Smartphone Security How safe are you?

Main Points 1. Malware/Spyware 2. Other Mischief 3. How a phone might get infected 4. Staying Safe a. Malware b. Loss c. WiFi/Bluetooth

I. Malware/Spyware on My Phone - What Can Go Wrong? QUERY1: If a hacker got into your phone, what would you NOT want him/her to see &/or copy…?

Hackers can see and in some cases even alter:  calendars, address books, contact lists  photos  iTunes music files  text messages, old and new (even deleted ones)  details about every phone call  the location of the phone at all times  Web browsing details and history  Plus, all your subsequent phone calls could be recorded and forwarded to a third party

Hackers can make calls from your phone without your knowledge QUERY 2: What websites or numbers would you NOT want a hacker to call from your phone…? Malware/Spyware on My Phone - What Can Go Wrong?

 Porn sites … $$$  Overseas numbers … $$$  The hacker herself. This turns the phone into a bugging device because he/she can hear everything you say and (maybe) do  Your contacts in the middle of the night

QUERY 3: Is it safe to conduct financial transactions over my cell phone…? Malware/Spyware on My Phone - What Can Go Wrong?

 In January, 2010, a single developer created fake 99-cent Android apps for over 50 banks. The app prompted users for their banking username and passwords [Notes]  In 2011 a hacker built a botnet that could steal data such as online banking credentials off “jailbroken” iPhones [Notes]

2. Other Mischief  Have you ever heard of a DDOS (distributed denial of service) attack? What is it?  Can cell phones be directed by a “slavemaster” to slam their carrier with so much traffic it can’t handle it?  Yes, they can

3. How Does a Phone Get Infected?  Does a hacker need physical access to your phone?  NO  So how does the malicious code get there…?

Malicious software can be:  downloaded by a click on a website link  opened in an /text attachment  introduced by an infected app  introduced simply by clicking on Quick Response codes (those black-and-white squares starting to show up in ads)

Via Bluetooth?!  Simply leaving your Bluetooth enabled while in a public place allows an intruder access  Hacker simply downloads software onto a laptop (available free on the web)and adds a Bluetooth antenna  Next slide gives examples of Bluetooth hacker activities

 “Bluesnarfing” - downloading any and all information from a hacked device (for example, address book information, photos, calendars, SIM card details)  Hacker could send a “corruption code” and completely shut down the phone and make it unusable  “Bluebugging” - hacker makes the compromised phone call another device (the one the hacker is using, or long-distance calls to worldwide locations)  The hacker could make “micro-purchases” with the hacked phone which show up on the subscriber’s bills phones-and-how-to-protect-yourself/

 GOALS  1. keep malware off your cell phone  2. protect the information stored on your phone if it is lost  3. protect from intrusion/theft during Wi-Fi or Bluetooth transmission  Each of these three will be discussed next… 4. Staying Safe

4a. Keep Malware off Your Phone  Do not jailbreak your phone  Do not click on website links from unknown sources ( 1/3 of smartphone users have been negatively affected by a link they clicked)  Only download applications from trusted sources, such as reputable application markets ( Remember to look at the developer name, reviews, and star ratings)

 Do not click on multimedia attachments in texts/ s from unknown sources  Always check the permissions an app requests  Using an official banking application is safer than banking through your mobile’s online browser

 Download a trusted mobile security anti-virus app for your phone  Learn how to update your operating system ( software/). software/  Beware of Porn sites ( Nearly one-quarter of malware on phones and tablets comes from visits to porn sites)

How are we doing (malware) ? Student responses n=106 total n=85 with smartphone I have or definitely would I haven’t but I might I haven’t and would not Don’t know Do you open multimedia attachments received in texts or s from unknown sources? 45%16%33%6% Do you download apps that request access to your contacts or other personal information? 38% 10% 45% 7% Have you installed anti- virus software on your smartphone? Yes 24% N/A No 63% Don’t know 13%

Why might people click on website links or open multimedia attachments from unknown sources?

4b. To minimize damage if phone is lost or stolen  Password/passcode protect your phone  Log off mobile apps (Logging in every time prevents someone from having access if you lose your phone)  Backup and secure your data at least monthly (Contacts, documents, and photos, e.g.)  Install security apps that enable remote location and wiping  Wipe data on your old phone before you donate, resell or recycle it  Report a stolen smartphone

How are we doing (if lost)? YesNo Don't Know To wake up after idle, is a password or passcode required on your smartphone? 54% N/A 45% 1% Always Some- timesNever Don’t know Do you disconnect off applications such as Facebook and Gmail when you are done using them? 19%30%45%6%

Why might people not password protect their phone?

4c. Wi-Fi/Bluetooth transmission  When transmitting information via wireless networks, use encryption  Disable Bluetooth when you are not using it

How’re we doing (WiFi/Bluetooth) ? Always or Most of the Time Some- times Never Don’t use this feature Do you disable Blue Tooth when it's not in use? 55% 7% 13% 25%

Why might someone keep Bluetooth enabled when not using it?

Last question – have you or anyone you know had any type of smartphone security breach? Very Serious A bit of a problem Some- what annoying Harm- less No one I know has I or someone I know personally has experienced a security threat with their smart phone that was… 3% 9% 22% 4% 62%

 Describe…