1 / 35

Mobile Device Security - Reading Material

Mobile Device Security - Reading Material. Adam C. Champion and Dong Xuan CSE 4471: Information Security. Based on materials from Tom Eston (SecureState), Apple, Android Open Source Project, and William Enck (NCSU). Organization. Quick Overview of Mobile Devices

querida
Download Presentation

Mobile Device Security - Reading Material

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. Mobile Device Security- Reading Material Adam C. Champion and Dong Xuan CSE 4471: Information Security Based on materials from Tom Eston (SecureState), Apple, Android Open Source Project, and William Enck (NCSU)

  2. Organization • Quick Overview of Mobile Devices • iOS/Android Threats and Attacks • iOS/Android Security

  3. Overview of Mobile Devices • Mobile computers: • Mainly smartphones, tablets • Sensors: GPS, camera, accelerometer, etc. • Computation: powerful CPUs (≥ 1 GHz, multi-core) • Communication: cellular/4G, Wi-Fi, near field communication (NFC), etc. • Many connect to cellular networks: billing system • Cisco: 7 billion mobile devices will have been sold by 2012 [1] Organization

  4. Organization • Quick Overview of Mobile Devices • iOS/Android Threats and Attacks • iOS/Android Security

  5. iOS/Android Malware • iOS malware: very little • Juniper Networks: Major increase in Android malware from 2010 to 2011 [18] • Android malware growth keeps increasing ($$$) • Main categories: [19] • Trojans • Monitoring apps/spyware • Adware • Botnets • We’ll look at notable malware examples

  6. iOS Malware • Malware, “fake apps” have hit iOS too • iKee, first iPhone virus, “rickrolled” jailbroken iDevices [25] • Example “fake/similar” apps: • Temple Run: Temple Climb, Temple Rush, Cave Run • Angry Birds: Angry Zombie Birds, Shoot Angry Birds • Not to mention “walkthroughs,”“reference” apps, etc. • Google Play banned such apps… • iOS, Android hit with “Find and Call” app • SMS spammed contacts from central server • Removed from App Store, Google Play

  7. Android: DroidDream Malware • Infected 58 apps on Android Market, March 2011 • 260,000 downloads in 4 days • How it worked: • Rooted phone via Android Debug Bridge (adb) vulnerability • Sent premium-rate SMS messages at night ($$$) • Google removed apps 4 days after release, banned 3 developers from Market • More malware found since

  8. Android: Fake Angry Birds Space • Bot, Trojan • Masquerades as game • Roots Android 2.3 devices using “Gingerbreak” exploit • Device joins botnet Source: [20]

  9. Android: SMS Worm • Students in previous information security classes wrote SMS worms, loggers on Android • Worm spreads to all contacts via social engineering, sideloading, etc. • Logger stored/forwarded all received SMS messages • Only needed SEND_SMS, RECEIVE_SMS, READ_SMS permissions • Can send 100 SMS messages/hour • One group put SMS logger on Google Play (removed it)

  10. Android: Google Wallet Vulnerabilities (1) • Google Wallet enables smartphone payments • Uses NFC technology • Many new mobile devices have NFC • Some credit card info stored securely in secure element • Separate chip, SD card, SIM card • Unfortunately, other data are not stored as securely

  11. Android: Google Wallet Vulnerabilities (2) • Some information can be recovered from databases on phone: [21] • Name on credit card • Expiration date • Recent transactions • etc. • Google Analytics tracking can reveal customer behavior from non-SSL HTTP GET requests • NFC alone does not guarantee security • Radio eavesdropping, data modification possible [22] • Relay attacks, spoofing possible with libnfc [23]

  12. Android: Sophisticated NFC Hack • Charlie Miller’s Black Hat 2012 presentation: Nokia, Android phones can be hijacked via NFC [24] • NFC/Android Beam on by default on Android 2.3+, Android 4.0+ • Place phone 3–4 cm away from NFC tag, other NFC-enabled phone • Attacker-controlled phone sends data to tag/device, can crash NFC daemon, Android OS • For Android 4.0–4.0.1, can remotely open device browser to attacker-controlled webpage

