Android Operating Research Articles

Toward Engineering a Secure Android Ecosystem

The openness and extensibility of Android have made it a popular platform for mobile devices and a strong candidate to drive the Internet-of-Things. Unfortunately, these properties also leave Android vulnerable, attracting attacks for profit or fun. To mitigate these threats, numerous issue-specific solutions have been proposed. With the increasing number and complexity of security problems and solutions, we believe this is the right moment to step back and systematically re-evaluate the Android security architecture and security practices in the ecosystem. We organize the most recent security research on the Android platform into two categories: the software stack and the ecosystem. For each category, we provide a comprehensive narrative of the problem space, highlight the limitations of the proposed solutions, and identify open problems for future research. Based on our collection of knowledge, we envision a blueprint for engineering a secure, next-generation Android ecosystem.

Taming transitive permission attack via bytecode rewriting on Android application

AbstractGoogle Android is popular for mobile devices in recent years. The openness and popularity of Android make it a primary target for malware. Even though Android's security mechanisms could defend most malware, its permission model is vulnerable to transitive permission attack, a type of privilege escalation attacks. Many approaches have been proposed to detect this attack by modifying the Android OS. However, the Android's fragmentation problem and requiring rooting Android device hinder those approaches large‐scale adoption. In this paper, we present an instrumentation framework, called SEAPP, for Android applications (or “apps”) to detect the transitive permission attack on unmodified Android. SEAPP automatically rewrites an app without requiring its source codes and produces a security‐harden app. At runtime, call‐chains are built among these apps and detection process is executed before a privileged API is invoked. Our experimental results show that SEAPP could work on a large number of benign apps from the official Android market and malicious apps, with a repackaged success rate of over 99.8%. We also show that our framework effectively tracks call‐chains among apps and detects known transitive permission attack with low overhead. Copyright © 2016 John Wiley & Sons, Ltd.

Authentication Based on Non-Interactive Zero-Knowledge Proofs for the Internet of Things.

This paper describes the design and analysis of a new scheme for the authenticated exchange of confidential information in insecure environments within the Internet of Things, which allows a receiver of a message to authenticate the sender and compute a secret key shared with it. The proposal is based on the concept of a non-interactive zero-knowledge proof, so that in a single communication, relevant data may be inferred to verify the legitimacy of the sender. Besides, the new scheme uses the idea under the Diffie–Hellman protocol for the establishment of a shared secret key. The proposal has been fully developed for platforms built on the Android Open Source Project, so it can be used in any device or sensor with this operating system. This work provides a performance study of the implementation and a comparison between its promising results and others obtained with similar schemes.

Основанный на резюме метод реализации произвольных контекстно-чувствительных проверок при анализе исходного кода посредством символьного выполнения

A specific approach to summary-based interprocedural symbolic execution is described. The approach is suitable for analysis of program source code developed with high-level programming languages and allows executing arbitrarily complex checks during symbolic execution, including throwing reports in the callee function about defects that only become certain within the caller context. The structure of the function summary, procedure of applying the summary in a particular context, composition of symbolic values for particular contexts, effect of summary-based analysis on complexity of implementing specific checker modules, procedure for constructing path-sensitive bug reports, and other aspects of the implementation are discussed in detail. A particular implementation of the approach, based on Clang Static Analyzer, is described. The implementation is scalable enough to allow analysis of large-scale software projects in reasonable time, finding bugs faster than the existing implementation of the inlining-based interprocedural analysis, without sacrificing correctness and soundness of the analysis. Particular checker modules, which find various defects, such as integer overflows, modifications of constant-qualified memory, multithreading issues, array bound checks, exception safety checks, and file stream errors, were updated to use the summary-based approach, demonstrating flexibility of the technique proposed. The implementation was tested by running full intra-unit inter-procedural analysis of the Android Open Source Project codebase.

Mobile Banking in the Opinion of Users of Banking Applications in Poland

The objective of this article is to present and analyze the findings of a survey concerning mobile banking services offered by commercial banks to individual clients. The present study conducted by the authors examines the use of banking products and services offered in the mobile channel and the opinions of individual customers on the subject. The findings presented in the article focus on mobile banking applications offered by universal banks in Poland available for mobile devices running the Android, iOS and WindowsPhone operating systems. The paper presents general assumptions of the study, description of the methodology and research sample as well as the analysis of the obtained findings and their discussion. The quantitative study was conducted on a selected sample of respondents with the application of a standardized evaluation method used for the assessment of selected banking products and services.

Painting the Town Blue and Green: Curating Street Art through Urban Mobile Gaming

Painting the Town Blue and Green: Curating Street Art through Urban Mobile Gaming

Application of Domain-aware Binary Fuzzing to Aid Android Virtual Machine Testing

The development of a new application virtual machine (VM), like the creation of any complex piece of software, is a bug-prone process. In version 5.0, the widely-used Android operating system has changed from the Dalvik VM to the newly-developed ART VM to execute Android applications. As new iterations of this VM are released, how can the developers aim to reduce the number of potentially security-threatening bugs that make it into the final product? In this paper we combine domain-aware binary fuzzing and differential testing to produce DexFuzz, a tool that exploits the presence of multiple modes of execution within a VM to test for defects. These modes of execution include the interpreter and a runtime that executes ahead-of-time compiled code. We find and present a number of bugs in the in-development version of ART in the Android Open Source Project. We also assess DexFuzz's ability to highlight defects in the experimental version of ART released in the previous version of Android, 4.4, finding 189 crashing programs and 15 divergent programs that indicate defects after only 5,000 attempts.

