mobilesecuritylandscape

8/7/2019 MobileSecurityLandscape

http://slidepdf.com/reader/full/mobilesecuritylandscape 1/27

Feature Language Support Encryption APIsOperating System

iPhone OS

Blackberry

iPhone Apps can only bedeveloped in Objective-C. The

applications can invoke Clibraries and C code.

iPhone provides a Common Cryptolibrary in the libSystem dynamic

library. CFNetwork is a high-levelAPI that can be used byapplications to create and maintainsecure data streamsand to add authenticationinformation to a message.Block Encryption and decryption isalso supported by the Supportedby the Certificate, Key and TrustServices API. Storage encryptioncan be achieved using KeyChainAPI.

The BlackBerry devicesupports MIDlets (Javaapplications that usestandard MIDP and CLDC APIsonly) and Java applicationsthat use the BlackBerry APIs.

The RIM crypto API supports a widerange of asymmetric, symmetricand hashing algorithms. It has aKey Store API and a Messaging APIthat is CMS compliant.



Android

Symbian Platform

All apps are written in Javaand executed within a customJVM called Dalvik VirtualMachine. Development in C ispossible but apps have to beexternally compiled and thenloaded.

Does not have support for device-level encryption. However,supports the javax.crypto API forcreating encryption capableapplications. Bouncycastle's J2MEprovider comes bundled withAndroid.

Applications can bedeveloped for Symbian usingC++ or J2ME.Using Symbian's WebRuntime Tools that supportHTML/ JavaScript/ CSS, webapplications can bedeveloped, distributed andinstalled on Symbian devices.

Supports the Security and TrustServices API (SATSA) for Java MEthat defines a set of APIs thatallows applications tocommunicate with and accessfunctionality, secure storage andcryptographic operations providedby security elements. Supports theSATSA-CRYPTO package to enable

symmentric and asymmetriccryptography.

Also has C++ classes for OS basedencryption and decryption.Another alternative is use of Bouncycastle's Lightweight CryptoAPI.



Windows Phone Third-paty applications can bedeveloped for Windows Phoneby- writing native code withVisual C++- writing Managed code thatworks with the .NET Compact

Framework- Server-side code that can bedeployed using InternetExplorer Mobile or a mobileclient on the user's device.There is no J2ME version forWindows Phone.

Windows Mobile providescryptography services that enableapplication developers to addcryptographic security to theirapplications. These are available inthe form of Cryptography APIs andCryptographic Service Providers

(CSP).

Windows Phone also supportsDevice Encryption which allowsencryption os internal as well asexternal memory cards using apassword that is itself encryptedand stored using the Device LockPIN.



Certificate Management SSL/ TLS support

iPhone provides the the KeychainServices API and the Certificate,

Key, and Trust services API, whichin turn communicate with theinternal Security Server.

In iPhone OS, an application canaccess only its own items in thekeychain—the user is never askedfor permission or for a password.

Supports TLS/ SSL. Also has aCFNetwork API, a high-level C API

that makes it easy to create,send, and receive serialized HTTPmessages.Because CFNetwork is built ontop of Secure Transport, datastream can be encrypted usingany of a varietyof SSL or TLS protocol versions.

The RIM crypto API provides aCertificate Management API and aKey Store API.

Data can be encrypted overSSL/TLS for the entire connectionbetween BlackBerrysmartphones and the applicationserver. The RIM crypto APIprovides a WTLS and a TLS API.



Supports java.security.certpackage that provides all theclasses and all the interfacesneeded to generate, administerand verify X.509 certificates.

Supports javax.net.ssl packagethat provides all the classes andinterfaces needed to implementand program the Secure Socketabstraction based on the SSLprotocol SSSLv3.0 or TLSv1.2.

OpenSSL is also available onAndroid as a standardcomponent. The Androidjavax.net.ssl package uses theOpenSSL Library to implementthe low level SSL functionality.

Certificate and Key Managementis supported through the SATSAPKI UserCredentialManagementclass.

Another alternative is use of Bouncycastle's Lightweight CryptoAPI.

