TWC: TTP Option: Medium: Collaborative: Identifying and Mitigating Trust Violations in the Smartphone Ecosystem

智能手机的采用在过去几年中稳步增长，智能手机已成为数百万用户处理机密信息的工具，如财务和健康相关数据。 因此，这些设备已成为网络犯罪分子的诱人目标，他们试图违反智能手机平台的信任假设，以损害用户的安全和隐私。这项研究工作提供了一个新颖的框架，可以对用户、智能手机平台和周围生态系统（包括智能手机应用和应用市场）之间的信任关系进行建模。该模型允许系统地探索违反信任的弱点（即，信任被错误放置并且信任假设可能被违反的情况）。作为补充，该模型还支持设计解决已识别弱点的安全机制（即，这项研究的结果有可能影响数百万智能手机用户的生活，为可能损害他们福祉的攻击提供保护。 虽然这个项目的重点是Android平台，其结果是通用的，适用于其他智能手机平台。 作为本研究的一部分开发的分析技术通过门户网站向公众提供，该门户网站允许用户提交智能手机应用程序，并根据应用程序的静态和动态分析及其与其他应用程序，网络和Android平台中的其他组件的交互获得有关可能的信任弱点的报告。

The adoption of smartphones has steadily increased in the past few years, and smartphones have become the tool with which millions of users handle confidential information, such as financial and health-related data. As a result, these devices have become attractive targets for cybercriminals, who attempt to violate the trust assumptions underlying the smartphone platform in order to compromise the security and privacy of users.This research effort provides a novel framework to model the trust relationships between users, the smartphone platform, and the surrounding ecosystem, including smartphone apps and app markets. This model allows for the systematic exploration of trust-violation weaknesses (i.e., situations in which trust is misplaced and trustassumptions can be violated). In a complementary fashion, the model also supports the design of security mechanisms that address the identified weaknesses (i.e., techniques to prevent, or detect and mitigate trust violations).The results of this research have the potential of impacting the lives of millions of smartphone users, providing protection against attacks that might harm their well-being. Though this project focuses on the Android platform, its results are general and applicable to other smartphone platforms. The analysis techniques that have been developed as part of this research are made available to the public through a web portal that allows users to submit smartphone applications and obtain reports on possible trust weaknesses based on the static and dynamic analysis of the application and its interaction with other applications, the network, and other components in the Android platform.