DroidPosture: A Trusted Posture Assessment Service for Mobile Devices

Mobile devices such as smartphones are becoming the majority among computing devices. Currently, millions of persons use such devices to store and process personal data. Unfortunately, smartphones running Android are increasingly being targeted by hackers and infected with malware. Antimalware software is being used to address this situation, but it may be subverted by the same malware it aims to detect. We present DROIDPOSTURE, a posture assessment service for Android devices. This service aims to securely evaluate the level of trust we can have on a device (assess its posture) even if the mobile OS is compromised. For that to be possible, DROIDPOSTURE is protected using TrustZone, a security extension for ARM processors. DROIDPOSTURE is configurable with a set of application and kernel analysis mechanisms that enable detecting malicious applications and rootkits. We implemented a DROIDPOSTURE prototype using a hardware board with an ARM processor with TrustZone, and evaluated its performance and security.