论文标题
为什么我的秘密泄漏？在设备到设备文件共享中发现漏洞
Why is My Secret Leaked? Discovering Vulnerabilities in Device-to-Device File Sharing
论文作者
论文摘要
Wi-Fi直接设备到设备文件共享应用程序的活跃用户数量已超过18亿。 Wi-Fi Direct，也称为Wi-Fi P2P，通常用于移动设备之间的点对点，高速文件传输，以及用于无线摄像机，网络打印机，电视，其他物联网和移动设备的紧密接近连接模式。对于最终用户，这种类型的直接文件传输不会产生蜂窝数据费用。但是，尽管此类应用程序很受欢迎，但我们观察到软件供应商倾向于优先考虑其实施中用户流量的便利性，从而导致严重的安全缺陷。我们在安全性和可用性的背景下进行全面的安全分析，并以17个常见漏洞和暴露（CVE）的形式报告我们的发现，这些漏洞和暴露（CVE）已披露给相应的供应商。为了解决应用程序设计早期的类似缺陷，我们建议对此类应用程序及其协议的安全性和可用性进行联合考虑，以可视化，以自定义的用户旅程映射（UJM）的形式可视化。
The number of active users of Wi-Fi Direct Device-to-Device file sharing applications on Android has exceeded 1.8 billion. Wi-Fi Direct, also known as Wi-Fi P2P, is commonly used for peer-to-peer, high-speed file transfer between mobile devices, as well as a close proximity connection mode for wireless cameras, network printers, TVs and other IoT and mobile devices. For its end users, such type of direct file transfer does not incur cellular data charges. However, despite the popularity of such applications, we observe that the software vendors tend to prioritize the ease of user flow over the security in their implementations, which leads to serious security flaws. We perform a comprehensive security analysis in the context of security and usability and report our findings in the form of 17 Common Vulnerabilities and Exposures (CVE) which have been disclosed to the corresponding vendors. To address the similar flaws at the early stage of the application design, we propose a joint consideration of security and usability for such applications and their protocols that can be visualized in form of a customised User Journey Map (UJM).