Symbian Platform SSL/ TLS clientfunctionality through both nativeC++ API provided by the OS andthrough MIDP.



Windows mobile provides aCredential Manager that consistsof a set of APIs that applicationscan use to cache and obtaincached credentials. The supportedCredential types includeCertificates.

Windows Mobile only supportsclient certificates using itswireless authenticationcomponents. Machine certificatesare not supported.

Windows Mobile device shasinbuilt SSL support for HTTPprotocol. Its NATIVE SSL supportis however lacking as one socketcan only receive and send at onetime. So for full duplexconnection two SSL sockets are

needed.



VPN Support Authentication Support

In iPhone OS, there is no API forSecure Transport. CFNetwork API

is used for secure connections.

The iPhone OS security servicesdo not provide an authentication

interface. It relies on the device'sPIN for Authentication.

Supports VPN functionality onlythrough a Blackberry EnterpriseServer. Does not have a bundledVPN client that can connect tothird-party VPN servers.

By default, Blackberry supportssimple password deviceauthentication. Server-side strongauthentication can be built intoapplications using J2ME and theRIM crypto API.



The supported types of VPN are- L2TP/IPSEC pre-shared keybased VPN- L2TP/IPsec certificate basedVPN- L2TP only VPN- PPTP only VPN

Also, a VPN client for openvpn isavailable but it requires rootaccess to the phone to bestarted.

Supportsjavax.security.auth.pluginpackage that provides apluggable and stackableauthentication system based onideas and concepts from the Unix-PAM module.

Vpnclient software is used toestablish secure connectionsfrom a mobile device toprotected networks (e.g. acompany intranet) over insecurenetworks such as the Internet.Vpnclient is based on openstandards and it can be usedwith various security gateways

produced by different vendors.

Symbian also supports IPSec.

Authentication is supportedthrough the SATSA PKICMSMessageSignatureServiceclass. This class provides anauthenticate method that can beused to invoke DSC basedauthentication capability on theunderlying device.Password-based authentication

can be supported using thestandard J2ME Authenticatorclass.



By default, Windows Mobilesupports virtual privatenetworking (VPN),using either Layer Two TunnelingProtocol with Internet ProtocolSecurity encryption (LT2P/IPSec)or Point-to-Point Tunneling

Protocol (PPTP).

To achieve networkauthentication the WindowsMobile Security Support ProviderInterface (SSPI) allowsapplications to access DLLs —called Security Support Providers(SSPs) — that provide common

authentication protocols likeKerberos, NTLM and SSL.Additionally, Windows Mobile-based devices can dial intoRemote Access Servers by usingone of the followingauthentication protocols:- Password AuthenticationProtocol (PAP)- Challenge HandshakeAuthentication Protocol (CHAP)- Microsoft CHAP v1 & 2



Digital Signatures Authorization

Supported by the Certificate, Keyand Trust Services API. iPhone

has Apple's Fast EllipticEncryption (FEE) implementationthat has a small memoryfootprint.

The iPhone OS security servicesdo not provide an authorization

interface. It relies on thesandboxing to achieve this. Eachapplication is put in a sandboxthat restricts the application tousing only its own filesand preferences, and limits thesystem resources to which theapplication has access.

Digital Signatures are supportedthrough Core Crypto API orthrough the CMS API which isPKCS #7 compliant. Supports ECbased cryptosystems.

BlackBerry applications can writeonly to the BlackBerrydevicecmemory that theBlackBerry® Java® VirtualMachine uses; they cannotaccess the virtual memory or thepersistent storage of other applications unless theyare specifically granted access todo so through the use of specialBlackberry APIs. Research InMotion must digitallysign a BlackBerry JavaApplication that uses theseBlackBerry APIs, to provide anaudit trail of applications thatuse sensitiveAPIs.



BouncyCastle has a J2ME providerthat can be used on Android. Thisprovider comes bundled withAndroid however certainalgorithms like EC do not seem tobe working. This will have to beinvestigated further.

