TWC: TTP Option: Medium: Collaborative: Identifying and Mitigating Trust Violations in the Smartphone Ecosystem

在过去的几年里，智能手机的使用率稳步上升，智能手机已经成为数百万用户处理机密信息的工具，比如金融和健康相关的数据。因此，这些设备已经成为网络犯罪分子的诱人目标，他们试图违反智能手机平台背后的信任假设，以损害用户的安全和隐私。这项研究工作提供了一个新的框架，以建模用户、智能手机平台和周围生态系统之间的信任关系，包括智能手机应用程序和应用程序市场。这个模型允许系统地探索违反信任的弱点(即，信任错位和信任假设可能被违反的情况)。作为补充，该模型还支持安全机制的设计，以解决已发现的弱点(即防止或检测和缓解信任违规的技术)。这项研究的结果可能会影响数百万智能手机用户的生活，提供保护，使其免受可能损害他们福祉的攻击。虽然这个项目的重点是Android平台，但它的结果是通用的，也适用于其他智能手机平台。作为这项研究的一部分开发的分析技术通过一个门户网站向公众提供，该门户允许用户提交智能手机应用程序，并基于对该应用程序及其与其他应用程序、网络和Android平台中其他组件的交互的静态和动态分析，获得有关可能的信任弱点的报告。

The adoption of smartphones has steadily increased in the past few years, and smartphones have become the tool with which millions of users handle confidential information, such as financial and health-related data. As a result, these devices have become attractive targets for cybercriminals, who attempt to violate the trust assumptions underlying the smartphone platform in order to compromise the security and privacy of users.This research effort provides a novel framework to model the trust relationships between users, the smartphone platform, and the surrounding ecosystem, including smartphone apps and app markets. This model allows for the systematic exploration of trust-violation weaknesses (i.e., situations in which trust is misplaced and trustassumptions can be violated). In a complementary fashion, the model also supports the design of security mechanisms that address the identified weaknesses (i.e., techniques to prevent, or detect and mitigate trust violations).The results of this research have the potential of impacting the lives of millions of smartphone users, providing protection against attacks that might harm their well-being. Though this project focuses on the Android platform, its results are general and applicable to other smartphone platforms. The analysis techniques that have been developed as part of this research are made available to the public through a web portal that allows users to submit smartphone applications and obtain reports on possible trust weaknesses based on the static and dynamic analysis of the application and its interaction with other applications, the network, and other components in the Android platform.