Survey on Mobile User's Data Privacy Threats and Defense Mechanisms
---
paper_title: Google Android: A Comprehensive Security Assessment

paper_content:

This research provides a security assessment of the Android framework-Google's software stack for mobile devices. The authors identify high-risk threats to the framework and suggest several security solutions for mitigating them.
---
paper_title: On Mobile Viruses Exploiting Messaging and Bluetooth Services

paper_content:

The exponential growth of mobile messaging worldwide has made it an indispensable tool for social and business interactions. The interoperability between SMS (short messaging service) and IM (instant messaging) networks has enabled mobile users to communicate over the Internet seamlessly. However, the proliferation of cellular phones and handheld devices with messaging capability has also attracted virus writers who increasingly develop malware targeted to mobile handheld devices. The mobile viruses discovered so far have exploited vulnerabilities in Bluetooth to infect a nearby device and then use SMS to spread itself to other devices in the mobile network. This problem is expected to become worse with the growth of MMS (multimedia messaging service), mobile games, mobile commerce and peer-to-peer file-sharing in the near future. We investigate the propagation of mobile worms and viruses that spread primarily via SMS/MMS messages and short-range radio interfaces such as Bluetooth. First, we study these vulnerabilities in-depth so that appropriate malware behavior models can be developed. Next, we study the propagation of a mobile virus similar to Commwarrior in a cellular network using data from a real-life SMS customer network. Each handheld device is modeled as an autonomous mobile agent capable of sending SMS messages to others (via an SMS center), and is capable of discovering other devices equipped with Bluetooth. Since mobile malware targets specific mobile OSs, we consider diversity of deployed software stacks in the network. Our results reveal that hybrid worms that use SMS/MMS and proximity scanning (via Bluetooth) can spread rapidly within a cellular network, making them potential threats in public meeting places such as sports stadiums, train stations, and airports
---
paper_title: Insights into Malware Detection and Prevention on Mobile Phones

paper_content:

The malware threat for mobile phones is expected to increase with the functionality enhancement of mobile phones. This threat is exacerbated with the surge in population of smart phones instilled with stable Internet access which provides attractive targets for malware developers. Prior research on malware protection has focused on avoiding the negative impact of the functionality limitations of mobile phones to keep the performance cost within the limitations of mobile phones. Being different, this paper investigates the positive impact of these limitations on suppressing the development of mobile malware. We study the state-of-the-art mobile malware, as well as the progress of academic research and industrial effort against mobile malware. Our study shows that the functionality limitations of mobile phones should be considered as advantages as they have significant impact on shrinking the living space of mobile malware. From this perspective, we propose and analyze three potential directions for effective malware detection and prevention on mobile phones.
---
paper_title: Understanding Android Security

paper_content:

Google's Android platform is a widely anticipated open source operating system for mobile phones. This article describes Android's security model and attempts to unmask the complexity of secure application development. The authors conclude by identifying lessons and opportunities for future enhancements.
---
paper_title: A Small But Non-negligible Flaw in the Android Permission Scheme

paper_content:

This paper presents a flaw in the permission scheme of Android. The Android framework enforces a permission-based security policy where an application can access the other parts of the system only when the application is explicitly permitted. The security of the framework depends to a large extent on the owner of a device since the authorization decisions are mainly made by the user. As a result, the permission scheme imposes much of the administrative burden on the user instead of keeping it simple. Moreover, the framework does not impose enough controls nor support dynamic adjustment in the following respects: No naming rule or constraint is applied for a new permission declaration; once an application acquires a permission, the permission is never revoked during the lifetime of the application, two different permissions can be in use having the same name. These features of the framework can result in a security flaw. We explain how we found the flaw, demonstrate an exploit example, and discuss the solution.
---
paper_title: Mobile Malware Behavioral Analysis and Preventive Strategy Using Ontology

paper_content:

Mobile malware has caused harm by leaking of user privacy, depletion of battery power, and extra service charges by automatically sending expensive multimedia messages or making long-distance calls. Also, the convenience which can download programs from the Internet and share software with one another through short-range Bluetooth connections, worldwide multimedia messaging service communications and memory cards has created new vulnerabilities. As we know, anti-malware software is to play an essential role in defending against mobile malware. The majority of detection software relies on an up-to-date malware signature database to detect malware. However, mobile phone networks have very different characteristics in terms of limited processing power, storage capacity and battery power. It is a challenge to distribute malware signatures files to mobile devices in a timely manner. Therefore, this paper proposes an ontology-based behavioral analysis for mobile malware, and further provides information about mobile malware for end users to help them use their mobile phones securely.
---
paper_title: Mobile Malware Threats and Defenses for Homeland Security

paper_content:

As the population of mobile users grows rapidly, mobile malware targeting smartphones are becoming a new threat to homeland security. So far, many kinds of malicious malwares including monetizing, stealing credentials or rooting have emerged. The latest mobile malwares are especially posing a serious threat to homeland security, because they can zombify phones to be controlled by their command and conquer servers. In this paper, we survey the threats and malicious behaviors of current mobile malwares. Then, we study the defense mechanisms of mobile malware and introduce a cooperative system for mobile security in South Korea. We also discuss the possible future of mobile malware and attack techniques.
---
paper_title: Security of smartphones at the dawn of their ubiquitousness

paper_content:

The importance of researching in the field of smartphone security is substantiated in the increasing number of smartphones, which are expected to outnumber common computers in the future. Despite their increasing importance, it is unclear today if mobile malware will play the same role for mobile devices as for common computers today. Therefore, this thesis contributes to defining and structuring the field mobile device security with special concern on smartphones and on the operational side of security, i.e., with mobile malware as the main attacker model. Additionally, it wants to give an understanding of the shifting boundaries of the attack surface in this emerging research field. The first three chapters introduce and structure the research field with the main goal of showing what has to be defended against today. Besides introducing related work they structure mobile device attack vectors with regard to mobile malicious software and they structure the topic of mobile malicious software itself with regard to its portability. The technical contributions of this thesis are in Chapters 5 to 8, classified according to the location of the investigation (on the device, in the network, distributed in device and network). Located in the device is MobileSandbox, a software for dynamic malware analysis. As another device-centric contribution we investigate on the efforts that have to be taken to develop an autonomously spreading smartphone worm. The results of these investigations are used to show that device-centric parts are necessary for smartphone security. Additionally, we propose a novel device-centric security mechanism that aims at reducing the attack surface of mobile devices to mobile malware. The network-centric investigations show the possibilities that a mobile network operator can use in its own mobile network for protecting the mobile devices of its clients. We simulate the effectiveness of different security mechanisms. Finally, the distributed investigations show the feasibility of distributed computation algorithms with security modules. We give prototypic implementations of protocols for secure multiparty computation as a modularized version with failure detector and consensus algorithms, and for fair exchange with guardian angels.
---
paper_title: The security challenges for mobile ubiquitous services

paper_content:

It is envisaged that in future mobile ubiquitous environments, users will be able to seamlessly, search, access and consume a rich offering of services and content from an array of Service/Content Providers, whilst they are on the move, anytime, anywhere. Unfortunately, this new computing paradigm also brings along new and unique security challenges. Novel security solutions are therefore required. But, in order for appropriate security solutions to be devised, all possible security threats must first be thoroughly analysed, and the corresponding security requirements be identified. In this paper, we examine the security issues germane to a mobile ubiquitous environment. We then suggest some possible solutions which may be employed to address these security issues. Open research issues are also highlighted.
---
paper_title: On Mobile Viruses Exploiting Messaging and Bluetooth Services

paper_content:

The exponential growth of mobile messaging worldwide has made it an indispensable tool for social and business interactions. The interoperability between SMS (short messaging service) and IM (instant messaging) networks has enabled mobile users to communicate over the Internet seamlessly. However, the proliferation of cellular phones and handheld devices with messaging capability has also attracted virus writers who increasingly develop malware targeted to mobile handheld devices. The mobile viruses discovered so far have exploited vulnerabilities in Bluetooth to infect a nearby device and then use SMS to spread itself to other devices in the mobile network. This problem is expected to become worse with the growth of MMS (multimedia messaging service), mobile games, mobile commerce and peer-to-peer file-sharing in the near future. We investigate the propagation of mobile worms and viruses that spread primarily via SMS/MMS messages and short-range radio interfaces such as Bluetooth. First, we study these vulnerabilities in-depth so that appropriate malware behavior models can be developed. Next, we study the propagation of a mobile virus similar to Commwarrior in a cellular network using data from a real-life SMS customer network. Each handheld device is modeled as an autonomous mobile agent capable of sending SMS messages to others (via an SMS center), and is capable of discovering other devices equipped with Bluetooth. Since mobile malware targets specific mobile OSs, we consider diversity of deployed software stacks in the network. Our results reveal that hybrid worms that use SMS/MMS and proximity scanning (via Bluetooth) can spread rapidly within a cellular network, making them potential threats in public meeting places such as sports stadiums, train stations, and airports
---
paper_title: Google Android: A Comprehensive Security Assessment