The Android manifest file allowsdevelopers to define an accesscontrol policy for access tocomponents- Each component can beassigned an access permissionlabel

- Each application requests a listof permission labels which arefixed at install

When an application requestspermissions to access otherapplications or OS features, theOS either automatically allows ordisallows based on certificates orprompts the user.

Digital Signatures are supportedthrough the SATSA PKICMSMessageSignatureServiceclass. This class provides a signmethod that can be used toinvoke signature capability on theunderlying device. The signaturesare generated in accordance withCMS - PKCS #7.

Currently, Symbian Platform doesnot support ECC.

Symbian platform has a UNIX-style capability model(permissions per process, notper object).

Symbian supports Data cagingwhich means that theapplications and the users haveaccess only to certain areas of

the file system. In practice theapplications can access theirown private directories anddirectories that are marked asopen.Privileges can be granted byuser at installation time, throughbeing Symbian signed or bydevice manufacturer.



Digital Signatures based uponRSA are supported.

Windows Phone has the conceptof Normal and Privilegedapplications.

Normal applications cannotaccess protected registry keysand system APIs.

Privileged Applications canaccess all registry keys and allsystem APIs and can installcertificates on the device.Privileged applications canswitch to run kernel mode.Privilege is assigned toprocesses rather than tomodules.



Application Deployment

Digital signatures are required onall applications for iPhone OS. The

developer first signs an application.It is then signed by Apple.

An application thathasn’t been signed by Apple will notexecute.

(The BlackBerry device allows thedownloading of all third-party Javaapplications by default.BlackBerry smartphone applicationsusing the RIM crypto API requiredevelopers to sign and registertheir applications with Research InMotion (RIM).



All Android applications (.apk files)must be signed with a certificatewhose private key is held by theirdeveloper. This certificate identifiesthe author of the application andmay even be self-signed.

Digital signatures by Symbian arerequired on all trusted applicationsfor Symbian OS. These are appliedthrough the Symbian Signed program.

An application thathasn’t been signed by Symbian willbe an untrusted application.



Windows Mobile devices areavailable in several securityconfigurations. The typicalconfigurations are locked, third-party signed, prompt, and security-off.

Windows Phone has the concept of Normal, Privileged and Blockedapplications. Privilegedapplications are those that aresigned using a Certificate availablein the Privileged Execution TrustAuthorities Store. Privilegedapplications can be created bygetting them signed by Verisign -a Microsoft Partner.



S.No Category

1

Software Modification Threats

2 Data Threats

3

Threats due to Malware

4 DoS Attacks



Threat Description

Moderate

Viruses, Worms, Trojans

Spyware

Rootkits

Jailbreaking

Attack via faulty or illegal privilegedcode extensions

Data extraction from Lost/ stolendevices



social engineering attacks

Data Theft

Copyright Abuse

Device Theft

Theft of Service

Taking someone’s pictures, messages,phonebook or file data without the

permission of the owner

Violating paid for content – e.g. byrecording and distributing pay-per-view films

phones are a highly lucrative item andphone theft is a massive problem. Re-

enabling stolen phones is a key driverfor hacking phones

stealing someone else’s minutes ordata or getting free service from thenetwork



Denial of Service

Disruptive / Anarchistic Attacks

Interception

Facilitators

Fraud

preventing normal operating of aphone or preventing the access to oroperation of a network

attacks in which the intention is tocause upset, distress and disturbanceto the user, network or corporationsuch as a virus (could include Denial of Service).

listening into someone’s calls orgetting access to messages / dataduring transit

some attacks are deliberatelydesigned to create a staging post forother forms of attack.

Getting financial gain by deceptivemeans



Method of Propagation Resolution

WWW

MMS, SMS, Email, Bluetooth, WiFi,User Installation, Self Installation,Memory Card, USB



A distrusting partner or spouse cansecretly download the free application,

called PhoneSnoop, onto yourBlackBerry, remotely turn on themicrophone, and listen toconversations held in proximity to thedevice.



Major Players

mobilesecuritylandscape

Documents