Seeding a Security-Enhancing Infrastructure for Multi-Market Application Ecosystems∗

Seeding a Security-Enhancing Infrastructure for Multi-market Application Ecosystems∗ David Barrera1 William Enck2 Paul C. van Oorschot1 1School of Computer Science, Carleton University, Canada 2Penn State University, University Park, PA ABSTRACT app characteristic is a result of a) limited user interfaces, b) Application markets providing one-click software installa- a cottage industry of hundreds of thousands of developers tion have become common to smartphones and are emerging attempting to be the first to market, and c) a new comput- on desktop platforms. Until recently, each platform has had ing environment that enables innovative functionality (e.g., only one market; however, social and economic pressures location sensitivity). However, it is likely that general com- have resulted in multiple-market ecosystems. Multi-market puting will follow suit. Smartphone apps share much in environments limit, and in some cases eliminate, valuable se- common with Web apps running within a browser, and re- curity characteristics provided by the market model, includ- cent market statistics report more smartphones are sold per ing kill switches and developer name consistency (integrity). month than PCs [19], indicating a new breed of users whose We outline a novel approach to retaining single-market se- only exposure to computing is the app-centric model. curity semantics while enabling the flexibility and independence of a multi-market environment. We propose Stratus Application markets, also known as \app stores," provide as an abstract, security-enhancing, application installation one-click software installation. Markets serve as a central model that leverages information from a configurable set point of app distribution, sales, discovery, and installation. of security information sources. Information source content They have become hugely successful on smartphone plat- ranges from simple statistics to expert ratings for a spe- forms: they are the de facto method of installing apps. Much cific application domain. The Stratus approach provides of the success of application markets can be attributed to valuable decision-making criteria useful not only for smart- their ease of use for both developers and consumers. On phone users, but technology consumers as a whole, as new the developer front, markets simplify app distribution and and existing computing environments, including for desk- sales; on the consumer front, on-phone market interfaces al- top software, converge on a market-like model for software low wireless app discovery and installation. installation. A single, central application market offers an opportunity 1. INTRODUCTION to improve consumer security. Thus far, this model has ex- hibited two clear advantages. First, it provides a means to Consumer computing as we know it is currently undergoing remotely uninstall distributed apps later identified as mali- a transition. The emerging software ecosystem frequently cious. On multiple occasions, Google has exercised so called commoditizes functionality into discrete, purpose-driven ap- \kill switch"functionality for its Android Market [4, 12]. Kill plications. These applications, colloquially known as \apps," switches provide faster clean-up than traditional antivirus consist of both stand-alone utilities and front-ends to Internet- software, as they push actions to devices and do not require based services. Apps are plentiful, diverse, and frequently definition updates or resource intensive scanning. Second, redundant. For example, a smartphone app consumer is of- search results present consistent developer names for appli- ten presented several, if not tens, of options when searching cations.1 Once a developer has registered with the mar- for to-do lists, location-aware utilities, and games. ket, controls exist such that no other developer can easily distribute applications under that developer name. Hence, Smartphones are at the forefront of this computing transi- consumers have some assurance that all applications pro- tion. In the smartphone environment, the purpose-driven vided by\John Smith"are provided by the same John Smith. ∗Version: April 22, 2011. While this characteristic does not ensure that \John Smith" Contact author: [email protected] is the John Smith the consumer intended, it does allow the market to apply sanity checks for well known, high-impact entities, e.g., \Bank of America." As an aside, we note that while some believe security vetting is a valuable attribute of a central market, the practical effectiveness and scalability of certifying apps against security requirements is uncertain at best [14]. 1When corporations commission developers to create smartphone applications the corporation name may be listed rather than the developer name. 1 For several smartphone platforms, a multiple-market ecosys- and application databases are polled, kill switch au- tem is emerging. A multiple-market environment is an in- thorities push information to devices. Depending on evitable response to social and economic pressures. For ex- consumer privacy requirements, the kill switch author- ample, Apple is frequently chastised for denying distribu- ity may maintain a per-device list of installed apps to tion of apps that do not meet its moral code [5]. Even in more efficiently manage kill switches for target devices. an environment with minimal restrictions such as the An- droid Market, multiple markets are emerging. For example, the Amazon Appstore offers sales and anti-piracy mecha- A fundamental goal of our approach is to connect digital nisms, and the MiKandi market publishes adult applications properties such as package signatures to human evaluable deemed inappropriate for the official Android Market. How- information such as developer and application names. Note ever, while this flexibility and independence provides social that some goals sought by the creators of public key infras- and economic benefits, it undercuts valuable security prop- tructures (PKIs) often overlap with this goal, and numerous erties such as kill switches and developer name consistency. specific instances of PKIs have failed to meet the needs of users [8]. However, the characteristics of app distribution In this paper, we consider the convergence of one-click in- potentially make this goal more tractable, and we seek to stallation and multiple software distributors. Specifically, we centrally facilitate a distributed system, as opposed to the seek to answer two questions: 1) What security is sacrificed centralized control of typical PKI systems. Here, our key by moving to a multiple-market ecosystem? 2) How do we observations are that 1) name collisions should be minimal, achieve single market security semantics while retaining the i.e., given sufficient precision when identifying developers flexibility and independence provided by a multiple-market and applications, unintentional name collisions will be rare; setting? Our proposed solution enhances app installation and 2) name collisions should in fact raise suspicion, i.e., the with an extensible set of configurable security information more frequent cause of a name collision is malicious substi- sources and kill switch authorities. Information sources pro- tution of an app. vide diverse characteristics, ranging from app age, frequency of updates, and number of downloads to expert ratings on Note that while our approach mitigates many threats in- the app and other apps by the developer. On the other troduced by a multiple-market ecosystem, it cannot address hand, kill switch authorities allow consumer devices to be all threats. In particular, our architecture cannot automat- configured to subscribe to notifications of dangerous apps ically determine the most (or least) secure application for a for removal. Such a decentralized architecture is valuable specific task. This is a fundamental problem of app distri- not only for smartphones, but also tablets, netbooks, and bution even for single-market ecosystems, and is outside the computing devices in general as software distribution and scope of this paper. installation inevitably converges in the direction of application markets; for example, Apple has already introduced an We believe our proposed architecture for multiple-market App Store for Mac OS X. app distribution is a valuable step moving forward. How- ever, we believe our main contribution will end up being Our security-enhanced installation architecture, Stratus, is stimulation of alternate solutions meeting many of the re- based upon four fundamental underlying concepts: quirements we have identified, including several elements of our proposed solution, rather than one specific solution pro- posal itself. Indeed, many design details are needed to prac- • Universal application identifiers: We propose the tically instantiate such a model. We realize that a handful use of UAppIDs that incorporate not only the applica- of university researchers alone are not in a position to suc- tion and developer names, but also the cryptographic cessfully deploy such a system and hope that this paper is hash of the application and related signing key infor- viewed as a call to arms motivating mobile platform man- mation. UAppIDs enable security information sources ufacturers, and others who may gain from a robust global and kill switch authorities to reliably identify app in- software distribution infrastructure. stances. • Developer registries: The first general type of secu- The remainder of this paper proceeds as follows. Section 2 rity information source

Load more