Ten dangerous claims about smart phone security

Jon Espenschied

March 23, 2007 (Computerworld) My heart sank when I first saw Al Gore pull out his BlackBerry. It was in the waning weeks of the 2000 presidential campaign, and there he was on the TV, tapping away on his then-novel converged device. Though I had no evidence, I was positive that whatever he was reading had already been perused by some conservative skunk works, with his responses scrutinized not long after. Given recent revelations about the opposition's <a href="http://www.slate.com/id/2161312/entry/0/" target="_blank">ethics</a> and panting obsession with <a href="http://www.cbsnews.com/stories/2006/01/19/politics/main1223080.shtml" target="_blank">domestic spying</a>, I still suspect that any eavesdropping technically possible at the time was probably being done. <o:p></o:p> So imagine my dismay when I saw <a href="http://www.poy.org/63/15/ae03_04.php" target="_blank">Sen. Barack Obama</a> pulling a BlackBerry from his coat pocket shortly after announcing his candidacy for president. Like many others addicted to their converged devices (Sen. John McCain was apparently <a href="http://thinkprogress.org/2007/01/24/mccain-falls-asleep/" target="_blank">indulging</a> during the last State of the Union speech, not sleeping), he's become a constant user, and he now uses it to manage a large portion of his communications. While I hope these politicians have IT staffers paying attention to this sort of thing, more often than not, a series of underinformed security and privacy assumptions are made shortly before sensitive information starts flowing.<o:p></o:p> Many common assumptions about the security and privacy of smart phones or other handheld converged devices are off-base or just flat-out wrong. For any high-value target -- whether that's a political candidate or an organization with valuable financial or personal data -- a little more thought ought to go into the process of selecting and deploying any device handling important data. It makes sense then to challenge the more widespread assumptions and consider how to handle oft-ignored risks.<o:p></o:p> 1. It's just a phone with cool features, right?<o:p></o:p> No, it's not. There's been a major shift in smart phone architecture in the past few years. Yesterday's phone ran an embedded operating system with software hooks written for the specific model's CPU, interface, <a href="http://en.wikipedia.org/wiki/Vocoder" target="_blank">vocoder</a>  and radio. Today's mobile converged device is more likely to run software considerably more advanced and versatile than desktop systems just 10 years ago. That versatility is an enemy of security because it turns the underlying security architecture on its head. <o:p></o:p> It used to be that a phone or small handheld device had a default-deny security model, because every feature was added from the ground up. There were no extraneous services running on the device, because every one was purpose-built. Now most converged devices run commodity operating systems, such as <a href="http://www.symbian.com/" target="_blank">Symbian OS</a>  (owned in part by Nokia and Sony Ericsson) or Microsoft's Windows <a href="http://en.wikipedia.org/wiki/Image:Windows_CE_Timeline.png" target="_blank">CE/Mobile</a> family, that have portability as a core design goal. This means there are plenty of communications services and data handling hooks in the code base, and it's up to phone and application developers to ensure unused code is removed or disabled where not appropriate. <o:p></o:p> No one wants to annoy customers, so more often than not, a wide range of services and interfaces is included and enabled -- equivalent to a default-allow stance. While I'm a fan of open systems, it's worth evaluating a mobile device that provides the features you want and no more in the base configuration -- perhaps a <a href="http://www.technewsworld.com/story/44222.html" target="_blank">"feature phone"</a>  instead of a smart phone -- and place less priority on the capacity for upgrades and expansion.<o:p></o:p> 2. It's stable, just like any other purpose-built appliance.<o:p></o:p> Don't assume that the lack of operating system patches and application updates for a smart phone means that they aren't needed. In the short <a href="http://www.viruslist.com/en/analysis?pubid=170773606" target="_blank">history</a> of mobile malware, Symbian received bad press by playing host to the first, the <a href="http://www.viruslist.com/en/viruses/encyclopedia?virusid=60663" target="_blank">Cabir</a> worm. However, Windows CE wasn't far behind with the <a href="http://www.viruslist.com/en/viruses/encyclopedia?virusid=60590" target="_blank">Duts</a> virus and <a href="http://www.viruslist.com/en/viruses/encyclopedia?virusid=56883" target="_blank">Brador</a> Trojan. Even single-purpose network devices are periodically found vulnerable to network and service exploits, and vendors ought to make updates available in a timely manner.