DOCSLIB.ORG

Open Dissertation-Wenhuihu.Pdf

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
Open Dissertation-Wenhuihu.Pdf The Pennsylvania State University The Graduate School THIRD-PARTY LIBRARY SECURITY MANAGEMENT FOR MOBILE APPLICATIONS A Dissertation Document in Computer Science and Engineering by Wenhui Hu c 2016 Wenhui Hu Submitted in Partial Fulfillment of the Requirements for the Degree of Doctor of Philosophy December 2016 The dissertation document of Wenhui Hu was reviewed and approved∗ by the following: Patrick D. McDaniel Distinguished Professor of Computer Science and Engineering Dissertation Co-Advisor, Co-Chair of Committee Peng Liu Professor of Information Sciences and Technology Dissertation Co-Advisor, Co-Chair of Committee Trent R. Jaeger Professor of Computer Science and Engineering Constantino Lagoa Professor of Electrical Engineering Damien Octeau Postdoctoral Scholar, University of Wisconsin and Pennsylvania State University Special Member Chita R. Das Distinguished Professor of Computer Science and Engineering Interim Head of the Department of Computer Science and Engineering ∗Signatures are on file in the Graduate School. Abstract In recent years, the Android operating system has had an explosive growth in the number of applications containing third-party libraries for different purposes. In this thesis, we identify three library-centric threats in the real-world Android application markets: (i) the library modification threat, (ii) the masquerading threat and (iii) the aggressive library threat. These three threats cannot effectively be fully addressed by existing defense mechanisms such as software analysis, anti-virus software and anti-repackaging techniques. The limitation of existing mechanisms is that the existing mechanisms ignore the fact the library and applications coexist, but are from different stakeholder in the ecosystem. For existing libraries, related security problems in applications, we propose a li- brary integrity verification tool for Android applications at application stores. This is non-trivial because the Android application build process merges library code and application-specific logic into a single binary file. Our approach uses reverse-engineering to achieve integrity verification. The evaluation results also provide empirical insight into the library integrity situation in the wild. In addition, third-party libraries are detected to contain potentially malicious behav- iors. With the Android security model, the core logic and the third-party library share permissions. Solutions are provided to enforce library isolation. Unfortunately, libraries in the isolation still share some permissions with the core logic. In order to generate distinct policies for third-party libraries, we need to know which part of libraries works for the core logic. Existing analysis tools cannot differentiate libraries' behaviors assisting for the appli- cation's main functionality from libraries' behaviors for itself because of two limitations: 1) the analysis cannot do backwards analysis; 2) the analysis cannot distinguish different stakeholders within one application. This shortcoming leads to the difficulty of creating a precise policy for library isolation solutions. The missing part is the intra-app cross- stakeholder data-flow analysis. To address it, we propose a callsite-aware bidirectional static analysis tool. The tool enables to classify the Android framework APIs in libraries into six categories. The classification information can be used to generate polices. The dissertation also has an enforcement of the library isolation. iii Table of Contents List of Figures viii List of Tables ix Acknowledgments xi Chapter 1 Introduction1 1.1 Library-Centric Security Threats...................... 2 1.2 Library based Isolation............................ 3 1.3 Thesis Statement............................... 4 1.4 Threat Models ................................ 5 1.4.1 The Threat Model of the Library Integrity Verification...... 5 1.4.2 The Threat Model of the Policy Generation............ 6 1.5 Contributions................................. 7 Chapter 2 Preliminary Concepts9 2.1 Libraries in Android............................. 9 2.1.1 Android Application Compilation.................. 11 2.1.2 Library Post-Processing....................... 11 2.2 Limitation of Android Security Model ................... 12 2.2.1 Android Security Model....................... 12 2.2.2 Madware and application developers................ 12 2.3 Relationship between Library and Application Logic........... 