syssec_red_book

8 Security of Mobile DevicesIn an era of explosive growth in the use of mobile communication devices,the need for a secure and reliable infrastructure has never been moreapparent. Although connectivity is provided at large by WLAN networks,true mobility is only possible through the cellular infrastructure. Ericssonforecasts 80% of the world population will have WCDMA/HSPA (3G) coverageand 35% will benefit from an LTE (4G) connectivity by 2016. During the singlemonth of September 2012, 11 million automobile were connected to the mobilenetwork and recent forecasts refer to over 50 Exabytes of data being exchangedby mobile devices and smartphones have been recently reported [172].To give just one example, with more than 500 million of activations reportedin Q3 2012, Android mobile devices are becoming ubiquitous and trendsshow that the pace is unlikely to slow [267]. Android devices are extremelyappealing: powerful, with a functional and easy-to-use user interface foraccessing sensitive user and enterprise data, they can easily replace traditionalcomputing devices, especially when information is consumed rather thanproduced.Application marketplaces, such as Google Play and the Apple App Store,drive the entire economy of mobile applications. For instance, with more than600,000 applications installed, Google Play has generated revenues of about237M USD per year [161]. The prospect of such a fortune, combined with thequite unique Android ecosystem, with its high turnovers and access to sensitivedata, has unfortunately also attracted the interests of cybercriminals, with theresult that there is an alarming increase in the rate of malware strikes againstAndroid devices. Breaches of users privacy (e.g., access to address books andGPS coordinates) [416], monetization through premium SMS and calls [416],and colluding malware to bypass 2-factor authentication schemes [150, 231]are all real threats rather than a fictional forecast. Recent studies back upsuch statements, reporting how mobile marketplaces have been abused to hostmalware or legitimate-seeming applications in which malicious componentsare embedded [414].This clearly reflects a shift from an environment in which malware wasdeveloped for fun, to the current situation, where malware is distributed for