<o:p></o:p> The bad news is that mobile platform vendors are still very slow to issue operating system and application patches. The only practical way to mitigate this is through a mix of process and technology: Teach users proper skepticism of e-mailed attachments and unexpected connection or update confirmations, and implement <a href="http://usa.kaspersky.com/products/antivirus-mobile.php" target="_blank">anti-malware</a>  programs for those who just keep clicking "OK."<o:p></o:p> 3. Communications are encrypted from end to end.<o:p></o:p> BlackBerry and Sidekick users may have heard that their communications are encrypted "end to end," but e-mail and other communications are encrypted only from the phone to the phone company or service provider's servers. Beyond that point, e-mail, instant messages and file transfers may be transmitted unencrypted over the public Internet by default. <o:p></o:p> This is less of a concern for closed organizations where everyone involved uses the same services, but vendors, partners, consultants and others outside the organization often use their own e-mail addresses and smart phones on other carriers. There's no guarantee of message encryption in these cases, and the risk is no better or worse than any other Internet e-mail.<o:p></o:p> 4. The connection's secure unless I use Wi-Fi in a cafe.<o:p></o:p> Some might be concerned about the cellular connection itself. The GPRS and EDGE data protocols used by T-Mobile and Cingular are based on GSM, and GSM authentication algorithms such as <a href="http://cryptome.org/gsm-a512.htm" target="_blank">A5</a> have been <a href="http://cryptome.org/gsm-joke.htm" target="_blank">broken</a> in ways that allow a motivated eavesdropper to reconstruct voice and data conversations with only a few thousand dollars of equipment. CDMA and associated algorithms are mildly more secure (<a href="http://www.qualcomm.com.au/PublicationsDocs/authsecslides.pdf" target="_blank">PDF format</a>), but many carriers choose not to implement all of the security controls available because of performance and handset compatibility.<o:p></o:p> Use a VPN to mitigate this problem for sensitive data and make sure essential services are encrypted at the application level using SSL or similar protocols. While it might seem redundant, using a voice-over-IP client through a smart phone's VPN data connection is one way to ensure that voice calls are private. Direct SIP-compliant VoIP clients are best for this; closed-protocol applications such as Skype Mobile may try to route across a public connection even if a VPN is available. It also may relay connections between <a href="http://en.wiktionary.org/wiki/NAT" target="_blank">NAT</a> endpoints through random clients on the Internet, so it's not a good candidate in this scenario.<o:p></o:p> It's also worth noting that VoIP with AEC, one of the features of Windows Mobile 5, is not encryption. AEC refers to Acoustic Echo Canceling, not the NIST Advanced Encryption Standard ("<a href="http://www.iaik.tu-graz.ac.at/research/krypto/AES/" target="_blank">AES</a> ") described in FIPS 197.<o:p></o:p> 5. E-mails and messages are secure from prying eyes.<o:p></o:p> Whoever controls your smart phone application server has access to your data. While smart phone service providers and software packages all provide a modicum of access control, administrators with root access can always get at your information if they want.<o:p></o:p> While your corporate IT department might not be spying on marketing on behalf of finance, Obama might want to take note that congressional IT <a href="http://whitepapers.techrepublic.com.com/casestudy.aspx?docid=164813" target="_blank">organizations</a> that serve both Democratic and Republican senators have had several incidents involving e-mail disclosures to other parties. In the midst of the Mark Foley scandal, it was interesting to note a person <a href="http://www.harpers.org/sb-republicans-1160492797.html" target="_blank">described</a> in the media as a "Democratic operative" was able to retrieve and forward messages sent months earlier from a Republican representative's smart phone.<o:p></o:p> Know where messages and other data reside when sent from a smart phone. If service is provided by a neutral vendor, make sure you have a service-level agreement that considers whether your data may be commingled with other businesses -- possibly your competitors -- on the same systems. Those with specific competitive concerns ought to run their own systems using their own administrative staff. Obama would do well to use a device controlled by the Democratic National Committee or his own campaign, rather than one managed by Senate IT staff and easily influenced pages.