Who owns your phone? Who feels that they have the right to use your phone for their purposes or on your behalf?

Your Phone Code Data OS Activity Micro-phone Battery Peripherals Competitors Your Phone Code Data Application Authors Your Keeper OS Activity Phone Company Your Employer Camera Micro-phone Network Location Battery Law Enforcement Hardware Manufacture Peripherals Identity Mal OS Author

IOS Security Architecture All apps must signed by Apple To reduce malicious code Quick erase of key store Prevents data access, permanently Backups use different keys Firmware non-readable key (UID) To prevent cloning

IOS Security Architecture Signed Applications Data Library/Device Permissions File Keys Signed OS File Metadata Class Keys Effaceable Storage Boot Loader Phone UID Firmware Apple Root Certificate

Android Security Architecture Linux file system permissions model All apps must be signed Apps run in their own user space “eXecute Never” markings Device resource permissions Confirmed on install Accept all or go away

BYOD Can one device make your kids happy and let IT security sleep nights? Being pushed by Apple With root, all security arrangements are subvertable (futile?) Several venders (e.g. Good) propose walled gardens

HTML5 Security OWASP Top Ten SSL Iframe sandbox Cross Site Scripting (XSS) More opportunities in HTML5 Validate ALL input Make sure data is data and not executable! SSL Secured channel (privacy issues) Server authentication Post vs Get Iframe sandbox Hybrid mobile/web applications Server access to native phone features

References IOS Security Architecture Anroid Security Architecture http://images.apple.com/ipad/business/docs/iOS_Security_May12.pdf Anroid Security Architecture http://source.android.com/tech/security/index.html http://developer.android.com/guide/topics/security/permissions.html OWASP https://www.owasp.org/index.php/Top_10_2010-Main http://html5security.org https://www.owasp.org/index.php/HTML5_Security_Cheat_Sheet

Thank You Robert Klerer ListYourself.net inc. robert@listyourself.net