Publication Type

PhD Dissertation

Publication Date

10-2016

Abstract

Mobile systems are generally composed of three layers of software: application layer where third-party applications are installed, framework layer where Application Programming Interfaces (APIs) are exposed, and kernel layer where low-level system operations are executed. In this dissertation, we focus on security and vulnerability analysis of framework and application layers. Security mechanisms, such as Android’s sandbox and permission systems, exist in framework layer, while malware scanners protects application layer. However, there are rooms for improvement in both mechanisms. For instance, Android’s permission system is known to be implemented in ad-hoc manner and not well-tested for vulnerabilities. Application layer also focuses mainly on malware application detection, while different types of harmful applications exist on application markets. This dissertation aims to close these security gaps by performing vulnerability analysis on mobile frameworks and detecting policy-violating applications. As a result of our analysis, we find various framework-level vulnerabilities and we are able to launch serious proof-of-concept attacks on both iOS and Android platforms. We also propose mechanisms for detecting policy-violating applications and camouflaged applications. Our techniques are shown to improve the security of mobile systems and have several impacts on mobile industry.

Keywords

mobile, security, framework, vulnerability

Degree Awarded

PhD in Information Systems

Discipline

OS and Networks | Programming Languages and Compilers | Software Engineering

Supervisor(s)

LI, Yingjiu; DENG, Huijie Robert

Research Areas

School of Information Systems (SIS)

Publisher

Singapore Management University

City or Country

Singapore

Creative Commons License

Creative Commons Attribution-Noncommercial-No Derivative Works 4.0 License
This work is licensed under a Creative Commons Attribution-Noncommercial-No Derivative Works 4.0 License.

Share

COinS