We are looking for novel solutions in the field of smartphone security. The technology does not have to be fully developed yet, but a convincing proof of concept (PoC) should be realisable within one year and with less than CHF 100,000.
The goal is for the technology to help efficiently and comprehensively analyse the security of third-party smartphone applications and their potential threats. It also aims to test applications running in an unmodified (non-rooted) operating system while providing dynamic testing capabilities.
Below are some examples of smartphone security technologies that are of interest. However, we are also happy to hear about related technologies that are not listed.
Example: Black box tests
Testing an application without decompiling, reverse engineering or looking into its internal code or structure. Testing is done by interacting with the user interface (UI) and observing how the application interacts with the network or device to detect malicious behaviour. One possible approach would be to use Deep Reinforcement Learning to predict application interactions, recognise UI elements or generate input for form filling or logins.
Example: User data protection with black box tests
Use black-box testing of applications to identify risks to user privacy such as detecting dangerous permissions granted to applications (e.g. reading phone status, pinpointing location, etc.). Black box testing could be used to determine whether an application's permissions have been dangerously extended (by exploiting a legitimate application or by the malicious application itself) from the specified functionality.
Example: Dynamic application tests
The application is tested fully automatically while it is running. Besides black box testing, there are other ways to test applications dynamically with or without using the user interface. An example would be so-called fuzzing or other dynamic analysis techniques.
Example: Operating system tests
The aim could be to test the default operating system on a smartphone. This is to detect malicious or unintended behaviour of the operating system or the default installed applications. Testing could be done by interacting with the user interface or by detecting changes caused by applications, such as changing permissions or other properties.
