Abusing notification services on smartphones for phishing and spamming

摘要: Notification service is a popular functionality provided by almost all modern smartphone platforms. To facilitate customization for developers, many platforms support highly customizable notifications, which allow the third party applications to specify trigger events, notification views be displayed, and allowed user operations on views. In this paper, we show that may an installed trojan application launch phishing attacks or anonymously post spam notifications. Through our studies four major platforms, both Android BlackBerry OS are vulnerable under attacks. iOS Windows Phone little customization, thus launching will expose identity of application. Attack demonstrations presented. To prevent while still allowing propose Semi-OS-Controlled view design principle Logging service. Moreover, protect from fraudulent views, authentication framework, named SecureView, enables add image text their sensitive (e.g. account login view). The implementation proposed defense approaches also presented in paper.