syssec_red_book

8. Security of Mobile DevicesFinally, Zhou et al. performed a very detailed and fine-grained staticanalysis of a large set of real-world Android malware, collected from August2010 to October 2011 [416]. The authors released this data set as the AndroidMalware Genome Project [415].8.5 Research GapsRecent research has shown that mobile security is still in its infancy and,although we can borrow and build on traditional (PC) malware research, theproblem space is hard and quite diverse, which calls for solutions to be devisedspecifically for mobile devices. For instance, is sending an SMS a maliciousaction on its own? Hard to say; potentially, if this happens in the background.Given the nature of the problem space (i.e., smartphones travel acrossnetwork boundaries and store—on the same media—potentially sensitivepersonal and enterprise data), confidentiality (privacy) and integrity seem, onceagain, to be the most important property to guarantee. However, assuming wecan tolerate financial and intellectual property losses to some extent, privacy(e.g., no unauthorized data disclosure) may be the foremost challenge to meet.It is not hard to imagine mobile malware infections that collude with andabet traditional crimes more effectively. For instance, leaked GPS coordinates ormalicious location-based services may indicate that someone has reached or lefta specific location, enabling a number of traditional criminal-related activities(e.g., burglary, kidnapping, stalking, terrorist attacks). Information flow haslong been studied as a way to track how sensitive data propagate throughouta program’s execution, enabling integrity and confidentiality properties to berealized in a number of successful scenarios. Unfortunately, the very sametechnique has been shown to suffer from a slew of easy-to-deploy attacks andevasions when applied to the analysis analyze or containment of maliciousinfections [121, 341, 355]. It is clear that alternative and evasion-resistantsolutions, which potentially retrofit traditional malware, need to be explored.An interesting long-term research project would aim at exploring highlyscalable technologies for efficient monitoring and analysis of security eventsthat have the potential to compromise mobile devices. In particular, suchobjectives may be addressed by approaching three different steps within themobile communication process: 1) data monitoring and analysis—dedicatedto monitoring multi-source data, including mobile device security event detectionand analysis, and network-based features generated by smartphonecommunication; 2) data aggregation and correlation—by adopting a synergyof contextual information from the terminals correlated with application behavioralprofiles and honeypot events; and 3) management of mobile-relatedtrustworthy indicators—that will use the latest malware classifications and gen-64