A Comprehensive Study of Mobile Application Security in the Modern Era

Desklib provides past papers and solved assignments for students. This essay explores mobile app security threats and defenses.

APP DEVELOPMENT FOR MOBILE PLATFORMS

Contents
Table of Figures...............................................................................................................................3
Introduction......................................................................................................................................4
Mobile Application Security............................................................................................................5
The vulnerability of mobile applications.........................................................................................6
Malicious Behavior..........................................................................................................................6
Detection Techniques......................................................................................................................8
Defense Methodology....................................................................................................................10
Conclusion.....................................................................................................................................13
References......................................................................................................................................14

Table of Figures
Figure 1: Diallerware attack............................................................................................................6
Figure 2: Malware detection techniques..........................................................................................7
Figure 3: Cloud-Based Detection system........................................................................................8
Figure 4: The stakeholder’s cooperation as defense methods.......................................................10

Introduction
This scholarly essay will be based on the research and finding by different authors on mobile
security applications. The essay will describe the mobile application security the detection
methods and the defensive methods that are needed for the malicious activities on the mobile
applications. The essay will provide a detailed explanation of the recent technologies and models
that are developed by different researchers and are explained in the journal by different authors.
The essay will reflect different ideas and comparison of different defensive techniques and
detection techniques for the detection of mobile application techniques.

Mobile Application Security
Development of mobile application is the rising segment of the global market of the mobile
market. Mobile applications are evolving to give better and faster user experiences. But security
is one of the main concerns for the computing systems. Lin, Huang, Wright, and Kambourakis
have highlighted the major worm attack in the 1980s on the mainframe machines. Computers
have changed and evolved a lot after the Morris worm attack but the threats are not been
eliminated completely that leads to the exponential growth of the cyber threats and malware from
the benefits that are earned by the launching of attacks. Computing has shifted itself to the
mobile platforms so the malware and the cyber attacks have shifted them to the mobile
computing. The increasing use of mobile devices has increased the security issue of mobile
devices as mobile devices contain a lot of personal information's that attracts the attacker seeking
financial gains. From different research conducted by the authors has highlighted that most of the
attacks are for fetching the personal information’s and for tracking the users. This security issue
is been complicated by the fact that the mobile devices have restricted interface of the users and
have limited computing power that provides the hackers the flexibility to hide their malicious
activities. Research by the authors has highlighted the fact that Android devices are the biggest
target from 2013 and F-secure3 reported that the mobile malware samples or incidences are been
increasing and it reached from a hundred to around 50,000 in just5 a span of 2 years. Further He,
Chan and Guizani provided with more research data on the growing security attacks of the
mobile phones with data from International Data Corporation (IDC) and BYOD. They explained
the malware of mobile derives in a more understandable manner with more practical examples.
The authors explained the malware practices in the mobile devices are due to the downloading of
the malware infected applications that are supported by a survey that shows that
267,259 applications are malware affected and among them, 254,158 is Android malware
affected. The survey also suggested that the mobile application malware is increased by 614
percentages from 2012. This journal reflected various ways of malware infections as macros of
the saved file, some malware is installed during some known threats or vulnerabilities that exist
in the mobile platforms or network devices; some are infected by the multimedia messages of a
mobile device or from the email attachments.

The vulnerability of mobile applications
This journal by the authors He, Chan and Guizani also highlighted the basic cause for the
vulnerability of the Smartphones towards malicious functions. The first reason given by the
authors is the storage of the personal data including the financial transactions from where the
hackers can gain substantial financial information’s. The second reason highlighted by them is
the increasing number if the android based mobile phone as Android has a policy of open source
kernel which provide the hackers a better and deeper understanding of the Smartphone platform.
They discussed the Google marketing strategy that encourages the publishing of the third-party
applications and Google marketing strategy made the publication of the application easier for
gaining good share in the market but this strategy opens opportunities for the hackers to create
and publishes the mobile malware. The third reason for the vulnerability of mobile phones
towards the malware function is unawareness among the users about the cyber attacks related to
the applications of the mobile phones (He, Chan and Guizani, 2015)
Malicious Behavior
The malware behaviors are well explained by the authors He, Chan and Guizani in their journal.
They characterized the malware activities according to the remote control behavior, malicious
attach behavior and propagation behavior. The transmission of the malware to the victims is
explained by the propagation behavior. The further exploitation of the infected device by the
remote server is indicated by the remote control behavior and the attack behavior explains how
the malware after affecting a victim keep on attacking the device from different channels (He,
Chan and Guizani, 2015). The detection of the malware behavior is explained by the authors Lin,
Huang, Wright, and Kambourakis in their journal that explained the traditional approach of the
malware detection that involves static techniques, dynamic techniques or even both. The authors
discussed the Alterdroid tool that is used for the detection of malware activities. The tool
basically evaluated the modified application and the original application in the android
containers and detects the malicious behavior of the device by the use of the differential analysis
analyzing the execution traces (Lin, Huang, Wright, and Kambourakis, 2014). Types of malware
behaviors are highlighted by He, Chan and Guizani in their journal but the journal by Lin,