<o:p></o:p> 6. Using a mobile phone constitutes out-of-band communication.<o:p></o:p> A phone call over a landline used to be an acceptable method for communicating out-of-band administrative information. For example, a system administrator might call you back at your desk to verbally give you a new password (which you then changed, right?). This worked because the desk phone was isolated from the network and system resources to which you were being given access.<o:p></o:p> Not so anymore. If you lose your smart phone and IT calls you back on that mobile number to confirm the trouble ticket, is it a meaningful method of verifying the identity or location of the person who answers? Of course not. Possession of the number means little if anything anymore, especially since most phones will allow answering of an incoming call even when locked. <o:p></o:p> IT help desks should cross callbacks off the list of acceptable methods of identity verification for anything to do with mobile devices or remote access. The new BlackBerry Smart Card <a href="http://na.blackberry.com/eng/ataglance/security/products/smartcard.jsp" target="_blank">Reader</a> is a viable option for those who need to authenticate using something they possess, and while similar options lag a little on other platforms, they are <a href="http://msdn2.microsoft.com/en-us/ms881565.aspx" target="_blank">available</a>.<o:p></o:p> 7. I trust the integrity of data and applications on a smart phone.<o:p></o:p> On modern desktop and server systems, file systems with journaling, database-like features and integrated backup are common. Not so with mobile devices, where almost all data integrity relies upon some sort of synchronization with a stable fixed server system for backup and management.  <o:p></o:p> Windows Mobile users can use a variety of synchronization options to ensure that messages and data on the mobile device are consistent with a central Microsoft-based repository such as Exchange, SharePoint or even <a href="http://agramont.net/blogs/conrad/archive/2007/01/10/Using-Groove-2007-as-a-_1C20_Roaming-Folder_1D20_-for-mobile-and-multi_2D00_computer-users.aspx" target="_blank">Groove</a> file-share workspaces. BlackBerry <st1:City w:st="on"><st1:place w:st="on">Enterprise</st1:place></st1:City> users have over-the-air device security options that include data synchronization and backup, and remote shutdown options for lost devices. (A product called <a href="http://www.mobilecreek.com/products.htm" target="_blank">SyncBerry</a> provides advanced sync and backup features to SyncML-capable systems, and extends some of the BlackBerry goodness to Symbian users.)<o:p></o:p> T-Mobile's Sidekick, on the other hand, stores very little data locally because it's constantly <a href="http://everything2.com/index.pl?node_id=1432028&lastnode_id=0" target="_blank">synchronizing</a> with the servers at Danger Inc., the manufacturer. If the device is lost, damaged or reset, data can be reloaded on the device by logging in with a name and password. However, this means that data is stored at a service provider with which individuals have a rather one-sided service-level agreement unsuitable for corporate use.<o:p></o:p> All of this can be protected by setting the device to require a passcode at start-up. If the wrong passcode is entered four times on Sidekick, local data is erased but can be restored by a remote password reset on the management Web site. Security administrators might lament the scarcity of people who use this feature, but it's interesting to note that the young <a href="http://www.evanwashere.com/StolenSidekick/" target="_blank">thief</a> who acquired up the now-famous Sidekick II in New York last year was identified and arrested only because she had access to the phone, sent messages and took pictures of herself -- which then synchronized with the legitimate owner's account on the Danger servers.<o:p></o:p> What about application integrity? OK, you say, you'll just install digitally signed or approved applications. A few months ago, some enterprising pot-stirrers managed to buy a BlackBerry code-signing key from RIM (arguably the most security-oriented of the smart phone vendors) for <a href="http://securitywatch.eweek.com/exploits_and_attacks/cracking_the_blackberry_with_a_100_key.html" target="_blank">$100</a>, no questions asked. This is all bad. Users tricked into giving network access to unsigned applications may be opening themselves up to all sorts of spyware, message relay and other malware, but signed applications don't even require consent to suspicious prompts. It's far better to teach astute users about acceptable applications and forbid the rest from installing anything. The choice of installable applications ought to be from a whitelist -- or no list.