13 Chapter 3 Related Work 14 3.1 Smartphone Platform Security ....................... 14 3.2 Application Behavior Modification..................... 15 3.3 Android Application Library ........................ 16 3.3.1 Library Detection .......................... 16 3.3.2 Advertising Library ......................... 16 iv 3.3.3 Library Removal........................... 17 3.3.3.1 Native Library....................... 17 3.3.3.2 Other Approaches..................... 18 3.4 Information Flow Analysis Tools ...................... 18 3.5 Isolation.................................... 19 3.6 Other Security Solutions to Android Applications............. 19 3.6.1 Repackaging ............................. 19 3.6.2 Code Clones ............................. 20 3.6.3 Inline reference monitors for Java applications .......... 20 3.7 Malware Detection.............................. 20 Chapter 4 Duet: Library Integrity Verification 21 4.1 Introduction.................................. 21 4.2 Security Model and Problem Statement .................. 24 4.2.1 Security Model............................ 24 4.2.2 Problem Statement.......................... 26 4.2.3 Use Cases............................... 26 4.3 System Overview............................... 27 4.3.1 Naive Solutions and Challenges for Store Side Verification . 27 4.3.2 Our Idea (Double Reverse-Engineering).............. 28 4.3.3 Architecture of Duet......................... 28 4.3.4 Why this solution works? ...................... 30 4.4 Design and Implementation......................... 30 4.4.1 Reverse-Engineering Requirements................. 30 4.4.1.1 Potential Attack Surface ................. 31 4.4.2 Building the Reference Database.................. 32 4.4.2.1 Canonical Library Digest................. 32 4.4.2.2 Canonical File Digest................... 35 4.4.2.3 Issues............................ 35 4.4.3 Library Integrity Verification in Applications........... 36 4.5 Evaluation................................... 36 4.5.1 Libraries in Android Applications.................. 37 4.5.2 In-lab testing of the correctness of Duet.............. 40 4.5.3 In-the-wild Library Integrity Verification Results......... 40 4.5.4 Implications of Passing Rates.................... 44 4.5.5 Performance ............................. 44 4.6 In-depth Analysis of Applications that do not Pass Verification . 46 Chapter 5 Policy Generation for Library Isolation 49 5.1 Introduction.................................. 49 5.2 Background and Potential Applications .................. 53 5.2.1 Libraries for Android applications ................. 53 5.2.2 Dilemma for application developers................. 53 v 5.2.3 Applications of Intra-App Cross-Stakeholder Analysis . 54 5.3 Reducing Intra-App Cross-Stakeholder Module Relationship Analysis to a Data-Flow Analysis Problem ....................... 56 5.3.1 Definition of Intra-Application Modules.............. 56 5.3.2 Definition of Operations....................... 56 5.3.3 Data-flow Analysis for Read and Write Operations . 57 5.3.4 Understanding the Data-flow Analysis Results .......... 58 5.3.5 API Classification and Policy Generation ............. 61 5.4 System Overview............................... 62 5.4.1 Limitations.............................. 64 5.5 Bidirectional Callsite-aware Static Taint Analysis............. 64 5.5.1 Precise Modelling of Lifecycle.................... 64 5.5.2 Precise Bidirectional Taint Analysis ................ 64 5.5.2.1 IFDS Extension to Support Unbalanced Return Flows . 65 5.5.2.2 On-demand Forward Alias Analysis........... 65 5.5.2.3 Transfer Functions of Backwards Taint Analysis . 65 5.5.3 Callsite-Aware Extension ...................... 66 5.6 Evaluation................................... 66 5.6.1 RQ1: How serious is the intra-app cross-stakeholder security threats? 67 5.6.2 RQ2: What precision is achieved by the tool?........... 68 5.6.3 RQ3: Do we need a bidirectional static taint analysis tool? . 68 5.6.4 RQ4: How can this tool to classify the Android framework APIs in libraries of real Android applications?.............. 69 5.6.4.1 Summary of Classification Results............ 70 5.6.4.2 Results for each library Category............. 72 5.6.4.3 Overall Results....................... 77 Chapter 6 LibGuardian: Library Isolation 79 6.1 Introduction.................................. 79 6.2 Background.................................. 81 6.2.1 Stakeholders within the Ecosystem................. 81 6.2.1.1 Case Study: Advertising Library and Madware . 83 6.2.2 Problem Statement.......................... 83 6.2.3 Use Cases............................... 83 6.3 System Overview............................... 84 6.3.1 Design Choices............................ 84 6.3.2 Our Idea ............................... 85 6.3.3 Architecture of LibGuardian .................... 85 6.4 Design and Implementation......................... 86 6.4.1 Library Usage Analysis ....................... 86 6.4.2 Application Retrofit......................... 88 6.4.2.1 Android framework API Interception .......... 88 vi 6.4.2.2 Intercepted Method Handler Generation......... 88 6.4.2.3 Other
