论文标题
经验报告有关保护智能手机免受零点击攻击的挑战和机遇的报告
Experience Report on the Challenges and Opportunities in Securing Smartphones Against Zero-Click Attacks
论文作者
论文摘要
零单击的攻击不需要用户互动，通常会在即时聊天应用程序（例如WhatsApp和iMessage）中利用零日（即未拨打）漏洞，以获得对受害者智能手机的根访问权限，并脱离敏感数据。在本文中，我们报告了试图确保智能手机免于零点击攻击的经验。我们首先列举了我们认为需要的几个属性，以防止对智能手机的攻击，我们解决了问题。然后，我们创建了一个满足所有已确定属性的安全设计，并尝试使用现成的组件来构建它。我们的关键想法是将攻击表面从用户的智能手机转移到一个沙盒虚拟智能手机生态系统中，每个聊天应用程序都会隔离运行。我们建立的系统的性能和可用性评估突出了几个缺点以及确保现代智能手机免受零单击攻击的基本挑战。在这份经验报告中，我们讨论了我们学到的课程，并分享有关丢失的组件的见解，以实现对现代移动设备的零点击攻击所必需的安全性。
Zero-click attacks require no user interaction and typically exploit zero-day (i.e., unpatched) vulnerabilities in instant chat applications (such as WhatsApp and iMessage) to gain root access to the victim's smartphone and exfiltrate sensitive data. In this paper, we report our experiences in attempting to secure smartphones against zero-click attacks. We approached the problem by first enumerating several properties we believed were necessary to prevent zero-click attacks against smartphones. Then, we created a security design that satisfies all the identified properties, and attempted to build it using off-the-shelf components. Our key idea was to shift the attack surface from the user's smartphone to a sandboxed virtual smartphone ecosystem where each chat application runs in isolation. Our performance and usability evaluations of the system we built highlighted several shortcomings and the fundamental challenges in securing modern smartphones against zero-click attacks. In this experience report, we discuss the lessons we learned, and share insights on the missing components necessary to achieve foolproof security against zero-click attacks for modern mobile devices.