<o:p></o:p> 8. Information deleted from a smart phone is gone, right?<o:p></o:p> Most converged devices have relatively small storage capacities, and use variants of the venerable FAT file system. When a file is deleted, the markers for the beginning and end of the data on the storage media are removed so that it is no longer retrievable by normal means (orphaned). However, the actual data remains until it's overwritten. There are no guarantees against orphaned data. In fact, the whole practice of cell phone forensics rests on the availability of orphaned data and logs.<o:p></o:p> I'm not aware of any smart phone that comes with a secure delete function to remove orphaned file system data. Perhaps, Apple will include the file system wiping <a href="http://www.apple.com/macosx/features/security/" target="_blank">option</a> from OS X in its forthcoming iPhone, but it's not present in any of the other major players' offerings. With many smart phones offering basic word processing and spreadsheet applications, residual data from deleted copies becomes even more of an issue.<o:p></o:p> IT staffers responsible for disposal of outdated smart phones should use tools to ensure that residual data is removed. The simple method is to copy and erase chunks of data onto the device in a manner that fills the flash memory or hard disk, but forensically sound methods are available from various <a href="http://www.paraben-forensics.com/handheld_forensics.html" target="_blank">vendors</a>. If the device memory can't be erased, it should be destroyed -- a damaged but repairable smart phone ought not be found in the trash. Those resorting to a hammer are <a href="http://gizmodo.com/gadgets/laptops/actual-video-of-an-exploding-laptop-battery-214322.php" target="_blank">advised</a> to remove the Li-Ion battery first.<o:p></o:p> 9. Spying on my smart phone is hard.<o:p></o:p> Think spying on your activities is hard? Think again. Most smart phones have no equivalent of Bluetooth authentication when plugged in; they just become slave USB devices and give up all your data. Worse yet, a rogue employee, jealous husband or political opponent can buy backdoor malware ... uh, "remote phone monitoring" software <a href="http://www.flexispy.com/" target="_blank">here</a> and keep ongoing tabs on communications. If they manage to install the spendy version on your phone (or trick you into doing it), it even includes remote microphone activation and generates a tidy Excel spreadsheet of your activities each day.<o:p></o:p> Flexispy is cheap, oriented toward consumers and very worrisome. It's only available for Symbian so far, but less-polished remote viewing software or illicit copies of management tools are available for BlackBerry, Windows Mobile and other platforms. It's not clear if anti-malware products send alerts upon finding these, so the best policy now is to educate users on physical security and admonish them not to install unexpected software or updates.<o:p></o:p> 10. Abuse is minimal because the network and phones are constrained.<o:p></o:p> Four words: Remember ASCII art porn. Network miscreants will work with what's available, and resource limitations only make those inclined to misbehave do so in more creative ways. The difference is that smart phones are quite capable, and modern 2.5G and 3G phone networks provide surprisingly adequate bandwidth. For example, there are now multiple BitTorrent clients for <a href="http://www.symbian-freak.com/news/006/10/sym_torrent.htm" target="_blank">Symbian</a> as well as other platforms, some phones are adept at seamlessly switching between cellular and unsecured Wi-Fi networks, and with the price point for 4+ GB flash cards dropping below $100, there's lots to worry about.<o:p></o:p> To paraphrase Steve Jobs, misuse of technology is a social problem, not a technological one. Having a well-defined policy for the use of converged devices is essential prior to deployment. Conversely, rolling out smart phones without proper guidance will lead to all sorts of havoc. Users might respect pay-per-minute airtime as a corporate asset, but unless instructed otherwise they'll think of flat-rate data services as free connectivity on someone else's network (not covered by your policy), and the phone itself as corporate tribal adornment suitable for display anywhere, anytime.<o:p></o:p> More to consider<o:p></o:p> Am I advocating Naomi Campbell's <a href="http://galleryoftheabsurd.typepad.com/14/2006/04/the_naomi_campb.html" target="_blank">method</a> of disposing of one's fancy mobile? No, in fact, just this month I bought a new smart phone. While I'm no fan of troublesome devices -- two colleagues recently commented that their new WM5 phones rarely crash more than once per day now -- mobile e-mail and Internet access are quickly becoming de rigueur. I made a list of the functions I needed and tried to avoid models that included features I would not use or could not secure.