Load more

Recommended publications
  • Virtual Currencies and Terrorist Financing : Assessing the Risks And
    DIRECTORATE GENERAL FOR INTERNAL POLICIES POLICY DEPARTMENT FOR CITIZENS' RIGHTS AND CONSTITUTIONAL AFFAIRS COUNTER-TERRORISM Virtual currencies and terrorist financing: assessing the risks and evaluating responses STUDY Abstract This study, commissioned by the European Parliament’s Policy Department for Citizens’ Rights and Constitutional Affairs at the request of the TERR Committee, explores the terrorist financing (TF) risks of virtual currencies (VCs), including cryptocurrencies such as Bitcoin. It describes the features of VCs that present TF risks, and reviews the open source literature on terrorist use of virtual currencies to understand the current state and likely future manifestation of the risk. It then reviews the regulatory and law enforcement response in the EU and beyond, assessing the effectiveness of measures taken to date. Finally, it provides recommendations for EU policymakers and other relevant stakeholders for ensuring the TF risks of VCs are adequately mitigated. PE 604.970 EN ABOUT THE PUBLICATION This research paper was requested by the European Parliament's Special Committee on Terrorism and was commissioned, overseen and published by the Policy Department for Citizens’ Rights and Constitutional Affairs. Policy Departments provide independent expertise, both in-house and externally, to support European Parliament committees and other parliamentary bodies in shaping legislation and exercising democratic scrutiny over EU external and internal policies. To contact the Policy Department for Citizens’ Rights and Constitutional Affairs or to subscribe to its newsletter please write to: [email protected] RESPONSIBLE RESEARCH ADMINISTRATOR Kristiina MILT Policy Department for Citizens' Rights and Constitutional Affairs European Parliament B-1047 Brussels E-mail: [email protected] AUTHORS Tom KEATINGE, Director of the Centre for Financial Crime and Security Studies, Royal United Services Institute (coordinator) David CARLISLE, Centre for Financial Crime and Security Studies, Royal United Services Institute, etc.
    [Show full text]
  • Systematization of Vulnerability Discovery Knowledge: Review
    Systematization of Vulnerability Discovery Knowledge Review Protocol Nuthan Munaiah and Andrew Meneely Department of Software Engineering Rochester Institute of Technology Rochester, NY 14623 {nm6061,axmvse}@rit.edu February 12, 2019 1 Introduction As more aspects of our daily lives depend on technology, the software that supports this technology must be secure. We, as users, almost subconsciously assume the software we use to always be available to serve our requests while preserving the confidentiality and integrity of our information. Unfortunately, incidents involving catastrophic software vulnerabilities such as Heartbleed (in OpenSSL), Stagefright (in Android), and EternalBlue (in Windows) have made abundantly clear that software, like other engineered creations, is prone to mistakes. Over the years, Software Engineering, as a discipline, has recognized the potential for engineers to make mistakes and has incorporated processes to prevent such mistakes from becoming exploitable vulnerabilities. Developers leverage a plethora of processes, techniques, and tools such as threat modeling, static and dynamic analyses, unit/integration/fuzz/penetration testing, and code reviews to engineer secure software. These practices, while effective at identifying vulnerabilities in software, are limited in their ability to describe the engineering failures that may have led to the introduction of vulnerabilities. Fortunately, as researchers propose empirically-validated metrics to characterize historical vulnerabilities, the factors that may have led to the introduction of vulnerabilities emerge. Developers must be made aware of these factors to help them proactively consider security implications of the code that they contribute. In other words, we want developers to think like an attacker (i.e. inculcate an attacker mindset) to proactively discover vulnerabilities.
