Mobile devices are now the most common way users handle digital information and interact with online services. Different actors, trusting each other in different ways, compose the mobile ecosystem. Users interact with apps, trusting them to access valuable and privacy-sensitive information. At the same time, apps usually communicate with remote backends and authenticate users to online services. Finally, all these interactions are mediated, on one side, by the user interface and, on the other, by the operating system.

In my research, I studied how all these different actors trust each other, and how this trust can be unfortunately violated by attackers, due to limitations on how the mobile operating systems, apps, and user interfaces are currently designed and implemented. To assist my work, I developed automated systems to perform large-scale analyses of mobile apps.

In this talk, I will describe both the tools I have developed and my findings. Specifically, I will first describe my work on how, in an Android system, it is possible to lure users to interact with malicious apps which “look like” legitimate ones. This attack completely violates the trust relationship, mediated by the user interface, between users and apps. Then, I will explain how many apps unsafely authenticate their users to remote backends, due to misplaced trust in the operating system. Finally, I will show how many apps misuse hardware-backed authentication devices, such as trusted execution environments and fingerprint readers, making them vulnerable to a variety of authentication bypass attacks. I will finish my talk presenting current open issues in the field and outlining future directions for my research.