The Digital Generation: Comparing and Contrasting Smartphone Use in the Digital Age

This paper investigates the use and application of smartphones amongst predominantly young Taiwanese users of this new technology. Using online tools such as Facebook and Google Forms it was possible to quickly illicit detailed information about 127 smartphone users from six countries. This dataset was then utilized to preview trends in the marketplace and draw comparisons and contrasts between different platforms and operating systems. The main conclusions are that users enjoy the freedom to customize their devices and whether they use Android or iOS operating systems, seems to make little difference in terms of functionality. Screen size appears to be the biggest hurdle to successfully using these types of devices and this will force users to become more creative in how they arrange their icons and folders.

The Implementation For The Intelligent Home Control System Based On The Android And Zigbee

abstract The intelligent home system finished the wireless or remote control for all the indoor electric devices through the intelligent terminals. The description about the integrated network architecture and the interconnecting mechanisms for the reliable measurement of parameters by smart sensors and transmission of data via internet is being presented. The wireless communication technology includes the WiFi, Zigbee and mobile communications. The system presented the design of the hardware part and the software part. The forward are fixed in the variety of appliances based on CC2530 chip and sensors. The connection between different devices can be finished by the standard interfaces RS232 and RS485. The software can be installed in the tablet PC, the personal computer or smart telephones. It can be realized on the open Android platform or Eclipse. The system has been applied in the actual intelligent house. Results are encouraging as the reliability of sensing information transmission is with very little error in the peak of the internet. The home owners are satisfied with the test results. The prototype was tested to generate real-time graphical information rather than a test bed scenario. This will be widely applied in the future of the smart home.

Evaluation of Smart Phones for Remote Control of a Standard Hospital Room

The standard hospital room interface for control of communication and entertainment devices assumes a patient has the ability to hold and press mechanical switches. If the patient does not have these abilities, then the patient must wait for a nurse to walk by the room to ask for help. Mobile devices using the Android and iOS operating systems are compared to accommodate the limitations of a patient for communication and control of the hospital room environment. In order to design an appropriate system, analysis of currently available off-the-shelf technology is performed to find the appropriate configuration that is compatible with the hospital room environment and covers a clear patient need. Evaluation of components for a fully integrated system is shown. Strengths and weaknesses of each technology are discussed. Progress toward an integrated solution on a tablet is provided in the conclusion.

Visualization Engineering Simulation Based on HTML5 and Cloud Computing

Visualization Engineering Simulation Based on HTML5 and Cloud Computing is the first product using web technology in the development of simulation.This hardware simulation platform is a visualization simulation platform like Simulink, which is based on the browser, and provides a integrated environment with dynamic systems modeling, simulation and comprehensive analysis. The platform adopted HTML5 system, realize the cross-platform simulation.By calling the HTML5 standard Canvas 2D Graphics and other new technology, developers can visually control elements and logic circuit simulation tests, and it truly realize the span of PC, Android, BB10 and other operating system platforms for the work.Simulation of the platform carry out in the clouds,and the simulation process lower the requirements over equipment, therefore the requirements on the hardware in developing becomes transparency.Long term, the platform will be the focus shifted to engineering simulation development of Internet air.

안드로이드 로컬 마켓 인증 방안

급격하게 증가하고 있는 스마트폰의 애플리케이션 이용의 편의를 위한 마켓 기반의 배포 방식이 활성화되고 있으며, 안드로이드의 경우 개방성을 제공하여 다양한 형태의 애플리케이션 배포 방식이 존재하고 있다. 그러나 애플리케이션의 직접 설치를 허용하는 개방성은 안드로이드 애플리케이션의 불법적인 이용이라는 부작용을 낳고 있으며, 이에 대응하기 위해 온라인 인증과 같은 강력한 사용자 인증 방식을 이용하고 있다. 그러나 이러한 방식은 정당한 사용자에게도 경우에 따라 이용을 제한할 수 있다는 문제점을 갖고 있으며 특히 구글 외 로컬 마켓에서 사용자의 애플리케이션 이용을 저해하는 요인이 된다. 따라서 본 논문에서는 사용자가 로밍, 통신사 변경 등의 다양한 변동 상황에서 구매한 애플리케이션을 그대로 이용할 수 있는 인증 방안을 제시한다. Google Android provides market based application distribution to provide ease use of application services. While openness of Android allows various ways of application distribution, including installation of unsigned application. such openness also invokes critical threats such as the spread of malwares and the illegal distribution of applications. In order to prevent such threats, several distributors use on-line authentication techniques by using mobile subscriber's information. However such methods also have limits that even legal users cannot use their purchased application in situations. Therefore, in this paper, we discuss such problems and provide some ideas of authentication method that allow users to use their purchased application when users change their status.