syssec_red_book

8.3. What Is the Worst That Can Happen?8.3 What Is the Worst That Can Happen?Losses can happen in almost any domain: financial, personal data [212], andintellectual property are the easiest to think of, but other attacks could alsobe potentially life-threatening. For instance, denial of services to avoid callingemergency numbers, malicious location-based services and leakage of GPScoordinates, which may enable traditional crime activities (as outlined above),may all be concrete attacks rather than fictional artifacts. In addition, anylife-affecting device (e.g., cars, NFC-based insulin pumps), if improperly usedand fully controlled by a smartphone (assuming read/write/exec accesses andno fallback safety checks) may threaten life itself or violate an individualsprivacy.8.4 State of the ArtTo contribute to an understanding of the security problems affecting smartphones,La Polla et al. surveyed the related literature in the 2004–2011 period,highlighting threats, vulnerabilities, and attacks [246]. Despite the similarities,there are in fact a number of security-related differences between mobile devicesand PCs (e.g., monetization through premium SMS and calls [416]) andthey need to be dealt with specifically.With a few exceptions focused on enhancing mobile OSes with state-of-theartmemory error protections [105], iOS privacy violation detection [162], anda recent detailed analysis of cellular networks [253], current research is mainlyconcerned with understanding, analyzing, and mitigating Android malwarethreats.DroidScope [405] is a framework for creating dynamic analysis tools forAndroid malware that trades simplicity and efficiency for transparency. As anout-of-the-box approach, it instruments the Android emulator, but it may incurhigh overhead (for instance, when taint-tracking is enabled). DroidScope employsa 2-level virtual machine introspection (VMI) [187] to gather informationabout the system (i.e., OS-level and Android-specific behaviors) and exposeshooks and a set of APIs that enable the development of plugins to perform bothfine and coarse-grained analyses (e.g., system call, single instruction tracing,and taint tracking). Unfortunately, DroidScope just offers a set of hooks thatother analyses can build upon to intercept interesting events and does notperform any behavioral analysis per se.Enck et al. presented TaintDroid [167], a framework to enable dynamictaint analysis of Android applications. TaintDroid’s main goal is to trackhow sensitive information flows between the system and applications, orbetween applications, in order to automatically identify information leaks.Because of the complexity of Android, TaintDroid relies on different levelsof instrumentation to perform its analyses. For example, to propagate taint61