Smartphones with no doubt became an integral part of our everyday life. At the same time, they contain the most sensitive information like your passwords, bank details and private files, which we want to keep secure at all time. Taking into account the variety of numerous models of Smartphones on the market, making each one of them secure is a rather challenging task to do! Aravind Machiry, a PhD student at the University of California, Santa Barbara, have shared his thoughts on how we can accomplish a better security of our beloved smartphones.

Your area of research is static and dynamic program analysis. How is it used in domain of Information Security?

Program analysis deals with understanding properties of a "program". Techniques based on program analysis are extensively used in various areas of information security like malware analysis, vulnerability detection, automated exploitation, exploitation hardening etc.

What are the main challenges in securing smartphone systems?

There are many challenges, and the order of these depends on the person you ask. IMHO, following are the two main challenges.

Variance: There are over 100 different companies manufacturing smartphones having different system software configuration. This poses a huge challenge in ensuring that all the smartphones are running the latest, updated software versions.

Secure storage: Smartphones contain a lot of user’s private and secret information like Bank tokens, passwords, photos, etc. The security of this information largely depends on the corresponding apps. Many apps do not handle this information correctly, which leads to vulnerabilities using the information that could be stolen. Ensuring that all the apps handle the sensitive information securely is a hard problem to solve.

What steps the manufacturers could take to improve smartphone security?

First, Updates, Updates, and Updates: Make sure that you push all the applicable patches from Android Security Bulletin to your repository.

Second, if you have a private app store, have protections in place to prevent malware from entering into it.
Third and most important one, run DR.CHECKER and DIFUZE on your drivers :)

You will present two tools at nullcon: DR.CHECKER and DIFUZE. What makes them different from other existing tools on the market?

Unlike the other general vulnerability detection or fuzzing tools, DR.CHECKER and DIFUZE are specifically designed to analyze Kernel drivers, particularly Linux kernel drivers. These tools gain their effectiveness by exploiting the modularity and common kernel interface of the drivers.

Why do you think it’s important for people to attend events like nullcon?

Nullcon provides a unique platform for researchers, industry folks, and students to come together to learn, exchange ideas, explore industry opportunities and present their work.

The conference schedule is top-notch, with talks spanning almost all the areas of information security.

All trainings are interesting and provide a great environment, especially for the students, to learn hands- on techniques with world-renowned InfoSec experts.

To top it off, the location - Goa - is an amazing place to visit and cool off some steam :)

Aravind will present his talk “Unleashing D* on Android Kernel Drivers” at nullcon Goa 2018. Make sure to stop by if it’s your topic of interest.

Interview by Yuliya Pliavaka.