Mobile Security

About the course

This advanced lecture deals with different fundamental aspects of mobile operating systems and application security, focusing strongly on the popular, open-source Android OS and its ecosystem. In general, the awareness and understanding of the students for security and privacy problems in this area are increased. The students learn to tackle current security and privacy issues on smartphones from the perspectives of different security principals in the smartphone ecosystem: end-users, app developers, market operators, system vendors, and third parties (like companies).

The central questions of this course are:

• What is the threat model from the different principals' perspectives?
• How are the fundamental design patterns of secure systems and security best practices realized in the design of smartphone operating systems? And how does the multi-layered software stack (i.e., middleware on top of the OS) influence this design?
• How are hardware security primitives, such as Trusted Execution Environments and trusted computing concepts, integrated into those designs?
• Which problems and solutions did security research in this area identify in the past half-decade?
• Which techniques have been developed to empower the end-users to protect their privacy?

The lectures are accompanied by exercises to reinforce the theoretical concepts and to provide an environment for hands-on experience for mobile security on the Android platform.

See also the lecture schedule.

Where and when

The lectures will take place in the form of a flipped classroom. Lecture videos will be posted online before the class (ca. one week), and the lecture slots will be used to answer and discuss questions about the lecture content. This discussion takes place as a hybrid event with physical attendance at UdS every Friday from 10:00 – 12:00 and a Zoom meeting for online/remote attendance. Please consult the lecture schedule for video links and Zoom links.

The lectures will take place between 18.10.2024 and 31.01.2025 (i.e., the overlap in lecture periods between Saarland University and Leibniz University Hannover).

Prerequisites

There are no formal requirements for participation. Students who want to participate in the course should

• have worked with a smartphone before (e.g., own an Android-based phone, iPhone, etc.)
• be familiar with programming in Java

Actual programming experience on Android or at the OS level is not a prerequisite but definitively an advantage.

Background in security is also an advantage (e.g., prior participation in the Foundations of Cybersecurity lecture or Security core lecture). However, the necessary knowledge of system design, access control, and network security will be provided in this lecture to put Android's design choices better into context.

Requirements for obtaining credit points (Scheinvergabe)

To pass the course, you need the following minimum amount of points:

• 50% of the points from the final exam.

The final grade is based purely on your exam results.

Registration

For all students

Register for the course here in the CISPA CMS. Registration will open on October 01, 2024.

For students of Saarland University

Don't forget to register in the LSF for the exam.

For students of Leibniz University Hannover

Don't forget to register in the QIS for the course and exam.