隨著Android智慧型手機的市占率提高，加上多數使用者對於安全的意識不高，可能會在公共場合使用公用充電器，或連接免費的網路，如果此時手機裝置的某些設定被開啟，如Android Debug Bridge (adb)，使用者的裝置將曝露在危險環境中。攻擊者可以透過這項Android提供給開發者的功能，來取得使用者的個人資訊，或甚至安裝惡意的應用程式到使用者的裝置上。這項功能雖然對開發者來說非常方便，但同時也存在著許多安全上的疑慮。先前有許多的論文，也都探討過此功能的安全問題。 本篇論文實作一個防禦工具Installation Protector (INPR)，當手機要透過adb指令進行APK檔案安裝時，INPR會針對此動作再次做確認，跳出警告訊息視窗，提醒使用者，並讓其決定是否要進行接下來的動作。INPR為使用者提供有效的防禦機制，並過濾出具有風險的訊息才進行通知，大大的減化了訊息的干擾，為開發者提供具有良好使用者經驗的adb環境，同時也為使用者提供更安全的adb使用環境。 ;With high market share of Android devices, more and more researchers are focusing on their security issues. Android provides many useful tools for developers, like Android Debug Bridge (adb). Developers can use adb for debugging Application and accessing many kind of resources on Android devices. Although adb is so powerful and convenient for developers, it is able to become an approach to a terrible attack. With most users’ lack of security awareness and insufficient protection on Android adb, the attacker can obtain some personal information from users or even to inject malicious Application in users’ devices. These attacks can lead to a disaster situation. In this paper, we design and implement a tool named Installation Protector (INPR) to prevent installation of malicious APK through adb. It will show up the confirmation Dialog while adb launches the installation command, and block the action on users’ acconunt. INPR only alerts the user when the potential risk comes from adb for installation, which makes the interference as less as possible to provide developer an undisturbed environment, and users obtain a safe environment when using adb.