    [Show full text]
  • Internet Security Threat Report VOLUME 21, APRIL 2016 TABLE of CONTENTS 2016 Internet Security Threat Report 2
    Internet Security Threat Report VOLUME 21, APRIL 2016 TABLE OF CONTENTS 2016 Internet Security Threat Report 2 CONTENTS 4 Introduction 21 Tech Support Scams Go Nuclear, 39 Infographic: A New Zero-Day Vulnerability Spreading Ransomware Discovered Every Week in 2015 5 Executive Summary 22 Malvertising 39 Infographic: A New Zero-Day Vulnerability Discovered Every Week in 2015 8 BIG NUMBERS 23 Cybersecurity Challenges For Website Owners 40 Spear Phishing 10 MOBILE DEVICES & THE 23 Put Your Money Where Your Mouse Is 43 Active Attack Groups in 2015 INTERNET OF THINGS 23 Websites Are Still Vulnerable to Attacks 44 Infographic: Attackers Target Both Large and Small Businesses 10 Smartphones Leading to Malware and Data Breaches and Mobile Devices 23 Moving to Stronger Authentication 45 Profiting from High-Level Corporate Attacks and the Butterfly Effect 10 One Phone Per Person 24 Accelerating to Always-On Encryption 45 Cybersecurity, Cybersabotage, and Coping 11 Cross-Over Threats 24 Reinforced Reassurance with Black Swan Events 11 Android Attacks Become More Stealthy 25 Websites Need to Become Harder to 46 Cybersabotage and 12 How Malicious Video Messages Could Attack the Threat of “Hybrid Warfare” Lead to Stagefright and Stagefright 2.0 25 SSL/TLS and The 46 Small Business and the Dirty Linen Attack Industry’s Response 13 Android Users under Fire with Phishing 47 Industrial Control Systems and Ransomware 25 The Evolution of Encryption Vulnerable to Attacks 13 Apple iOS Users Now More at Risk than 25 Strength in Numbers 47 Obscurity is No Defense
    [Show full text]
  • Compromised Connections
    COMPROMISED CONNECTIONS OVERCOMING PRIVACY CHALLENGES OF THE MOBILE INTERNET The Universal Declaration of Human Rights, the International Covenant on Civil and Political Rights, and many other international and regional treaties recognize privacy as a fundamental human right. Privacy A WORLD OF INFORMATION underpins key values such as freedom of expression, freedom of association, and freedom of speech, IN YOUR MOBILE PHONE and it is one of the most important, nuanced and complex fundamental rights of contemporary age. For those of us who care deeply about privacy, safety and security, not only for ourselves but also for our development partners and their missions, we need to think of mobile phones as primary computers As mobile phones have transformed from clunky handheld calling devices to nifty touch-screen rather than just calling devices. We need to keep in mind that, as the storage, functionality, and smartphones loaded with apps and supported by cloud access, the networks these phones rely on capability of mobiles increase, so do the risks to users. have become ubiquitous, ferrying vast amounts of data across invisible spectrums and reaching the Can we address these hidden costs to our digital connections? Fortunately, yes! We recommend: most remote corners of the world. • Adopting device, data, network and application safety measures From a technical point-of-view, today’s phones are actually more like compact mobile computers. They are packed with digital intelligence and capable of processing many of the tasks previously confined
    [Show full text]
  • Mind the Gap: Dissecting the Android Patch Gap | Ben Schlabs
    Mind the Gap – Dissecting the Android patch gap Ben Schlabs <[email protected]> SRLabs Template v12 Corporate Design 2016 Allow us to take you on two intertwined journeys This talk in a nutshell § Wanted to understand how fully-maintained Android phones can be exploited Research § Found surprisingly large patch gaps for many Android vendors journey – some of these are already being closed § Also found Android exploitation to be unexpectedly difficult § Wanted to check thousands of firmwares for the presence of Das Logo Horizontal hundreds of patches — Pos / Neg Engineering § Developed and scaled a rather unique analysis method journey § Created an app for your own analysis 2 3 Android patching is a known-hard problem Patching challenges Patch ecosystems § Computer OS vendors regularly issue patches OS vendor § Users “only” have to confirm the installation of § Microsoft OS patches Patching is hard these patches § Apple Endpoints & severs to start with § Still, enterprises consider regular patching § Linux distro among the most effortful security tasks § “The moBile ecosystem’s diversity […] OS Chipset Phone Android contriButes to security update complexity and vendor vendor vendor phones inconsistency.” – FTC report, March 2018 [1] The nature of Telco § Das Logo HorizontalAndroid makes Patches are handed down a long chain of — Pos / Negpatching so typically four parties Before reaching the user much more § Only some devices get patched (2016: 17% [2]). difficult We focus our research on these “fully patched” phones Our research question –
