Mobile security

Mobile security, or mobile device security, is the protection of smartphones, tablets, and laptops from threats associated with wireless computing. It has become increasingly important in mobile computing. The security of personal and business information now stored on smartphones is of particular concern.

More and more users and businesses use smartphones not only to communicate, but also to plan and organize both their users' work and private life. Within companies, these technologies are causing profound changes in the organization of information systems and have therefore become the source of new risks. Indeed, smartphones collect and compile an increasing amount of sensitive information to which access must be controlled to protect the privacy of the user and the intellectual property of the company.

All smartphones, as computers, are preferred targets of attacks. This is because these devices have family photos, pictures of pets, passwords, and more. For attackers, these items are a digital passport to access everything they would need to know about a person. This is why attacks on mobile devices are on the rise. These attacks exploit weaknesses inherent in smartphones that come from the communication mode—like Short Message Service (SMS, aka text messaging), Multimedia Messaging Service (MMS), WiFi, Bluetooth and GSM, the ''de facto'' global standard for mobile communications. There are also exploits that target software vulnerabilities in the browser or operating system, taking advantages of the weak knowledge of an average user.

Security countermeasures are being developed and applied to smartphones, from security in different layers of software to the dissemination of information to end users. There are practices to be observed at all levels, from design to use, through the development of operating systems, software layers, and downloadable apps.

Challenges of smartphone mobile security

Threats

A smartphone user is exposed to various threats when they use their phone. In just the last two-quarters of 2012, the number of unique mobile threats grew by 261%, according to ABI Research. These threats can disrupt the operation of the smartphone, and transmit or modify user data. So applications must guarantee privacy and integrity of the information they handle. In addition, since some apps could themselves be malware, their functionality and activities should be limited (for example, restricting the apps from accessing location information via GPS, blocking access to the user's address book, preventing the transmission of data on the network, sending SMS messages that are billed to the user, etc.). Since the recent rise of mobile attacks, hackers have increasingly targeted smartphones through credential theft and snooping. The number of attacks targeting smartphones and other devices has risen by 50 percent. According to the study, mobile banking applications are responsible for the increase in attacks.

Malware is distributed by the attackers so that they can take over the targets' transaction information, their rights to log in, and their money. Various types of malware are also developed with anti-detection techniques to avoid detection. Triade malware comes pre-installed on some mobile devices. In addition to Haddad, there is Lotoor, which exploits vulnerabilities in the system to repackage legitimate applications. The devices are also vulnerable due to spyware and leaky behaviors through applications. Devices connected to public networks are at risk of attacks. Mobile devices are also effective conveyance systems for malware threats, breaches of information, and thefts. Potential attackers were looking for possible weak points once Apple's iPhone and the first Android devices came onto the market. The Department of Homeland Security's cybersecurity department claims that the number of vulnerable points in smartphone operating systems has increased. As mobile phones are connected to utilities and appliances, hackers, cybercriminals, and even intelligence officials have access to these devices.

It became increasingly popular to let employees use their own devices for work-related purposes in 2011. The Crowd Research Partners study, published in 2017, reports that during 2017, most businesses that mandated the use of mobile devices were subjected to malware attacks and breaches. It has become common for rogue applications to be installed on user devices without the user's permission. They breach privacy, which hinders the effectiveness of the devices. As well as affecting the device, hidden malware is harmful. Mobile malware has been developed to exploit vulnerabilities in mobile devices. Ransomware, worms, botnets, Trojans, and viruses are some of the types. Since the introduction of mobile banking apps and other apps, which are vital targets for hackers, malware has been rampant. Trojan-droppers can also avoid detection of malware. The attackers who use the malware on the device are able to avoid detection by hiding malicious code. Despite the fact that the malware inside a device does not change, the dropper generates new hashes each time. Additionally, droppers can also create a multitude of files, which can lead to the creation of viruses. Android mobile devices are prone to Trojan-Droppers. The banking Trojans also enable attacks on the banking applications on the phone, which leads to the theft of data for use in stealing money and funds. Additionally, there are jailbreaks for iOS devices, which work by disabling the signing of codes on iPhones so that applications not downloaded from the App Store can be operated. In this way, all the protection layers offered by iOS are disrupted, exposing the device to malware. These outside applications don't run in a sandbox, and as a result, it exposes potential security problems. By installing malicious credentials and virtual private networks (VPN) to direct information to malicious systems, there are attack vectors developed to change the mobile devices' configuration settings. In addition, there is spyware that tends to be installed on mobile devices in order to track an individual. Malicious apps can also be installed without the owners' permission or knowledge.