paper_content:

This research provides a security assessment of the Android framework-Google's software stack for mobile devices. The authors identify high-risk threats to the framework and suggest several security solutions for mitigating them.
---
paper_title: On Mobile Viruses Exploiting Messaging and Bluetooth Services

paper_content:

The exponential growth of mobile messaging worldwide has made it an indispensable tool for social and business interactions. The interoperability between SMS (short messaging service) and IM (instant messaging) networks has enabled mobile users to communicate over the Internet seamlessly. However, the proliferation of cellular phones and handheld devices with messaging capability has also attracted virus writers who increasingly develop malware targeted to mobile handheld devices. The mobile viruses discovered so far have exploited vulnerabilities in Bluetooth to infect a nearby device and then use SMS to spread itself to other devices in the mobile network. This problem is expected to become worse with the growth of MMS (multimedia messaging service), mobile games, mobile commerce and peer-to-peer file-sharing in the near future. We investigate the propagation of mobile worms and viruses that spread primarily via SMS/MMS messages and short-range radio interfaces such as Bluetooth. First, we study these vulnerabilities in-depth so that appropriate malware behavior models can be developed. Next, we study the propagation of a mobile virus similar to Commwarrior in a cellular network using data from a real-life SMS customer network. Each handheld device is modeled as an autonomous mobile agent capable of sending SMS messages to others (via an SMS center), and is capable of discovering other devices equipped with Bluetooth. Since mobile malware targets specific mobile OSs, we consider diversity of deployed software stacks in the network. Our results reveal that hybrid worms that use SMS/MMS and proximity scanning (via Bluetooth) can spread rapidly within a cellular network, making them potential threats in public meeting places such as sports stadiums, train stations, and airports
---
paper_title: Mobile Malware Threats and Defenses for Homeland Security

paper_content:

As the population of mobile users grows rapidly, mobile malware targeting smartphones are becoming a new threat to homeland security. So far, many kinds of malicious malwares including monetizing, stealing credentials or rooting have emerged. The latest mobile malwares are especially posing a serious threat to homeland security, because they can zombify phones to be controlled by their command and conquer servers. In this paper, we survey the threats and malicious behaviors of current mobile malwares. Then, we study the defense mechanisms of mobile malware and introduce a cooperative system for mobile security in South Korea. We also discuss the possible future of mobile malware and attack techniques.
---
paper_title: Delegate the smartphone user? Security awareness in smartphone platforms

paper_content:

Smartphone users increasingly download and install third-party applications from official application repositories. Attackers may use this centralized application delivery architecture as a security and privacy attack vector. This risk increases since application vetting mechanisms are often not in place and the user is delegated to authorize which functionality and protected resources are accessible by third-party applications. In this paper, we mount a survey to explore the security awareness of smartphone users who download applications from official application repositories (e.g. Google Play, Apple's App Store, etc.). The survey findings suggest a security complacency, as the majority of users trust the app repository, security controls are not enabled or not added, and users disregard security during application selection and installation. As a response to this security complacency we built a prediction model to identify users who trust the app repository. The model is assessed, evaluated and proved to be statistically significant and efficient.
---
paper_title: Delegate the smartphone user? Security awareness in smartphone platforms

paper_content:

