Mobile Device Security Common Mobile OS Android iOS Windows Mobile Symbian ? RIM (Blackberry)? Who are attackers targeting? In 2013 Android accounts for "nearly all mobile malware." -- McAfee report

Android The good  built on top of Linux kernel  apps largely written in Java (Apache Harmony)  open source The bad (challenges)  must support different hardware (phones, netbooks, GoogleTV, cameras, Google glass…)  version proliferation (Cupcake, Donut, Éclair, Froyo, Gingerbread, Honeycomb, Ice Cream Sandwich, Jelly Bean, KitKat …)  legal issues  application piracy

Android Security Security a priority in the software life cycle Mandatory app sandbox  each process is a subject & has its own ID  safe mode ensures the system partition is read-only  the API includes common encryption ciphers  user consulted to grant permission to new app Application signing  every application must be signed with a public key  CA not required and no CA verification is currently performed Other the kernel intercepts common software vuls (buffer overflow, integer overflow, heap corruption, format string errors) hardware-based Never eXecute

iOS Layers of Security  secure boot process  secure system install/upgrade  app security  runtime protections  file encryption  passcode security  support for network security standards

iOS ROM Secure Boot Process Boot Program ApplePublicKey 1) run boot program (integrity guaranteed by ROM) 2) Remaining system code is signed by Apple 3) Recovery to iTunes if necessary

iOS System install/upgrade

iOS app security  provided software (Mail, Safari, etc.) signed by Apple  other apps from registered developers are signed Apple supplies certificates to registered developers.  firms can use Apple service for in-house only software runtime protections  each app has its own home directory for files  most processes run in a non-privileged mode  all OS code is in read-only memory  processes are assigned to random memory locations

iOS file encryption crypto engine for AES-256 and SHA-1 UID | GID crypto engine for AES-256 and SHA-1 There is also a random number generator using interrupt timing.  Each file encrypted with _________ key  Each per-file key is wrapped (encrypted) with _________ key  Each class key is encrypted with UID (and possibly a passcode) Each file's metadata includes wrapped per-file key and class key encrypted with ____________ key

iOS passcode security  The passcode is "tangled with UID  Passcode checking ________ to 80 msec.

iOS support for network standards  secure low-level protocols (SSL, TLS)  secure higher-level VPN (L2TP, PPTP)  wi-fi via 128-bit AES encryption  …and many others