Mobile Security

About the course

This advanced lecture deals with different fundamental aspects of mobile operating systems and application security, focusing strongly on the popular, open-source Android OS and its ecosystem. In general, the students' awareness and understanding of security and privacy problems in this area are increased. The students learn to tackle current security and privacy issues on smartphones from the perspectives of different security principals in the smartphone ecosystem: end-users, app developers, market operators, system vendors, and third parties (like companies).

The central questions of this course are:

• What is the threat model from the different principals' perspectives?
• How are the fundamental design patterns of secure systems and security best practices realized in the design of smartphone operating systems? And how does the multi-layered software stack (i.e., middleware on top of the OS) influence this design?
• How are hardware security primitives, such as Trusted Execution Environments and trusted computing concepts, integrated into those designs?
• Which problems and solutions did security research in this area identify in the past half-decade?
• Which techniques have been developed to empower the end-users to protect their privacy?

The lectures are accompanied by exercises to reinforce the theoretical concepts and to provide an environment for hands-on experience for mobile security on the Android platform.

See also the lecture schedule.

Where and when

The lectures will take place in the form of a flipped classroom. Lecture videos will be posted online before the class (ca. one week), and the lecture slots will be used to answer and discuss questions about the lecture content. This discussion takes place as a hybrid event with physical attendance at UdS every Friday from 10:00 – 12:00 and a Zoom meeting for online/remote attendance. Please consult the lecture schedule for video links and Zoom links.

The lectures will take place between 13.10.2025 and 30.01.2026 (i.e., the overlap in lecture periods between Saarland University, Technical University Dortmund, and Leibniz University Hannover).

Prerequisites

There are no formal requirements for participation. Students who want to participate in the course should

• have worked with a smartphone before (e.g., own an Android-based phone, iPhone, etc.)
• be familiar with programming in Java

Actual programming experience on Android or at the OS level is not a prerequisite, but definitely an advantage.

Background in security is also an advantage (e.g., prior participation in the Foundations of Cybersecurity lecture or Security core lecture). However, this lecture will provide the necessary knowledge of system design, access control, and network security to better contextualize Android's design choices.

Requirements for obtaining credit points (Scheinvergabe)

To pass the course, you need the following minimum number of points:

• 50% of the points from the final exam.

The final grade is based purely on your exam results.

Registration

For all students

Register for the course here in the CISPA CMS. The course will be centrally managed via the CMS (e.g., announcements, course materials, askbot, etc.). Registration closes with the midterm test!

For students of Saarland University

Don't forget to register for the exam in the LSF.

For students of Leibniz University Hannover

Don't forget to register for the course and exam in the QIS.

For students of Technical University Dortmund

Don't forget to register for the course and exam in BOSS.