Our Topic: Mobile Security

1
Introduction

• Our Topic Mobile Security
•  
• Why is mobile security important?

2
Research Questions
1. Why aren't current mobile security systems
effective at preventing mobile attacks? 2. What
is the most effective form of attack vector for
todays attackers? 3. What can be gained from
attacking a mobile phone? Do hackers attack
phones for the same reason they attack
computers? 4. Why is mobile security important
for the future? 5. What kinds of security
standards or methods will best prevent future
attacks?
3
Current Risk Communication

• I Phone
• Action Based
• An app uses location user will then be asked to
  allow or disallow
• G Phone
• Permission Based
• Lists set of permissions that application is
  granted

4
Problems with Risk Communications

• Current methods do not take context into account
• Context is related to a file
• The context will contain the history of a file
  and what other applications have access as well.
• Very important because helps prevent cover
  channel attacks
• Leaves system vulnerable
• especially cover channel attacks

5
(No Transcript)
6
Why Our Framework?

• Our framework combines the two most common
  frameworks (I Phone G Phone).
• Our framework takes context into account.
• We feel the context will allow us to be able to
  protect users from cover channel attacks.

7
History of Considerations

• We observed different mobile security systems and
  found
• Pre-download there is very little
  straightforward intervention
• In Andriod a list of permissions is present but
  the user may not understand that
• Interventions Systems try and predict attacks
  to directly as opposed to providing users with
  information (similar to computer antivirus)
• Theoretical solutions suggest any file modified
  by a permission should be stopped.

8
What is Considered Dangerous?

• Risky permissions for possibly fraudulent
  application
• Most Dangerous permission to send through
• Phone calls, Internet(WiFi), MMS, bluetooth, and
  email
• Medial Danger access to view personal info
• Contacts list, incoming calls, texts, ect
• Dangerous Enough access to location or files
• Camera, voice, global search, and GPS access

9
Why Intervene at Download

• Permission to use a sending vector
• the internet, MMS, bluetooth, or email
• Inform the user of the possibility of personal
  information compromise without consent or action
• In other security systems
• It is not explicitly specified what can go wrong
  by accepting these permissions
• The permissions are generalized into allow accept
  format

10
Why Intervene Otherwise

• Sending Files
• Files accessed by a sending vector without user
  direction are potentially compromising
• Many actions can modify files, but that doesnt
  directly hurt user
• User Sends Compromised Files
• Files modified using permissions can contain
  personal information
• We dont want users to develop bad habits.
• Similar to very long terms of service files
• Inform the user to make better decisions

11
Attack Scenario

• You are hanging out on the Android Marketplace

12

• You find this cool application called PingDroid

13

• This screen comes up before you install it

14
(No Transcript)
15
Intervention

• This is the first place where we want to
  intervene.
• Instead of listing permissions we might want to
  say
• Hey, are you sure you want to download an
  application that can take your location and
  photographs and send them over the internet?

16

• You say, well ok maybe I still want this.
• The application is running for a while and you
  forget about it.

17

• Later, you pick up your phone to notice it has a
  message for you.

18

• Intervention Your phone stopped PingDroid
• PingDroid may be sending a picture along with
  your location to anyone on the internet

19
What Happens Next?

• You, the user, have just found your application
  acting in a way that may be malicious
• If you decide that is what the application is
  supposed to do, allow the app to continue
• If not, you may stop the app from compromising
  your information
• The only way our security system intervenes again
  is if another kind of information is compromised
  or the sending location changes (IP address)

20
Attacking Scenario 2

• This scenario could be used by several
  applications.
• Ezimbra is a photo editing application that has
  the ability to post photos on the internet.

21
Attack Scenario 3

• People use more and more passwords and "secure"
  accounts with growth of technology
• Bank accounts, e-mail accounts, eBay/Amazon, etc.
• Palm attempts to help keep these accounts
  organized, but at what cost?

22
Attack Scenario 3

• How does SplashID work?
• Where are the security issues?
• How can these issues be averted?

23
Attack Method 4
Our system would inform the user of the level
of risk involved with the actions being preformed
by the application This could be done prior to
the user installing the update or after the
update tries to run malicious code
24
Future Work
Developing a system that uses past cases to
exploit malicious actions Final Goal
Software designed to alert user of adverse actions
25
Research Question Answers

• Obviously, new attacks and applications are
  produced daily.
• Security that tries to stop attacks in the
  background have not been successful
• There is no way to predict how an application
  will attack you, but you can predict the attack
  vector
• If the security system doesnt accurately assess
  a malicious situation, no action is taken

26
2. Most simply, Web applications account for 41
of all financial and 52 of all tech pathway
attacks There are more common vectors of attack,
but they are direct (such as bluetooth hacking).
These attacks can be easily prevented and are
not hidden. They are not the most controversial.
Source http//www.mobileenterprisemag.com/ME2/Sit
es/dirmod.asp?sidnmtypeMultiPublishingmodPu
blishingTitlesmidB4771C6F22F34E4CA3FFFDA61E0EA2C
5tier4id8C626442A70740CFB6A62EC3C7A339E8SiteI
D87D3DA363DA24D189035C60D0D8A4775
27
3. Your Personal information. Contact
information Financial information Location Photogr
aphs Personal data Compromising information
28
4. In the future, nearly everyone will have a
cell phone. In 2009, there were 4.6 billion cell
phone subscriptions. That number will increase in
2010. With the growing popularity of smart
phones, the cellular network will have a huge
market to take advantage of.
29
5. We have seen so many different kinds of attack
with new attacks happening each day. If there are
new attacks that work, then the current security
systems arent working. The users informed
decision and intuition should be much better for
prevention than a system that may take no action
30
(No Transcript)