Android Data Confidentiality Alex Mayer University of Houston

1. Android Data Confidentiality Alex MayerUniversity of Houston Summary DesDROID Flash Disk Application Abstract • Collection, data cleansing, and disposal of wireless devices. This software service secures corporate data assets and completes the lifecycle of individual communications devices in an environmentally responsible manner, while also providing your organization an opportunity to earn potential cash rebates based on the device type. • In order to delete confidential data from the mobile device, I have created a flash disk compilation of Android software, called DesDROID. These apps are needed to destroy system and user data on Android Mobile Operating System 2.1 and 2.2. All the following files will be located on DesDROID disk, and are apps all free to use. • Root Explorer • SPRecovery • Terminal Emulator • Superuser • Androot Mobile devices are increasingly being utilized by business to help ease the gap between work and home. Most enterprises currently use some type of smart device for their employees, consequently the confidentiality of data on these devices needs to be maintained. As mobile devices become more important in daily business processes, it is equally important to ensure information contained on those devices does not get into the wrong hands. Using DesDROID will positively impact your business by ensuring confidential data is not lost or stolen. By taking these necessary steps, your business complies with business standards and reduces unneeded risk. Employees are increasingly relying on mobile devices to perform daily job functions. Today's mobile devices are what connect the employee back to the office. Confidential company information remains on the mobile devices after they are at the end of their lifecycle. Company’s need to be able to secure confidential data left on mobile devices in order to meet security and business policy objectives. Mobile Device’s in Corporate Environments • Most, if not all large companies issue mobile devices to their employees • Mobile devices can connect to any and all information systems used by companies1 • Confidential company information is stored on mobile devices and remains on the devices when they reach the end of their life cycle • When a mobile device malfunctions, it is important to get into the device and backup the confidential data and destroy any and all traces of that data. • The Android operating system is fast replacing RIM and Windows Mobile devices which shows in the 3Q of 2010 to own 25% of the market share • According to NIST, cell phones and personal digital assistants (PDAs) have become indispensable tools for today's highly mobile workforce. Small and relatively inexpensive, these devices can be used for many functions, including sending and receiving electronic mail, storing documents, delivering presentations, and remotely accessing data. While these devices provide productivity benefits, they also pose new risks to organizations. 2 Journals and Articles Android Vulnerable To Data Theft Exploit Google is working to patch a new data-stealing vulnerability that affects all versions of the Android operating system. 5 • Step 1 :: Root the DROID • Run Androot and follow the directions • **Now the DROID is rooted proceed to step two. CIOs See Smart phones As Data Breach Time Bomb Eight out of 10 CIOs think that using smart phones in the workplace increases the business's vulnerability to attack, and rank data breaches as their top related security concern. Yet half of organizations fail to authenticate their employees' mobile devices, among other basic security measures. 6 Global Mobile Device Market Share for 2010 1.B 1.A 1.C Data loss challenges rise Organizations are starting to realize the importance of data protection, but possible routes of data loss have become complicated and numerous, making countermeasures difficult to develop. 7 • Step 2 :: Run Superuser • Grant Terminal Emulator Root Access NIST Standards Guidelines on Cell Phone and PDA Security 2 Guidelines for Media Sanitization 8 2.A 2.B • Step 3 :: Run Console Emulator • Type: su (grants root access to Droid OS) • Type Reboot Recovery (See blue image above) • Step 4 :: SPRecovery (Sir Psychosis Recovery) • Choose “wipe data/factory reset” and run it 7 times References Data Remanence Problem Data remanence is the left over physical data that either has been erased or overwritten. Since mobile devices use flash for data storage, typically files are not overwritten due to the nature of how flash disks operate. There are several methods to retrieve old data from mobile devices, all of which are not easy and require some technical expertise. However, the point being that it is possible to retrieve data from mobile devices even after the data was deleted. 3 3