    [Show full text]
  • Automating Patching of Vulnerable Open-Source Software Versions in Application Binaries
    Automating Patching of Vulnerable Open-Source Software Versions in Application Binaries Ruian Duan:, Ashish Bijlani:, Yang Ji:, Omar Alrawi:, Yiyuan Xiong˚, Moses Ike:, Brendan Saltaformaggio,: and Wenke Lee: fruian, ashish.bijlani, yang.ji, alrawi, [email protected], [email protected] [email protected], [email protected] : Georgia Institute of Technology, ˚ Peking University Abstract—Mobile application developers rely heavily on open- while ensuring backward compatibility, and test for unin- source software (OSS) to offload common functionalities such tended side-effects. For the Android platform, Google has as the implementation of protocols and media format playback. initiated the App Security Improvement Program (ASIP) [21] Over the past years, several vulnerabilities have been found in to notify developers of vulnerable third-party libraries in popular open-source libraries like OpenSSL and FFmpeg. Mobile use. Unfortunately, many developers, as OSSPolice [15] and applications that include such libraries inherit these flaws, which LibScout [4] show, do not update or patch their application, make them vulnerable. Fortunately, the open-source community is responsive and patches are made available within days. However, which leaves end-users exposed. Android developers mainly mobile application developers are often left unaware of these use Java and C/C++ [1] libraries. While Derr et al. [14] flaws. The App Security Improvement Program (ASIP) isa show that vulnerable Java libraries can be fixed by library- commendable effort by Google to notify application developers level update, their C/C++ counterparts, which contain many of these flaws, but recent work has shown that many developers more documented security bugs in the National Vulnerability do not act on this information.
    [Show full text]
  • VULNERABLE by DESIGN: MITIGATING DESIGN FLAWS in HARDWARE and SOFTWARE Konoth, R.K
    VU Research Portal VULNERABLE BY DESIGN: MITIGATING DESIGN FLAWS IN HARDWARE AND SOFTWARE Konoth, R.K. 2020 document version Publisher's PDF, also known as Version of record Link to publication in VU Research Portal citation for published version (APA) Konoth, R. K. (2020). VULNERABLE BY DESIGN: MITIGATING DESIGN FLAWS IN HARDWARE AND SOFTWARE. General rights Copyright and moral rights for the publications made accessible in the public portal are retained by the authors and/or other copyright owners and it is a condition of accessing publications that users recognise and abide by the legal requirements associated with these rights. • Users may download and print one copy of any publication from the public portal for the purpose of private study or research. • You may not further distribute the material or use it for any profit-making activity or commercial gain • You may freely distribute the URL identifying the publication in the public portal ? Take down policy If you believe that this document breaches copyright please contact us providing details, and we will remove access to the work immediately and investigate your claim. E-mail address: [email protected] Download date: 07. Oct. 2021 VULNERABLE BY DESIGN: MITIGATING DESIGN FLAWS IN HARDWARE AND SOFTWARE PH.D. THESIS RADHESH KRISHNAN KONOTH VRIJE UNIVERSITEIT AMSTERDAM, 2020 Faculty of Science The research reported in this dissertation was conducted at the Faculty of Science — at the Department of Computer Science — of the Vrije Universiteit Amsterdam This work was supported by the MALPAY consortium, consisting of the Dutch national police, ING, ABN AMRO, Rabobank, Fox-IT, and TNO.