  13. Organization • Quick Overview of Mobile Devices • iOS/Android Threats and Attacks • iOS/Android Security

  14. iOS System Architecture (1) • Boot sequence: • Bootloader, kernel, extensions, baseband firmware all have cryptographic signatures • Root of trust: burnt into boot ROM at the factory • Each component’s signature is verified • If any signature doesn’t match, the “connect to iTunes” screen is shown Icons from Double-J Design, IconBlock

  15. iOS System Architecture (2) • Software updates • Cannot install older version of iOS on an iDevice; e.g., if device runs iOS 5.1.1, cannot install iOS 4 • Device cryptographically “measures” components, sends to Apple install server with nonce, device ID • Nonce: value used only once • Prevents attacker from “replaying” the value • Server checks measurements; if allowed, server adds device ID to measurements, signs everything

  16. iOS Apps and App Store • All iOS apps signed by Apple (not developer) • Third-party apps signed only after: • Developer ID verification (individual, company) • Review: bugs, work correctly (program analysis) • Each app sandboxed in its own directory • Cannot communicate with other apps • Apps need signed “entitlements” to access user data • Further app protection: • Address Space Layout Randomization (ASLR) for all apps • ARM eXecute Never (XN) bit set for all memory pages

  17. iOS Data Protection Measures • Each iDevice has hardware-accelerated crypto operations (AES-256) • Effaceable Storage: securely removes crypto keys from flash memory • “Erase all content and settings” wipes user data using Effaceable Storage (locally or remotely) • Interact with mobile device management (MDM), Exchange ActiveSync servers • Developers can use APIs for secure file, database storage • Passcodes • Admins can require numeric, alphanumeric, etc. • Wipe device after 10 failed login attempts

  18. iPhone Configuration Utility

  19. Miscellaneous iOS Security • Built-in support for SSLv3, TLS, VPNs • Extensive administrative controls: • Password policies • Disable device features, e.g., camera • Disable Siri • Remote wipe • Apps can access contacts without permission (fixed in iOS 6) Source: [8]

  20. iOS Jailbreaking • Circumvents Apple’s iOS security mechanisms • Violates iDevice’s terms of use • Allows installation of apps from alternative app stores, e.g., Cydia • Removes app sandbox • Usually replaces kernel with one accepting non-Apple signatures • Tools: redsn0w, Absinthe, etc. • Legal in U.S. under DMCA 2010 exemption

  21. Google Android Platform • Android: Linux-based mobile handset platform • Developed by Google, Open Handset Alliance for handset manufacturers • Includes T-Mobile, Sprint Nextel, Google, Intel, Samsung, etc. [29] • Free, open mobile handset platform for industry [30] • Flagship: Google Nexus 4

  22. Android Architecture

  23. Android Features and Software • Features • 3D: OpenGL ES 1.0 • SQLite: Database engine • WebKit: Web browser • Dalvik: Register-based VM similar to Java VM [32] • FreeType: Bitmap and vector font rendering • Connectivity: Bluetooth, 802.11, GPS • Core Applications • Email, SMS, calendar, Google apps, browser, etc. • Written in Java • App Framework • Full access to same framework APIs • Architecture designed for component reuse • Runtime • Core C++ library • Multiple Dalvik VMs run in a process, rely on Linux kernel for process isolation [32]

  24. Android Security (1) • Android built on Linux kernel, which provides • User permissions model • Process isolation • Each app is assigned unique user/group IDs, run as a separate process ⇒ app sandbox • System partition mounted read-only • Android 3.0+ enables filesystem encryption using Linux dmcrypt (AES-128) • Device admins can require passwords with specific criteria, remote wipe devices, etc.