<o:p></o:p> Readers looking for a structured set of criteria for evaluating and selecting a specific smart phone product are encouraged to read NIST Special Publication 800-48 (<a href="http://csrc.nist.gov/publications/nistpubs/800-48/NIST_SP_800-48.pdf" target="_blank">PDF format</a>). It's a little dated, but when mobile system and application developers are rediscovering every mistake they made a decade ago with remote desktop and laptop systems, these old documents are right on the mark.<o:p></o:p> Jon Espenschied has been at play in the security industry for enough years to become enthusiastic, blasé, cynical, jaded, content and enthusiastic again. He is currently a senior security consultant in <st1:City w:st="on"><st1:place w:st="on">Seattle</st1:place></st1:City>, where his advice has been ignored by CEOs, auditors and sysadmins alike.<o:p></o:p> This column has been edited to correct a misstatement: The Symbian OS is in fact owned in part by Nokia and Sony Ericsson.<o:p></o:p> <o:p> </o:p> </div> </div> posted by Made4biz Security at <a class="post-footer-link" href="http://www.made4biz-security.com/log/2007/03/fyi.html" title="permanent link"> 2:42 PM </a> <a href="http://www.blogger.com/email-post.g?blogID=3622592209194769260&postID=1182037405400295499" title="Email Post"> </a><a style="border:none;" href="http://www.blogger.com/post-edit.g?blogID=3622592209194769260&postID=1182037405400295499" title="Edit Post"> </a> </div>   <div id="comments"> <a name="comments"></a> <h4>0 Comments:</h4> <dl id="comments-block"> </dl> <a class="comment-link" href="http://www.blogger.com/comment.g?blogID=3622592209194769260&postID=1182037405400295499">Post a Comment</a> <a href="http://www.made4biz-security.com/log/security_log.htm"><< Home</a> </div>  </div></div>  </TD> <TD valign = "top" width = "150"> Made4biz Security Translating real-world security knowhow into state of the art security systems. <h2 class="sidebar-title">Links</h2> <a href="http://www.made4biz-security.com/">Made4biz Security</a> Turn on Sound for Demos: <a href="http://made4biz-security.com/demos/scenario1.swf">Bill Gates Demo (Location-based)</a> <a href="http://made4biz-security.com/demos/scenario2.swf">Elvis Demo (Location/Context-based)</a> <a href="http://made4biz-security.com/demos/scenario3.swf">Clint Eastwood Demo (Temporal-based)</a> <h2 class="sidebar-title">Previous Posts</h2> <ul id="recently"> <li><a href="http://www.made4biz-security.com/log/2007/03/dynamic-security-is-solution-for.html">Dynamic! security is the solution for the followin...</a></li> <li><a href="http://www.made4biz-security.com/log/2007/03/identiwall-will-soon-protect-you-from.html">IDentiWall will soon protect you from ID theft</a></li> <li><a href="http://www.made4biz-security.com/log/2007/03/stolen-tjx-data-used-in-florida-crime.html"> Stolen TJX data used in Florida crime spree Mat...</a></li> <li><a href="http://www.made4biz-security.com/log/2007/03/dynamic-security-with-its-physical-and.html">Dynamic Security with its physical and ICT securit...</a></li> <li><a href="http://www.made4biz-security.com/log/2007/03/dynamic-security-and-identiwall-are.html">Dynamic Security and IDentiWall are the answer to ...</a></li> <li><a href="http://www.made4biz-security.com/log/2007/03/identiwall-is-solution-and-its-coming.html">IDentiWall is the solution and it's coming soon</a></li> <li><a href="http://www.made4biz-security.com/log/2007/03/just-wait-and-see-how-identiwall.html">Just wait and see how IDentiWall tackles the hacki...</a></li> <li><a href="http://www.made4biz-security.com/log/2007/03/dynamic-security-coupled-with.html">Dynamic Security coupled with IDentiWall resolve t...</a></li> <li><a href="http://www.made4biz-security.com/log/2007/03/identiwall-makes-phishing-irrelevant.html">IDentiWall makes phishing irrelevant</a></li> <li><a href="http://www.made4biz-security.com/log/2007/03/identiwall-coupled-with-dynamic.html">IDentiWall coupled with Dynamic Security is your b...</a></li> </ul>   <a href="http://www.blogger.com"><img src="http://buttons.blogger.com/bloggerbutton1.gif" alt="Powered by Blogger" /></a> Subscribe to Posts [<a target="_blank" href="http://www.made4biz-security.com/log/atom.xml" type="application/atom+xml">Atom</a>] <a href="http://technorati.com/claim/enq6cvhr2h" rel="me">Technorati Profile</a> <a href="http://made4biz-security.com/log/rss.xml">RSS Syndication</a> </div></div>  </TD></TR> </TABLE>  <div id="footer"><hr />   </div>  <a href="http://made4biz-security.com/">Made4Biz Security Inc</a> </div>  </div></div></div></div>  </body> </html>

Made4Biz Dynamic IT Security News

Sunday, March 25, 2007

FYI

Ten dangerous claims about smart phone security