Smartphone users increasingly download and install third-party applications from official application repositories. Attackers may use this centralized application delivery architecture as a security and privacy attack vector. This risk increases since application vetting mechanisms are often not in place and the user is delegated to authorize which functionality and protected resources are accessible by third-party applications. In this paper, we mount a survey to explore the security awareness of smartphone users who download applications from official application repositories (e.g. Google Play, Apple's App Store, etc.). The survey findings suggest a security complacency, as the majority of users trust the app repository, security controls are not enabled or not added, and users disregard security during application selection and installation. As a response to this security complacency we built a prediction model to identify users who trust the app repository. The model is assessed, evaluated and proved to be statistically significant and efficient.
---
paper_title: Biometric recognition: security and privacy concerns

paper_content:

Biometrics offers greater security and convenience than traditional methods of personal recognition. In some applications, biometrics can replace or supplement the existing technology. In others, it is the only viable approach. But how secure is biometrics? And what are the privacy implications?.
---
paper_title: Google Android: A Comprehensive Security Assessment

paper_content:

This research provides a security assessment of the Android framework-Google's software stack for mobile devices. The authors identify high-risk threats to the framework and suggest several security solutions for mitigating them.
---
paper_title: Biometric recognition: security and privacy concerns

paper_content:

Biometrics offers greater security and convenience than traditional methods of personal recognition. In some applications, biometrics can replace or supplement the existing technology. In others, it is the only viable approach. But how secure is biometrics? And what are the privacy implications?.
---
paper_title: Understanding Android Security

paper_content:

Google's Android platform is a widely anticipated open source operating system for mobile phones. This article describes Android's security model and attempts to unmask the complexity of secure application development. The authors conclude by identifying lessons and opportunities for future enhancements.
---
paper_title: A Small But Non-negligible Flaw in the Android Permission Scheme

paper_content:

This paper presents a flaw in the permission scheme of Android. The Android framework enforces a permission-based security policy where an application can access the other parts of the system only when the application is explicitly permitted. The security of the framework depends to a large extent on the owner of a device since the authorization decisions are mainly made by the user. As a result, the permission scheme imposes much of the administrative burden on the user instead of keeping it simple. Moreover, the framework does not impose enough controls nor support dynamic adjustment in the following respects: No naming rule or constraint is applied for a new permission declaration; once an application acquires a permission, the permission is never revoked during the lifetime of the application, two different permissions can be in use having the same name. These features of the framework can result in a security flaw. We explain how we found the flaw, demonstrate an exploit example, and discuss the solution.
---
paper_title: Mobile Malware Behavioral Analysis and Preventive Strategy Using Ontology

paper_content:

Mobile malware has caused harm by leaking of user privacy, depletion of battery power, and extra service charges by automatically sending expensive multimedia messages or making long-distance calls. Also, the convenience which can download programs from the Internet and share software with one another through short-range Bluetooth connections, worldwide multimedia messaging service communications and memory cards has created new vulnerabilities. As we know, anti-malware software is to play an essential role in defending against mobile malware. The majority of detection software relies on an up-to-date malware signature database to detect malware. However, mobile phone networks have very different characteristics in terms of limited processing power, storage capacity and battery power. It is a challenge to distribute malware signatures files to mobile devices in a timely manner. Therefore, this paper proposes an ontology-based behavioral analysis for mobile malware, and further provides information about mobile malware for end users to help them use their mobile phones securely.
---

Title: Survey on Mobile User's Data Privacy Threats and Defense Mechanisms

Section 1: Introduction
Description 1: This section introduces the significance of mobile device usage and the growing concern over mobile security and data privacy issues.

Section 2: Related Work
Description 2: This section summarizes existing research on mobile security and data privacy mechanisms, highlighting different approaches and findings.

Section 3: Security Challenges for Mobile Device Users
Description 3: This section discusses the various security challenges faced by mobile device users, including insecure data storage, physical security, and mobile browsing.

Section 4: Mobile Threats and Vulnerabilities
Description 4: This section provides a comprehensive overview of the types of threats and vulnerabilities related to mobile devices.

Section 5: Defensive Mechanisms
Description 5: This section describes the defense mechanisms that can be implemented to enhance security and data privacy in mobile devices, such as application stores scrutiny, OS and device manufacturer approaches, and biometric measures.

Section 6: Comparative Analysis and Discussion
Description 6: This section offers a comparative analysis of the discussed threats and defense mechanisms, including a discussion of the effectiveness of various approaches.

Section 7: Conclusion and Future Work
Description 7: This section concludes the paper by summarizing key findings and suggesting future research directions for improving mobile data privacy and security.