App Guarden: Resilient Application Stores

应用商店将成为软件分发的主导模式。仅仅四年后，他们就取得了令人难以置信的成功。2012年，苹果的App Store和谷歌的Play Store的应用下载量分别超过250亿次。应用商店不仅提供应用和媒体内容，还几乎完全控制了与其相连的手机和平板电脑。每天，数以亿计的人信任应用商店和设备安全。不幸的是，这种信任有时被放错了位置，并开始受到侵蚀。同样在2012年，手机恶意软件开始流行：数以万计的流氓应用程序被大量发现，包括高价短信发送应用程序、精心策划的攻击他人的移动僵尸网络、窃取密码的特洛伊木马程序，以及监控用户活动的间谍软件。合法的应用程序和移动操作系统也存在导致漏洞和信息泄露的缺陷。正如《连线》记者Mat Honan今年夏天痛苦地发现的那样，云备份同步设备的便利性意味着，一次入侵就可以一举摧毁你在任何地方的数据。未来的应用商店及其控制的设备必须在攻击下得到更好的防御和弹性。用户和数据所有者需要有理由相信，应用程序将运行良好，不会造成损害，无论是意外地通过漏洞，还是通过恶意设计。安全应该始终存在，但不突出，不会影响性能或导致崩溃，不会永远下载补丁，不会要求复杂的决策，也不会只掌握在一方手中。我们的研究将考察应用商店和移动设备操作系统的一些改进，这些改进将使我们更接近下一代安全的应用商店。例如，我们将设计算法，自动分析应用程序，以确保它们的安全。目前，这必须由恶意软件分析师以昂贵、耗时、有时不可靠的方式手动完成。另一项改进是在应用程序中增加了“数字证据”。数字证据可以保证应用程序的安全，甚至可以在手机上自动检查。有证据表明代码是安全的，而目前业界最先进的是代码签名，它充其量只能说明代码来自哪里。最后，我们希望找到自然、用户友好的安全策略：我们希望为不同类型的应用程序制定一套合理的策略，而不是像目前Android那样，用户检查一长串复杂的权限。在引擎盖下，控制实际上将比目前更精确：例如，在我们的解决方案中，一款游戏将不被允许访问互联网上的任何地方，只允许它真正需要访问的几个地方；短信应用可能只被允许从用户通讯录向联系人发送消息，而不是可能是溢价的未知号码。

Application stores are set to become the dominant model for software distribution. After only four years, they are incredibly successful. In 2012, Apple's App Store and Google's Play Store each topped 25 billion app downloads. App stores not only offer apps and media content, they also have near total control on phones and tablets that connect to them. Hundreds of millions of people place their trust in app store and device security every day. Unfortunately, this trust is sometimes misplaced and is starting to be eroded.Also in 2012, mobile malware took off: tens of thousands of rogue apps have been found `in the wild', including premium-rate SMS-sending apps, mobile botnets that are orchestrated to attack others, Trojans that steal passwords, and spyware that monitors users' activities. Legitimate apps and mobile operating systems have also had flaws leading to exploits and information leaks. And as the Wired reporter Mat Honan discovered painfully this summer, the convenience of cloud backed-up synchronized devices means that a single break-in can destroy your data everywhere, in one fell swoop.App stores of the future, and the devices they control, must be better defended and resilient under attack. Users and data owners need justifiable confidence that apps will behave well and will not cause damage, whether by accident through bugs, or by intention through malicious design. Security should be ever present but unobtrusive, not impacting performance or causing crashes, not forever downloading patches, not demanding complex decisions, and not in the hands of just one party. Our research will examine a number of improvements to app stores and mobile device operating systems which will take us closer to future generation, secure app stores.For example, we will design algorithms that will automatically analyse apps to ensure they are safe. At the moment, this has to be done manually by malware analysts in expensive, time-consuming and sometimes unreliable ways. Another improvement is to add "digital evidence" to apps. Digital evidence can guarantee that an app is safe and it can be checked automatically, even on a phone. Evidence establishes that the code is safe, whereas the current state-of-the-art in industry is code signing, which at best only says where the code has come from. Finally, we want to find natural, user-friendly security policies: rather than the user examining a long list of complicated permissions as currently happens in Android, we want to have a set of sensible policies for different types of app. Under the bonnet the controls will actually be more precise than at present: with our solution, a game, for example, would not be allowed to access anywhere on the Internet, just the few places that it really needs to go; a text-messaging app might only be allowed to send messages to contacts from a users address book, not unknown numbers that might be premium-rate.