Huang, Wright, and Kambourakis only provided with the detection method of the malware
functions. The malware behaviors that are explained by He, Chan and Guizani are:
 Phishing attack: The hacking of the user credentials such as the account details and
credit card information through emails, SMS etc is termed as a phishing attack.
 Spyware: The extraction of the personal information from the monitoring of the
activities of the user in the smartphones is known as spyware and it does not focus on
specific victims.
 Diallerware attack: Money of the users is stolen with the use of the malware for
converting the hidden calls to SMS services or premium numbers.
Figure 1: Diallerware attack
Source: (He, Chan and Guizani, 2015)
 Surveillance attack: By the use of the built-in sensors the user are kept in the
surveillance through the infected Smartphones of the user.
 Financial malware attack: The attack on the credential of the users from the mobile
phones or by performing attacks on the financial application of the mobile phones.
Financial information's are attacked in a financial malware attack.
 Worm based attacks: The securities of the mobile phones are damaged by the worm-
based attacks. It can duplicate itself without the use of any user intervention and can
propagate to different devices through the use of the existing networks. The
virtualization technology of the Smartphone's increase the event of worm-based attacks.
 Botnets: Botnets comprises of a set of devices that work as a zombie for the hackers and
are controlled by the hackers. Denial of the service attack or illegal collections of the
data is some of the examples of such attacks.

The authors of this journal also highlighted the challenges that mobile security face compared to
traditional computers security. They explained three effecting factors:
 Mobility: Mobile devices are mobile that is it is carried by the user so there raise the risk
of the device being stolen or being physically tempered.
 Strong Connectivity: By the user of the Smartphone the users can access to various suites
which enable the attack of different malware through different network channels.
 Strong personalization: The user of the mobile device is its unique user (He, Chan and
Guizani, 2015).
Detection Techniques
The authors He, Chan and Guizani explained the hierarchal classification of the techniques for
the detection of the malware.
Figure 2: Malware detection techniques
Source: (He, Chan and Guizani, 2015)
They categorized the detection techniques as signature based and anomaly based technique. The
signature-based malware functions basically capture the malware from the signature of the
malware. It detects the malware on the identification of the signatures. The anomaly-based
technique involves the modeling of the normal system behaviors and the detection of the
malware is done from the deviation of the system behavior from the behavior that is modeled.
Further, the authors categorized the malware detection based on the execution into network

detection and client detection. Client detection is based either on host or cloud-based. The
security vendors nowadays provide with antivirus software's that offers the same functions as in
desktop antivirus. So, mostly the signature-based malware detection tool is used nowadays. The
efficiency of the malware detection technique depends on the up to date database that depends on
the availability of this database. The static scanning requires storage of a huge database. The size
of the database is reduced by the use of single or same signature for all the variants of the same
malware. The drawback of signature-based malware detection technique is susceptibility towards
obfuscation. Metamorphism or polymorphism techniques are been used by the creators of the
malware to evade the detection of malware by static techniques of malware detection. So to
overcome the problem cloud-based approach is suggested by the authors.
Figure 3: Cloud-Based Detection system
Source: (He, Chan and Guizani, 2015)
It involves the offloading of the intensive computations that help in the heterogeneous detection
of the malware devices. As cloud-based approach consist of multiple engines for scanning and
detection of anomaly or signature. The author discussed Secloud which is a cloud-based malware
system developed by Zonouz et al. This cloud-based malware system basically works by
continuously feeding the network device network connections and inputs for the cloud. It
basically focuses on the intensive resource security on the emulated device. Another malware
detection method is the network malware detection scheme which captures the traffic of the
network and then detects the malicious activity or events that arise from the mobile phones. This
journal explained the different models that are developed for the detection of the malware