Wi-Fi interference technologies can also attack mobile devices through potentially insecure networks. By compromising the network, hackers are able to gain access to key data. A VPN, on the other hand, can be used to secure networks. As soon as a system is threatened, an active VPN will operate. There are also social engineering techniques, such as phishing. With phishing, unsuspecting victims are sent links to lead them to malicious websites. The attackers can then hack into the victim's device and copy all of its information. However, mobile device attacks can be prevented with technologies. Containerization is an example, as it allows the creation of a hardware infrastructure that separates the business data from other data. By detecting malicious traffic and rogue access points, there is network protection. Data security is also ensured through authentication.

There are three prime targets for attackers:
*Data: smartphones are devices for data management, and may contain sensitive data like credit card numbers, authentication information, private information, activity logs (calendar, call logs);
*Identity: smartphones are highly customizable, so the device or its contents can easily be associated with a specific person.
*Availability: attacking a smartphone can limit access to it and deprive the owner of its use.

There are a number of threats to mobile devices, including annoyance, stealing money, invading privacy, propagation, and malicious tools. Vulnerability in mobile devices is a weak spot that will allow an attacker to decrease a systems security. There are three elements that intercepts when vulnerability occurs and they are a system weakness, attacker access to the flaw, and attacker competence to exploit the flaw.
*Botnets: attackers infect multiple machines with malware that victims generally acquire via e-mail attachments or from compromised applications or websites. The malware then gives hackers remote control of "zombie" devices, which can then be instructed to perform harmful acts.
*Malicious applications: hackers upload malicious programs or games to third-party smartphone application marketplaces. The programs steal personal information and open backdoor communication channels to install additional applications and cause other problems.
*Malicious links on social networks: an effective way to spread malware where hackers can place Trojans, spyware, and backdoors.
*Spyware: hackers use this to hijack phones, allowing them to hear calls, see text messages and e-mails as well as track someone's location through GPS updates.

The source of these attacks are the same actors found in the non-mobile computing space:
*Professionals, whether commercial or military, who focus on the three targets mentioned above. They steal sensitive data from the general public, as well as undertake industrial espionage. They will also use the identity of those attacked to achieve other attacks;
*Thieves who want to gain income through data or identities they have stolen. The thieves will attack many people to increase their potential income;
* Black hat hackers who specifically attack availability. Their goal is to develop viruses, and cause damage to the device. In some cases, hackers have an interest in stealing data on devices.
* Grey hat hackers who reveal vulnerabilities. Their goal is to expose vulnerabilities of the device. Grey hat hackers do not intend on damaging the device or stealing data.

Consequences

When a smartphone is infected by an attacker, the attacker can attempt several things:
* The attacker can manipulate the smartphone as a zombie machine, that is to say, a machine with which the attacker can communicate and send commands which will be used to send unsolicited messages (spam) via sms or email;
* The attacker can easily force the smartphone to make phone calls. For example, one can use the API (library that contains the basic functions not present in the smartphone) PhoneMakeCall by Microsoft, which collects telephone numbers from any source such as yellow pages, and then call them. But the attacker can also use this method to call paid services, resulting in a charge to the owner of the smartphone. It is also very dangerous because the smartphone could call emergency services and thus disrupt those services;
* A compromised smartphone can record conversations between the user and others and send them to a third party. This can cause user privacy and industrial security problems;
* An attacker can also steal a user's identity, usurp their identity (with a copy of the user's sim card or even the telephone itself), and thus impersonate the owner. This raises security concerns in countries where smartphones can be used to place orders, view bank accounts or are used as an identity card;
* The attacker can reduce the usability of the smartphone, by discharging the battery. For example, they can launch an application that will run continuously on the smartphone processor, requiring a lot of energy and draining the battery. One factor that distinguishes mobile computing from traditional desktop PCs is their limited performance. Frank Stajano and Ross Anderson first described this form of attack, calling it an attack of "battery exhaustion" or "sleep deprivation torture";
* The attacker can also prevent the operation and/or use of the smartphone by making it unusable. This attack can either delete the boot scripts, resulting in a phone without a functioning OS, or modify certain files to make it unusable (e.g. a script that launches at startup that forces the smartphone to restart) or even embed a startup application that would empty the battery;
* The attacker can remove the personal (photos, music, videos, etc.) or professional data (contacts, calendars, notes) of the user.

Attacks based on communication

Attack based on SMS and MMS

Some attacks derive from flaws in the management of SMS and MMS.

Some mobile phone models have problems in managing binary SMS messages. It is possible by sending an ill-formed block, to cause the phone to restart, leading to the denial of service attacks. If a user with a Siemens S55 received a text message containing a Chinese character, it would lead to a denial of service.
In another case, while the standard requires that the maximum size of a Nokia Mail address is 32 characters, some Nokia phones did not verify this standard, so if a user enters an email address over 32 characters, that leads to complete dysfunction of the e-mail handler and puts it out of commission. This attack is called "curse of silence".
A study on the safety of the SMS infrastructure revealed that SMS messages sent from the Internet can be used to perform a distributed denial of service (DDoS) attack against the mobile telecommunications infrastructure of a big city. The attack exploits the delays in the delivery of messages to overload the network.