  25. Android Security (2) • Android device administration (3.0+): • Remote wipe • Require strong password • Full device encryption • Disable camera

  26. Android Security (3) • Other protection mechanisms: • Android 1.5+: stack buffer, integer overflow protection; double free, chunk consolidation attack prevention • Android 2.3+: format string protection, NX, null pointer dereference mitigation • Android 4.0+: ASLR implemented • Android 4.1+: ASLR strengthened, plug kernel leaks • Capability-based permissions mechanism: • Many APIs are not invoked without permission, e.g., camera, GPS, wireless, etc. • Every app must declare the permissions it needs • Users need to allow these permissions when installing app

  27. Android Security (4) • All Android apps need to be signed: by the developer, not Google • Google Play app store less regulated • Apps available rapidly after publishing • Bouncer service scans for malware in store [11] Google Play permissions interface

  28. Android Device Diversity (1) • Android runs on various devices • Different devices run different OS versions • Device manufacturers often add their own custom UIs, software • Mobile operators add their own software • Not all devices are updated to latest Android version! • Security challenges… Android devices accessing Google Play, August 2012. Some devices are not always updated to the latest version. These devices tend to have security vulnerabilities targeted by attackers. Source: [12]

  29. Android Device Diversity (2) • Notice many Android devices are “orphaned” without major updates [13] • Android developers need to secure their apps for many different devices…

  30. Android Device Diversity (3) The OpenSignalMaps Android app sees almost 4,000 types of device clients. Source: [14]

  31. Rooting Android Devices • Android device owners can often get root access to their devices • Process can be as simple as unlocking bootloader • Sometimes, exploit bugs to get root • Result: install OS of choice, bypass device/operator restrictions • Legal under 2010 DMCA exemption • Security problems: • Voids device warranty (usually) • Circumvents app sandbox: root can modify any app’s files • Malware can root and own your device!

  32. References (1) • Cisco, “Cisco Visual Networking Index: Global Mobile Data Traffic Forecast Update, 2011–2016”, 14 Feb. 2012, http://www.cisco.com/en/US/solutions/collateral/ns341/ns525/ns537/ns705/ns827/white_paper_c11-520862.html • Samsung, “Exynos 5 Dual,” 2012, http://www.samsung.com/global/business/semiconductor/product/application/detail?productId=7668&iaId=2341 • Nielsen Co., “Two Thirds of All New Mobile Buyers Now Opting for Smartphones,” 12 Jul. 2012, http://blog.nielsen.com/nielsenwire/online_mobile/two-thirds-of-new-mobile-buyers-now-opting-for-smartphones/ • K. De Vere, “iOS leapfrogs Android with 410 million devices sold and 650,000 apps,” 24 Jul. 2012, http://www.insidemobileapps.com/2012/07/24/ios-device-sales-leapfrog-android-with-410-million-devices-sold/ • K. Haslem, “Macworld Expo: Optimised OS X sits on ‘versatile’ Flash,” 12 Jan. 2007, Macworld, http://www.macworld.co.uk/ipod-itunes/news/index.cfm?newsid=16927 • Wikipedia, “iOS,” updated 2012, http://en.wikipedia.org/wiki/iOS • Apple Inc., “iPhone Developer University Program,”http://developer.apple.com/iphone/program/university.html • Apple Inc, “iOS Security,”http://images.apple.com/ipad/business/docs/iOS_Security_May12.pdf • Android Open Source Project, “Android Security Overview,”http://source.android.com/tech/security/index.html Presentation organization inspired by T. Eston, “Android vs. iOS Security Showdown,” 2012, http://www.slideshare.net/agent0x0/the-android-vs-apple-ios-security-showdown

