxonomy

We are currently moving from the Internet society to a mobile society where more and more access to information is done by previously dumb phones. For example, the number of mobile phones using a full blown OS has risen to nearly200% from Q3/2009 to Q3/2010. As a result, mobile security is no longer immanent, but imperative. This survey paper provides a concise overview of mobile network security, attack vectors using the back end system and the web browser, but also the hardware layer and the user as attack enabler. We show differences and similarities between "normal" security and mobile security, and draw conclusions for further research opportunities in this area.

http://www.ieee-security.org/TC/SP2011/PAPERS/2011/paper007.pdf

Mobile Security Catching Up? Revealing the Nuts and Bolts of the Security of Mobile Devices

The importance of researching in the field of smartphone security is substantiated in the increasing number of smartphones, which are expected to outnumber common computers in the future. Despite their increasing importance, it is unclear today if mobile malware will play the same role for mobile devices as for common computers today. Therefore, this thesis contributes to defining and structuring the field mobile device security with special concern on smartphones and on the operational side of security, i.e., with mobile malware as the main attacker model. Additionally, it wants to give an understanding of the shifting boundaries of the attack surface in this emerging research field. The first three chapters introduce and structure the research field with the main goal of showing what has to be defended against today. Besides introducing related work they structure mobile device attack vectors with regard to mobile malicious software and they structure the topic of mobile malicious software itself with regard to its portability. The technical contributions of this thesis are in Chapters 5 to 8, classified according to the location of the investigation (on the device, in the network, distributed in device and network). Located in the device is MobileSandbox, a software for dynamic malware analysis. As another device-centric contribution we investigate on the efforts that have to be taken to develop an autonomously spreading smartphone worm. The results of these investigations are used to show that device-centric parts are necessary for smartphone security. Additionally, we propose a novel device-centric security mechanism that aims at reducing the attack surface of mobile devices to mobile malware. The network-centric investigations show the possibilities that a mobile network operator can use in its own mobile network for protecting the mobile devices of its clients. We simulate the effectiveness of different security mechanisms. Finally, the distributed investigations show the feasibility of distributed computation algorithms with security modules. We give prototypic implementations of protocols for secure multiparty computation as a modularized version with failure detector and consensus algorithms, and for fair exchange with guardian angels.

/pdf/security-of-smartphones-at-the-dawn-of-their-ubiquitousness-4x1hr0tk67.pdf

Security of Smartphones at the Dawn of their Ubiquitousness

Web applications are not protected by today's network level firewalls, because they allow access to TCP port 80 without restrictions. However, many successful attacks today are not on the network level, but on application level. For protecting against application level attacks, a firewall must understand the application protocols, that are used on its open ports. This happens in application level firewalls and for Web application in Web application firewalls. The underlying concepts of Web application firewalls differ much from the concepts of traditional network level firewalls. This book explains the underlying concepts of Web application firewalls. Afterwards, they are applied to a collection of security requirements, that application developers should respect today for developing a secure Web application. A Web application firewall is capable of automatically implementing many of these requirements. As a result, Web application developers can ignore these requirements, because the Web applications firewall already ensures their implementation and therefore the security of the Web application. This book is intended for anyone, who is interested in securing his Web application.

Web Application Firewalls

Mobile devices like smartphones have different properties compared to common personal computers. Therefore, the basic principles of mobile device security are also different and this situation is advantageous because it gives more possibilities of securing the mobile device, based on the more centrally controlled environment in which they operate, and a different role of the user. This paper describes the framework for a background monitoring system to collect software that a user is going to install on its device, and to automatically perform a dynamic analysis of the software. The implementation of a dynamic analysis module of the monitoring system is presented. It has the task of performing the dynamic analysis by transferring common sandboxing approaches to the Windows Mobile operating system on the ARM architecture.

Towards Dynamic Malware Analysis to Increase Mobile Device Security

The techniques of kernel-level system call interception are well known today for many different operating systems. This work starts with transferring these technique to the Windows CE type of operating systems. Afterwards, two current problems are solved. The first solution uses the technique for dynamic malware analysis with a sandbox approach, extending previous solutions in terms of effectiveness. The second solution enhances the expressiveness of security policies by implementing the concept of a reference monitor on the operating system level. Windows CE based devices are now enabled to enforce sophisticated security policies without the need to change the underlying operating system.

Michael Becher

Papers

Mobile Security Catching Up? Revealing the Nuts and Bolts of the Security of Mobile Devices

Security of Smartphones at the Dawn of their Ubiquitousness

Web Application Firewalls

Towards Dynamic Malware Analysis to Increase Mobile Device Security

Kernel-Level Interception and Applications on Mobile Devices