TWC: Small: Understanding and Mitigating the Security Hazards of Mobile Fragmentation

移动计算技术正在快速发展，手机(和其他移动设备)制造商不断面临提供新产品型号的压力。每个制造商都为其设备定制操作系统软件，并经常更改该软件以支持其新型号。考虑到移动设备市场中的许多制造商和许多不同代的产品，随时都有许多定制的移动操作系统分支在使用。不幸的是，通过操作系统定制过程和移动应用程序的设计相结合，引入了高影响的安全关键缺陷。该项目是第一个系统研究和缓解此类安全隐患的项目。研究人员正在与设备制造商密切合作，将该项目的成果转化为实践。更具体地说，该项目涉及对导致碎片相关漏洞的安全风险和陷阱的深入研究。研究人员正在开发新的技术，以检测现有系统中的此类缺陷，并在构建新系统时避免这些缺陷。该项目包括开发自动分析技术，扫描大量工厂映像，以识别不同操作系统(OS)层(例如，Android框架层、Linux层等)以及定制版本和官方对应版本上的系统功能保护方面的不一致。这种一致性检查有助于将定制系统的安全质量提升到Android官方系统的安全质量。此外，为了减少为跨版本、跨设备兼容而设计的服务或应用程序带来的安全风险，研究团队正在研究在新操作系统版本上自动分析各种服务的技术，增强捕获这些服务的机制，并消除新的安全风险，如挂起功能。

Mobile computing technologies are rapidly evolving and phone (and other mobile device) manufacturers are under constant pressure to offer new product models. Each manufacturer customizes operating system software for its devices and often changes this software to support its new models. Given the many manufacturers in the mobile device marketplace and the many different generations of products, there are many customized branches of mobile operating systems in use at any time. Unfortunately, high-impact, security-critical flaws have been introduced through the combination of the operating system customization process and the design of mobile applications. This project is the first to systematically study and mitigate such security hazards. The researchers are collaborating closely with device manufacturers to transfer the results of the project into practice. More specifically, the project involves an in-depth study of the security risks and pitfalls that lead to fragmentation-related vulnerabilities. The researchers are developing novel technologies to detect such flaws in existing systems and avoid them when building new ones. The project includes the development of automatic analysis techniques that scan a large number of factory images to identify inconsistencies in the protection of a system capability on different operating system (OS) layers (e.g., Android framework layer, Linux layer, etc.), and across a customized version and its official counterpart. This consistency check helps elevate the security qualities of customized systems to that of Android official systems. Furthermore, to mitigate the security risk introduced by the services or apps designed for cross-version, cross-device compatibility, the research team is studying techniques for automatically analyzing a variety of services on new OS releases, enhancing the mechanism for capturing exploits on them, and eliminating new security hazards like hanging capabilities.