  33. References (2) • A. Rubin, 15 Feb. 2012, https://plus.google.com/u/0/112599748506977857728/posts/Btey7rJBaLF • H. Lockheimer, “Android and Security,” 2 Feb. 2012, http://googlemobile.blogspot.com/2012/02/android-and-security.html • Android Open Source Project, http://developer.android.com/about/dashboards/index.html • M. DeGusta, “Android Orphans: Visualizing a Sad History of Support,” 26 Oct. 2011, http://theunderstatement.com/post/11982112928/android-orphans-visualizing-a-sad-history-of-support • http://opensignalmaps.com/reports/fragmentation.php • http://www.micro-trax.com/statistics ` • Lookout, Inc., “Mobile Lost and Found,” 2012, https://www.mylookout.com/resources/reports/mobile-lost-and-found/ • K. Haley, “Introducing the Smartphone Honey Stick Project,” 9 Mar. 2012, http://www.symantec.com/connect/blogs/introducing-symantec-smartphone-honey-stick-project • Juniper Networks, Inc., “Global Research Shows Mobile Malware Accelerating,” 15 Feb. 2012, http://newsroom.juniper.net/press-releases/global-research-shows-mobile-malware-accelerating-nyse-jnpr-0851976

  34. References (3) • F-Secure, “Mobile Threat Report Q2 2012,” 7 Aug. 2012, http://www.slideshare.net/fsecure/mobile-threat-report-q2-2012 • http://nakedsecurity.sophos.com/2012/04/12/a ndroid-malware-angry-birds-space-game/ • Via Forensics LLC, “Forensic Security Analysis of Google Wallet,” 12 Dec. 2011, https://viaforensics.com/mobile-security/forensics-security-analysis-google-wallet.html • Proxmark, http://www.proxmark.org/ • libnfc, http://www.libnfc.org • D. Goodin, “Android, Nokia smartphone security toppled by Near Field Communication hack,” 25 Jul. 2012, http://arstechnica.com/security/2012/07/android-nokia-smartphone-hack/ • B. Andersen, “Australian admits creating first iPhone virus,” 10 Nov. 2009, http://www.abc.net.au/news/2009-11-09/australian-admits-creating-first-iphone-virus/1135474 • R. Radia, “Why you should always encrypt your smartphone,” 16 Jan. 2011, http://arstechnica.com/gadgets/2011/01/why-you-should-always-encrypt-your-smartphone/ • Heritage Foundation, “Solutions for America: Overcriminalization,” 17 Aug. 2010, http://www.heritage.org/research/reports/2010/08/overcriminalization • Wikipedia, http://en.wikipedia.org/wiki/Mobile_device_forensics • C. Quentin, http://www.slideshare.net/cooperq/your-cell-phone-is-covered-in-spiders

  35. References (4) • A. J. Aviv, K. Gibson, E. Mossop, M. Blaze, and A. M. Smith, “Smudge Attacks on Smartphone Touch Screens,” Proc. USENIX WOOT, 2010. • X. Ni, Z. Yang, X. Bai, A. C. Champion, and Dong Xuan, “DiffUser: Differentiated User Access Control on Smartphones,”Proc. IEEE Int’l. Workshop on Wireless and Sensor Networks Security (WSNS), 2009. • W. Enck, P. Gilbert, B.-G. Chun, L. P. Cox, J. Jung, P. McDaniel, and A. N. Sheth, “TaintDroid: An Information-Flow Tracking System for Realtime Privacy Monitoring on Smartphones,” Proc. USENIX OSDI, 2010, http://appanalysis.org • W. Enck, P. Gilbert, B.-G. Chun, L. P. Cox, J. Jung, P. McDaniel, and A. N. Sheth, “TaintDroid: An Information-Flow Tracking System for Realtime Privacy Monitoring on Smartphones,”http://static.usenix.org/event/osdi10/tech/slides/enck.pdf • B. Gu, X. Li, G. Li, A. C. Champion, Z. Chen, F. Qin, and D. Xuan, “D2Taint: Differentiated and Dynamic Information Flow Tracking on Smartphones for Numerous Data Sources,” Technical Report, 2012.

More Related