    [Show full text]
  • Download Article (PDF)
    Proceedings of the 2nd International Conference on Computer Science and Electronics Engineering (ICCSEE 2013) Trust in Cyberspace: New Information Security Paradigm R. Uzal, D. Riesco, G. Montejano N. Debnath Universidad Nacional de San Luis Department of Computer Science San Luis, Argentina Winona State University [email protected] USA {driesco, gmonte}@unsl.edu.ar [email protected] Abstract—This paper is about the differences between grids and infrastructure for destruction [3]. It is evident we traditional and new Information Security paradigms, the are facing new and very important changes in the traditional conceptual difference between “known computer viruses” and Information Security paradigm. Paradigm shift means a sophisticated Cyber Weapons, the existence of a Cyber fundamental change in an individual's or a society's view of Weapons “black market”, the differences between Cyber War, how things work in the cyberspace. For example, the shift Cyber Terrorism and Cyber Crime, the new Information from the geocentric to the heliocentric paradigm, from Security paradigm characteristics and the author’s conclusion “humors” to microbes as causes of disease, from heart to about the new Information Security paradigm to be faced. brain as the center of thinking and feeling [4]. Criminal Authors remark that recently discovered Cyber Weapons can hackers could detect some of those placed “military logic be easily described as one of the most complex IT threats ever bombs” and use them for criminal purposes. This is not a discovered. They are big and incredibly sophisticated. They pretty much redefine the notion of Information Security. theory. It is just a component of current and actual Considering the existence of a sort of Cyber Weapon black Information Security new scenarios.
    [Show full text]
  • Alerta Integrada De Seguridad Digital N° 198-2020-PECERT
    Lima, 19 de octubre de 2020 La presente Alerta Integrada de Seguridad Digital corresponde a un análisis técnico periódico realizado por el Comando Conjunto de las Fuerzas Armadas, el Ejército del Perú, la Marina de Guerra del Perú, la Fuerza Aérea del Perú, la Dirección Nacional de Inteligencia, la Policía Nacional del Perú, la Asociación de Bancos del Perú y la Secretaría de Gobierno Digital de la Presidencia del Consejo de Ministros, en el marco del Centro Nacional de Seguridad Digital. El objetivo de esta Alerta es informar a los responsables de la Seguridad de la Información de las entidades públicas y las empresas privadas sobre las amenazas en el ciberespacio para advertir las situaciones que pudieran afectar la continuidad de sus servicios en favor de la población. Las marcas y logotipos de empresas privadas y/o entidades públicas se reflejan para ilustrar la información que los ciudadanos reciben por redes sociales u otros medios y que atentan contra la confianza digital de las personas y de las mismas empresas de acuerdo a lo establecido por el Decreto de Urgencia 007-2020. La presente Alerta Integrada de Seguridad Digital es información netamente especializada para informar a las áreas técnicas de entidades y empresas. Esta información no ha sido preparada ni dirigida a ciudadanos. PECERT │Equipo de Respuestas ante Incidentes de Seguridad Digital Nacional www.gob.pe [email protected] Contenido Vulnerabilidad de ejecución remota de código de Microsoft SharePoint .................................................... 3 Campaña de phishing que utilizan Basecamp ............................................................................................... 4 Nuevo archivo adjunto Windows Update del malware Emotet. .................................................................. 5 El malware Windows “GravityRAT” ahora también se dirige a Android, macOS .........................................
