TWC: Small: Emerging Attacks Against the Mobile Web and Novel Proxy Technologies for Their Containment

用户将敏感数据（包括商业电子邮件以及健康和财务信息）委托给他们的移动设备。因此，移动设备已成为攻击者越来越受欢迎的目标。移动设备拥有强大的浏览器，它们受到的攻击至少与桌面设备一样多。然而，研究人员对这些移动浏览器的安全性研究不足，导致缺乏有关正在进行的攻击和可能的防御措施的当前信息。该项目正在收集针对移动浏览器的潜在攻击的最新信息，并开发能够保护用户的防御系统，同时考虑到移动平台的复杂性。为了帮助研究人员更好地理解和优先考虑针对移动浏览器的潜在攻击，该项目首先开发了一个攻击分类，其中包括有关当前和未来攻击媒介可以依赖的基础漏洞的信息。其次，该项目正在开发一个自动漏洞评估框架，以帮助分析人员识别哪些浏览器容易受到哪些攻击。最后，该项目正在开发一种保护代理，允许对资源受限的移动设备的流量进行基于云的分析，同时避免代理隐私敏感活动。通过该项目获得的信息将告知研究社区移动网络平台的漏洞，并有助于优先考虑未来的研究工作，以开发最有效和最高效的防御。

Users entrust their mobile devices with sensitive data, including business emails, as well as health and financial information. Thus, mobile devices have become an increasingly popular target for attackers. Mobile devices house powerful browsers that are vulnerable to at least as many attacks as their desktop counterparts. Yet, the security of these mobile browsers is understudied by researchers, leading to a lack of current information about ongoing attacks and possible defenses. This project is gathering up-to-date information about potential attacks against mobile browsers, and developing defense systems that can safeguard a user while taking into account the intricacies of the mobile platform. To help researchers better understand and prioritize protections for potential attacks against mobile browsers, the project is first developing an attack taxonomy that includes information about cornerstone vulnerabilities on which current and future attack vectors can rely. Second, the project is developing an automated vulnerability assessment framework to assist analysts in identifying which browsers are vulnerable to which attacks. Finally, the project is developing a protection proxy to allow cloud-based analysis of traffic to the resource-constrained mobile device, while avoiding proxying of privacy-sensitive activities. The information gained through this project will inform the research community of the vulnerabilities of the mobile web platform and help to prioritize future research efforts toward developing the most effective and performant defenses.