An Inside Look at Mobile Security Android & iOS Zachary Hance & Andrew Phifer Dr Harold Grossman

Introduction As of February 27 th, 2012, according to techcrunch.com, “Explosive growth. That’s Android. Google’s mobile platform is up 250 percent over last year and, according to Andy Rubin, SVP, Mobile and Digital Content, Google is seeing 850,000 activations every day.” According to dailymail.co.uk, “Apple’s total figure of 250 million activations of devices running iOS, including iPods, iPhones, and iPads. In November last year, Android was already standing at 200 million activations.”

Mobile Security Risks – Top 10 1.Insecure Data Storage 2.Weak Server Side Controls 3.Insufficient Transport Layer Protection 4.Client-Side Injection 5.Poor Authorization and Authentication 6.Improper Session Handling 7.Security Decisions via Untrusted Inputs 8.Side Channel Data Leakage 9.Broken Cryptography 10.Sensitive Information Disclosure

Insecure Data Storage Resulting from: -Not encrypting data -Caching data not intended for long-term storage -Weak or global permissions -Not leveraging platform best- practices Impacts from this attack: -Confidentiality of data lost -Credentials disclosed -Privacy violations -Non-compliance

Weak Server Side Controls Resulting from: -Not being able to trust the client (can’t always assume) -Applies to the backend services Impacts from this attack: -Confidentially of data lost -Integrity of data not trusted

Insufficient Transport Layer Protection Resulting from: - Complete lack of encryption for transmitted data -Weakly encrypted data in transit -Strong encryption, but ignoring security warnings -Ignoring certificate validation errors and falling back to plain text Impacts from this attack: -Man-in-middle gets access to data -Tampering with data -Confidentiality of data is lost

Client Side Injection Resulting from: -Apps using browser libraries -HTML and SQL injections Impacts from this attack: -Device is compromised -Toll fraud -Privilege escalation

Poor Authorization and Authentication Resulting from: -Relying on immutable values to authenticate a user’s device Impacts: -Privilege escalation -Unauthorized access

Improper Session Handling Resulting from: Mobile apps running for long periods of time and the ways they maintain sessions (ex. HTTP cookies, OAuth tokens, and SSO authentication devices) Impacts Privilege escalation Unauthorized access Circumvent licensing and payments

Security Decisions Via Untrusted Inputs Resulting from Mobile devices being taken advantage of to bypass permissions and security models Main attack sources Malicious apps Client side injection Impacts Consuming paid resources Data exfiltration Privilege escalation

Side Channel Data Leakage Resulting from Mix of not disabling platform features and programmatic flaws that causes sensitive data to be in unintended places (web caches, keystroke logging, screenshots, logs, and temp directories) Impacts Data retained indefinitely Privacy violations

Broken Cryptography Resulting from Broken implementations using strong cryptography libraries Custom, easily defeated cryptography implementations Impacts Confidentiality of data lost Privilege escalation Circumvent business logic

Sensitive Information Disclosure Resulting from Apps are reversed engineered easily, code obfuscation Impacts Credentials disclosed Intellectual property exposed Ex. API keys, passwords, sensitive business logic

Which mobile OS is more secure? -Collectively, the mobile OS is more secure than the computer OS. -However, the tide is beginning to turn for more malware being developed for mobile OS.

Conflict of Interest -Mobile devices do not allow users complete control over their devices. -Most users root or jailbreak their devices using the same vulnerabilities malware is developed for. -This conflict of interest between vulnerability disclosure and the ability for people to fully control their own device poses a great security issue.

Interesting Stats

Tips For Generally Keeping Safe 1) Only download apps from trusted sources, such as reputable app stores and download sites. Remember to look at the developer name, reviews, and star ratings. 2) After clicking on a web link, pay close attention to the address to make sure it matches the website it claims to be if you are asked to enter account or login information. 3) Set a password on your mobile device so that if it is lost or stolen, your data is difficult to access. 4) Download a mobile security tool that scans every app you download for malware and spyware and can help you locate a lost or stolen device. For extra protection, make sure your security app can also protect from unsafe websites. 5) Be alert for unusual behaviors on your phone, which could be a sign that it is infected. These behaviors may include unusual text messages, strange charges to the phone bill, and suddenly decreased battery life. 6) Make sure to download firmware updates as soon as they are available for your device.

In Summary -The top ten threats are not the only threats. -Threats are grouped in application-based, web-based, network-based, and physical groupings. -Mobile devices are being increasingly targeted for malware. -Staying up to date on trends seen in mobile security will be the best chance at keeping your device clean. -Mobile security is equally important for both the Developer And End-User.

Resources secure/ biw=944&bih=950&tbm=isch&tbnid=jpwbVi42K7WRSM:&imgrefurl= newgadget.org/technology/apple-ios-vs-google-android-which-one-is- better/&docid=yBXTR8AlMGbqEM&imgurl= m/wp-content/uploads/2010/09/apple-logo.jpg&w=450&h=370&ei=PUaTT--0I- fe2AWvvpHzBA&zoom=1&iact=hc&vpx=651&vpy=290&dur=1968&hovh=204& hovw=248&tx=155&ty=121&sig= &sqi=2&page=1&tb nh=140&tbnw=157&start=0&ndsp=24&ved=1t:429,r:8,s:0,i: schemes-apples-ios/