Techniques for identifying mobile platform vulnerabilities and detecting policy-violating applications

Mobile systems are generally composed of three layers of software: application layer where third-party applications are installed, framework layer where Application Programming Interfaces (APIs) are exposed, and kernel layer where low-level system operations are executed. In this dissertation, we fo...

全面介紹

Saved in:
書目詳細資料
主要作者: SU, Mon Kywe
格式: text
語言:English
出版: Institutional Knowledge at Singapore Management University 2016
主題:
在線閱讀:https://ink.library.smu.edu.sg/etd_coll_all/3
https://ink.library.smu.edu.sg/cgi/viewcontent.cgi?article=1004&context=etd_coll_all
標簽: 添加標簽
沒有標簽, 成為第一個標記此記錄!
實物特徵
總結:Mobile systems are generally composed of three layers of software: application layer where third-party applications are installed, framework layer where Application Programming Interfaces (APIs) are exposed, and kernel layer where low-level system operations are executed. In this dissertation, we focus on security and vulnerability analysis of framework and application layers. Security mechanisms, such as Android’s sandbox and permission systems, exist in framework layer, while malware scanners protects application layer. However, there are rooms for improvement in both mechanisms. For instance, Android’s permission system is known to be implemented in ad-hoc manner and not well-tested for vulnerabilities. Application layer also focuses mainly on malware application detection, while different types of harmful applications exist on application markets. This dissertation aims to close these security gaps by performing vulnerability analysis on mobile frameworks and detecting policy-violating applications. As a result of our analysis, we find various framework-level vulnerabilities and we are able to launch serious proof-of-concept attacks on both iOS and Android platforms. We also propose mechanisms for detecting policy-violating applications and camouflaged applications. Our techniques are shown to improve the security of mobile systems and have several impacts on mobile industry.