activities, Nadji et al. designed a malware detection prototype Airmid that responds and detect to
the malware activities in mobile phones in a continuous manner (He, Chan and Guizani, 2015)).
Both the journals by He, Chan and Guizani and by Lin, Huang, Wright, and Kambourakis
explained the static and dynamic analysis of the malware detection. Static analysis of mobile
application involves the analysis of the malware without the execution of the application and the
codes, just on the basis of the analysis. The static analysis of malware detection involves three
steps unpacking of the malware, dissembling, and analysis of the malware detected. It is a simple
and fast process of detecting a malware function. Dynamic analysis of the malware function
involves the evolution of the malware in an isolated environment in a continuous manner.
Dynamic analysis helps in collecting and analyzing the runtime information of the application
that includes the system calls and the events. Static analysis of malware function focuses on the
events that are being accessed and the dynamic analysis of malware function focuses on the
reason of performing the suspicious operations and the intervals of their performance (Lin,
Huang, Wright and Kambourakis, 2014).
Defense Methodology
The authors of the journals provided different defense methodology to prevent the malware
actions. Lin, Huang, Wright, and Kambourakis explained three approaches to prevent mobile
malware activities, jailbreaking and rooting, application store security and BYOD paradigm.
Rooting and jailbreaking basically does an evaluation on the realistic malware and exploits the
handwritten demos that produce a more secure environment for the rooted devices. Application
store security basically expands the frontier of the ecosystem of the Smartphone's like the
security does not depend only on the Smartphone device it also involves the safety and security
of the entire environment and entire operation. Device agnostic approach is been used by the
authors which demonstrates the objectives of security, friendliness, and usability simultaneously.
The application store is a system that contains interesting security features that contain multilevel
authorization, application reputation scoring, identity management, and gesture navigation. The
expansion of smartphones leads to the trend of BYOD that enables the employees of an
organization to use and bring their private devices to the workplace. The authors describe the
BYOD paradigm and the challenges that it is creating in the balance of security and convenience.

BYODroid is an application that is launched for solving the problems of challenges that are
faced regarding balancing security and convenience in the BYOD paradigm and also provide
with the solution to the Android malware threats (Lin, Huang, Wright, and Kambourakis, 2014).
Further, the preventive measures that are given by the authors He, Chan and Guizani contain
two level strategies. The first level method basically aims to restrict the malware in getting in
contact with the Smartphones. Sand the second level method contains the malware detection
tools that basically detect the existence of any malware. On the detection of the malware first, the
malware is removed and then the system is cleaned up. Based on the general scenarios the
authors discussed the preventive measures for malware function in mobile application and
categorized the three main areas where preventive measures can help in the mobile application
security, application developers, app market administrators, and users.
Figure 4: The stakeholder’s cooperation as defense methods
Source: (He, Chan and Guizani, 2015)
Application developers need to ensure that the app that they are developing is according to the
security policies that it does not permit any access to the unnecessary information’s that will
prevent the malware in exploiting the security weakness of others applications in launching
attacks. App market must vet the application that is uploaded for the removal of the suspicious
applications. Server-side vetting is a recent process that is developed for the detection of
malicious activities from the application market and then removing the malicious activities. The
security policies of the administrators help in the security of the application developer.
Smartphones users are the third group in the defense mechanism against the malicious activities

of the mobile application. Smartphone users need to implement a strong framework of the anti-
malware system. Phishing effect can be prevented on the smartphones by avoiding the emails
that contain hyperlinks, blacklisting the methods that ask for the verification of human, filtering
based on content and whitelisting of the websites. Use of anti-spyware for the scanning of the
smartphones is another defensive method to prevent malicious activities on the mobile
application (He, Chan and Guizani, 2015).