Another potential attack could begin with a phone that sends an MMS to other phones, with an attachment. This attachment is infected with a virus. Upon receipt of the MMS, the user can choose to open the attachment. If it is opened, the phone is infected, and the virus sends an MMS with an infected attachment to all the contacts in the address book. There is a real-world example of this attack: the virus Commwarrior uses the address book and sends MMS messages including an infected file to recipients. A user installs the software, as received via MMS message. Then, the virus began to send messages to recipients taken from the address book.

Attacks based on communication networks

Attacks based on the GSM networks

The attacker may try to break the encryption of the mobile network. The GSM network encryption algorithms belong to the family of algorithms called A5. Due to the policy of security through obscurity it has not been possible to openly test the robustness of these algorithms. There were originally two variants of the algorithm: A5/1 and A5/2 (stream ciphers), where the former was designed to be relatively strong, and the latter was designed to be weak on purpose to allow easy cryptanalysis and eavesdropping. ETSI forced some countries (typically outside Europe) to use A5/2. Since the encryption algorithm was made public, it was proved it was possible to break the encryption: A5/2 could be broken on the fly, and A5/1 in about 6 hours . In July 2007, the 3GPP approved a change request to prohibit the implementation of A5/2 in any new mobile phones, which means that it has been decommissioned and is no longer implemented in mobile phones. Stronger public algorithms have been added to the GSM standard, the A5/3 and A5/4 (Block ciphers), otherwise known as KASUMI or UEA1 published by the ETSI. If the network does not support A5/1, or any other A5 algorithm implemented by the phone, then the base station can specify A5/0 which is the null algorithm, whereby the radio traffic is sent unencrypted. Even in case mobile phones are able to use 3G or 4G which have much stronger encryption than 2G GSM, the base station can downgrade the radio communication to 2G GSM and specify A5/0 (no encryption) . This is the basis for eavesdropping attacks on mobile radio networks using a fake base station commonly called an IMSI catcher.

In addition, tracing of mobile terminals is difficult since each time the mobile terminal is accessing or being accessed by the network, a new temporary identity (TMSI) is allocated to the mobile terminal. The TMSI is used as the identity of the mobile terminal the next time it accesses the network. The TMSI is sent to the mobile terminal in encrypted messages.

Once the encryption algorithm of GSM is broken, the attacker can intercept all unencrypted communications made by the victim's smartphone.

Attacks based on Wi-Fi

An attacker can try to eavesdrop on Wi-Fi communications to derive information (e.g. username, password). This type of attack is not unique to smartphones, but they are very vulnerable to these attacks because very often the Wi-Fi is the only means of communication they have to access the internet. The security of wireless networks (WLAN) is thus an important subject. Initially, wireless networks were secured by WEP keys. The weakness of WEP is a short encryption key which is the same for all connected clients. In addition, several reductions in the search space of the keys have been found by researchers. Now, most wireless networks are protected by the WPA security protocol.
WPA is based on the " Temporal Key Integrity Protocol (TKIP)" which was designed to allow migration from WEP to WPA on the equipment already deployed. The major improvements in security are the dynamic encryption keys. For small networks, the WPA is a "pre-shared key" which is based on a shared key. Encryption can be vulnerable if the length of the shared key is short. With limited opportunities for input (i.e. only the numeric keypad), mobile phone users might define short encryption keys that contain only numbers. This increases the likelihood that an attacker succeeds with a brute-force attack. The successor to WPA, called WPA2, is supposed to be safe enough to withstand a brute force attack. Free Wi-Fi is usually provided by organizations such as airports, coffee shops, and restaurants for a number of reasons. In addition to spending more time on the premises, Wi-Fi access helps them to stay productive. It's likely they'll end up spending more money if they spend more time on the premises. Enhancing customer tracking is another reason. A lot of restaurants and coffee shops compile data about their customers so they can target advertisements directly to their devices. This means that customers know what services the facility provides. Generally, individuals filter business premises based on Internet connections as another reason to gain a competitive edge. The ability to access free and fast Wi-Fi gives a business an edge over those who do not. Network security is the responsibility of the organizations. There are numerous risks associated with their unsecured Wi-Fi networks, however. The man-in-the-middle attack entails the interception and modification of data between parties. Additionally, malware can be distributed via the free Wi-Fi network and hackers can exploit software vulnerabilities to smuggle malware onto connected devices. It is also possible to eavesdrop and sniff Wifi signals using special software and devices, capturing login credentials and hijacking accounts.

As with GSM, if the attacker succeeds in breaking the identification key, it will be possible to attack not only the phone but also the entire network it is connected to.

