Colluding Apps: Tomorrow's Mobile Malware Threat

As efforts to detect individual malicious apps intensify, a new threat emerges: groups of apps that collude such that each plays a small, undetectable role in a larger malicious operation. Colluding apps can make themselves virtually undetectable by repurposing shared device resources for covert communication. Some possible directions for detecting colluding apps are proposed.

App Isolation and Interaction

Today's mobile OSs are designed with a focus on security. Android, the most popular mobile OS, isolates each app in an application sandbox by leveraging the security features of its underlying Linux kernel. Each app runs in its own memory space, has access to a permission-protected file system, and has protected CPU cycles. Unless the user explicitly bypasses it, this sandbox design protects apps from interfering or interacting with one another and other vital system components. For example, a banking app can't access files from a messaging app and vice versa.