    [Show full text]
  • Ransomware Payments in the Bitcoin Ecosystem
    Ransomware Payments in the Bitcoin Ecosystem Masarah Paquet-Clouston Bernhard Haslhofer Benoît Dupont GoSecure Research Austrian Institute of Technology Université de Montréal Montreal, Canada Vienna, Austria Montreal, Canada [email protected] [email protected] [email protected] ABSTRACT the time of writing, there are 5051 known ransomware families de- Ransomware can prevent a user from accessing a device and its tected and almost all of them demand payments in Bitcoin [27], files until a ransom is paid to the attacker, most frequently in Bit- which is the most prominent cryptocurrency. coin. With over 500 known ransomware families, it has become Yet, global and reliable statistics on the impact of cybercrime in one of the dominant cybercrime threats for law enforcement, se- general, and ransomware in particular, are missing, causing a large curity professionals and the public. However, a more comprehen- misunderstanding regarding the severity of the threat and the ex- sive, evidence-based picture on the global direct financial impact tent to which it fuels a large illicit business. Most of the statistics of ransomware attacks is still missing. In this paper, we present available on cybercrime and ransomware are produced by private a data-driven method for identifying and gathering information corporations (cf. [29, 38, 39]) that do not disclose their underlying on Bitcoin transactions related to illicit activity based on foot- methodologies and have incentives to over- or underreport them prints left on the public Bitcoin blockchain. We implement this since they sell cybersecurity products and services that are sup- method on-top-of the GraphSense open-source platform and ap- posed to protect their users against such threats [23].
    [Show full text]
  • Malware Detection Techiniques and Tools for Android Mobile – a Brief Review
    International Journal of Latest Research in Engineering and Technology (IJLRET) ISSN: 2454-5031 www.ijlret.com || Volume 03 - Issue 03 || March 2017 || PP. 102-105 Malware Detection Techiniques and Tools for Android Mobile – A Brief Review Dr. Bhaskar V. Patil#1 #1Bharati Vidyapeeth University Yashwantrao Mohite institute of Management, Karad [M.S.], INDIA Dr. Rahul J. Jadhav#2 21Bharati Vidyapeeth University Yashwantrao Mohite institute of Management, Karad [M.S.], INDIA Abstract: Android has the biggest market share among all Smartphone operating system. The number of devices running with the Android operating system has been on the rise. By the end of 2012, it will account for nearly half of the world's Smartphone market. Along with its growth, the importance of security has also risen. Security is one of the main concerns for Smartphone users today. As the power and features of Smartphone’s increase, so has their vulnerability for attacks by viruses etc. Perhaps android is more secured operating system than any other Smartphone operating system today. Android has very few restrictions for developer, increases the security risk for end users. Antivirus Android apps remain one of the most popular types of applications on Android. Some people either like having that extra security or just want to be extra cautious just in case and there is nothing wrong with that. In this list, we’ll check out the best antivirus Android apps and anti-malware apps on Android! The efficacies of these applications have not been empirically established. This paper analyzes some of the security tools written for the Android platform to gauge their effectiveness at mitigating spyware and malware.
    [Show full text]
  • Choose Trend Micro for Internet Security, Nothing Comes Close
    TREND MICRO Choose Trend Micro for internet security, nothing comes close. for Security Trend Micro Titanium uses cloud technology to only Trend Micro™ Titanium™ delivers on everything automatically stop viruses and spyware before you’ve always wanted in an antivirus and internet they reach your computer so it won’t slow you security solution without the limitations and down. it’s a whole new way to protect your Pc. drawbacks of yesterday’s slow antivirus software. cloud technology: leverages trend Micro’s Smart Titanium Has What You Want Protection Network™ plus real-time antivirus scanning Strong, fast protection to provide always-on-guard protection to keep you uses lightning-fast cloud security technology safe from latest, ever-evolving malware threats and real-time antivirus scanning to proactively Automatic Protection: removes the guesswork of stop threats , without waiting for updates protecting your Pc, intelligently and immediately and downloads reacts to threats easy to use and understand internet security Simple installation: it takes just a few clicks Just set it and forget it Streamlined interface: it is easy to understand Light demands on your Pc’s resources and simple to manage it doesn’t affect computer performance the trend Micro titanium finally! internet security that does the job Cloud Security Advantage quickly and won’t drive you crazy. Nothing else titanium is powered by Trend Micro™ Smart Protection comes close to Titanium—in security, speed, Network™—the security infrastructure ranked #1 at or simplicity. stopping threats in cyberspace or “the cloud.” Smart • STRONG choose from three strong, fast, and easy-to-use Protection Network monitors the internet 24/7, • FAST options—based on your lifestyle and how you worldwide.
    [Show full text]