Many smartphones for wireless LANs remember they are already connected, and this mechanism prevents the user from having to re-identify with each connection. However, an attacker could create a WIFI access point twin with the same parameters and characteristics as the real network. Using the fact that some smartphones remember the networks, they could confuse the two networks and connect to the network of the attacker who can intercept data if it does not transmit its data in encrypted form.

Lasco is a worm that initially infects a remote device using the SIS file format. SIS file format (Software Installation Script) is a script file that can be executed by the system without user interaction. The smartphone thus believes the file to come from a trusted source and downloads it, infecting the machine.

Principle of Bluetooth-based attacks

Security issues related to Bluetooth on mobile devices have been studied and have shown numerous problems on different phones. One easy to exploit vulnerability: unregistered services do not require authentication, and vulnerable applications have a virtual serial port used to control the phone. An attacker only needed to connect to the port to take full control of the device. Another example: a phone must be within reach and Bluetooth in discovery mode. The attacker sends a file via Bluetooth. If the recipient accepts, a virus is transmitted. For example: Cabir is a worm that spreads via Bluetooth connection. The worm searches for nearby phones with Bluetooth in discoverable mode and sends itself to the target device. The user must accept the incoming file and install the program. After installing, the worm infects the machine.

Attacks based on vulnerabilities in software applications

Other attacks are based on flaws in the OS or applications on the phone.

Web browser

The mobile web browser is an emerging attack vector for mobile devices. Just as common Web browsers, mobile web browsers are extended from pure web navigation with widgets and plug-ins, or are completely native mobile browsers.

Jailbreaking the iPhone with firmware 1.1.1 was based entirely on vulnerabilities on the web browser. As a result, the exploitation of the vulnerability described here underlines the importance of the Web browser as an attack vector for mobile devices. In this case, there was a vulnerability based on a stack-based buffer overflow in a library used by the web browser ( LibTIFF).

A vulnerability in the web browser for Android was discovered in October 2008. As the iPhone vulnerability above, it was due to an obsolete and vulnerable library. A significant difference with the iPhone vulnerability was Android's sandboxing architecture which limited the effects of this vulnerability to the Web browser process.

Smartphones are also victims of classic piracy related to the web: phishing, malicious websites, software that run in the background, etc. The big difference is that smartphones do not yet have strong antivirus software available.

The internet offers numerous interactive features that ensure a higher engagement rate, capture more and relevant data, and increase brand loyalty. Blogs, forums, social networks, and wikis are some of the most common interactive websites. Due to the tremendous growth of the internet, there has been a rapid rise in the number of security breaches experienced by individuals and businesses over the past few years. Users can balance the need to utilize the interactive features while also maintaining caution regarding security issues in several ways. Reviewing computer security regularly and correcting, upgrading, and replacing the necessary features are a few of the ways to do this. Installation of antivirus and anti-spyware programs is the most effective way of protecting the computer, and they offer protection against malware, spyware, and viruses. As well, they use firewalls, which are typically installed between the internet and the computer network in order to find a balance. By acting as a web server, the firewall prevents external users from accessing the internal computer system. Also, secure passwords and not sharing them help maintain the balance.

Operating system

Sometimes it is possible to overcome the security safeguards by modifying the operating system itself. As real-world examples, this section covers the manipulation of firmware and malicious signature certificates. These attacks are difficult.

In 2004, vulnerabilities in virtual machines running on certain devices were revealed. It was possible to bypass the bytecode verifier and access the native underlying operating system. The results of this research were not published in detail. The firmware security of Nokia's Symbian Platform Security Architecture (PSA) is based on a central configuration file called SWIPolicy. In 2008, it was possible to manipulate the Nokia firmware before it is installed, and in fact in some downloadable versions of it, this file was human-readable, so it was possible to modify and change the image of the firmware. This vulnerability has been solved by an update from Nokia.

In theory, smartphones have an advantage over hard drives since the OS files are in ROM, and cannot be changed by malware. However, in some systems it was possible to circumvent this: in the Symbian OS it was possible to overwrite a file with a file of the same name. On the Windows OS, it was possible to change a pointer from a general configuration file to an editable file.

When an application is installed, the signing of this application is verified by a series of certificates. One can create a valid signature without using a valid certificate and add it to the list. In the Symbian OS all certificates are in the directory: . With firmware changes explained above, it is very easy to insert a seemingly valid but malicious certificate.

Android is the OS that has been attacked the most. Because it has most of users among the operation systems. According to cybersecurity company, it reported that they have blocked about 18 millions attack in 2016.

Attacks based on hardware vulnerabilities

Electromagnetic Waveforms

In 2015, researchers at the French government agency Agence nationale de la sécurité des systèmes d'information

HOME


Content is Copyleft
Website design, code, and AI is Copyrighted (c) 2014-2017 by Stephen Payne


Consider donating to Wikimedia



As an Amazon Associate I earn from qualifying purchases