What security risks exist in cell phone apps
lima-city → Forum → Sonstiges → Spam und sonstiges Unvergütetes
all
bad
date
http
limit
lot
medium
most
not
photo
problem
same
see
server
session
solution
these
transfer
url
weben
-
Smartphones apps transfer various types of data over the provider's data network (or wifi, if enabled). What security risks are there in this transfer, and how can the risks be mitigated? I'm not talking about cell phone security in general, but specifically the area of data transfer between the phone and some other source over the cell phone or wireless network.
Edit: Sorry for the vagueness, I'll try to narrow it down. I'm wondering specifically about the channel used for data transfer (either the provider's wireless network or a wifi hotspot). What encryption (if any) is provided over these networks, and how common is it for apps to encrypt data in addition to what's provided by the channel itself? For example, what encryption is used by the Facebook app over a public wifi network? What about a banking app over the provider's data network? What about Gmail over a WPAsecured wireless network? etc.
Probably the most straightforward problem securitywise is the transmission of unencrypted data. For instance, imagine you are using the facebook app over wifi. router) or your gateway is compromised. If your data is not encrypted in such a scenario, your username/password, your personal information or even other people's personal information are at the mercy of someone sniffing the network.
Facebook of course can be regarded as a lowsecurity risk, but internetbanking over smartphones is already possible and apps don't necessarily encrypt data.
Another problem is the carrier itself. A lot of carriers still use GSM. The cryptographic standards of GSM are over 20 years old. Not only can GSM Networks be hacked, but can actually become hostage. New implementations of GSM (also known as 2G) have been developed (UMTS/3G) but those also have been hacked as of recently. You can read more about this here.
calls records (remote phone number, time/date of call start, call duration, direction [incoming/outgoing] , potentially the name of he remote party)
SMS/MMS data ( photots [time/date, location, potentially names of people in the photos])
location data ( time/date with lattitude longitude )
photos ( see SMS/MMS )
emails ( recipients, time/date, pop3 server, smtp server)
web site usage ( URL, form data, cookies, time date of last visit )
contacts (phone numbers, email, physical address, relationships )
music (preferences, listening frequency, etc)
Potentially, any data stored on the smartphone could be transfered.
Do you want any of this data to be private (confidential) ?
If so, then transfers involving this data need to be protected, usually this is done by encryption. The security risk in this case would be exposure of confidential data. Mitigation against exposure is encrypting your data, and configuring access controls to limit access to the data.
Do you want to protect any of this data from modification?
Protocols used during data transfer have the ability to modify or delete your data. The security risk in this case would be loss of integrity of the data (it gets changed), or loss of availabilty of the data (it gets deleted). Mitigation against loss of integrity is the use of cryptographic hashes (which will indicate if your data is intacted or not). Additional mitigation might be errorcorrecting codes which allow you to recover data that is altered. Mitigation against loss of availability is data backup and properly configured access control. The backup can restore the availability of data if it is destroyed, and the access control can limit who can delete which data.
GSM: See Smartphone / GSM Sniffer for details on recent breaks of the common GSM 2G (EDGE/GPRS) encryption ciphers.
CDMA, LTE: See What is the attack tree to intercept traffic on 4G and 3G? to follow the attacks reported at DEFCON 2011.
Wifi WPA2: See How does FaceNiff work? IT Security Stack Exchange for attacks on WPA2.
See Can you secure a web app from FireSheep without using SSL? for why you should just use SSL/TLS to protect sensitive data from all these bad wireless implementations, as well as vulnerabilities in wired networks.
Attacks on the channel can occur if information is not encrypted, as it is a broadcast medium. Also, you have no control of the antenna so if it could be compromised you could also be susceptible to attack there.
Solution encrypted, authenticated channel. And this goes for WiFi or GSM if it isn't your network, don't trust it at all; if it is, secure it against others and still protect yourself.
Denialofservice is also a very likely attack, as any wireless communications are susceptible to jamming.
Solution not a lot you can do here if an attacker has a high power jammer
The security risks which exists on cell phone application(s) in the process of data transfer are exactly same as the risks associated with say for example one's personal laptop in the process of data transfer. Many a times we tend to think the issues related to mobile gamess are too different because it is a different network.
Lets say for example one have connected his/her laptop to browse Facebook or GMAIL using the open WIFI network or a corporate network. The risk associated are same when compared to mobile application communication. Some one in the corporate network or open WIFI network can sniff the data which is being transmitted. As far as banking sites are concerned, it is hard to believe today if there exists any banking portal login where the entire session is not SSL encrypted enabled. Infact GMAIL now supports full logged session over SSL. For example if the app is J2ME application, than the application have no API's exposed to determine the mode of internet connection. In blackberry the app shops can know it. In Android and IPhone it might be possible. -
Diskutiere mit und stelle Fragen: Jetzt kostenlos anmelden!
lima-city: Gratis werbefreier Webspace für deine eigene Homepage
-
Firstly, this is a blog entry, which doesn't agree with our minimum requirements for posts. You can read that in the help section.
Secondly, you simply steal this entry:
http://www.techques.com/question/8-5034/What-security-risks-exist-in-cell-phone-apps%27-data-transfer
We don't appreciate that! -
Diskutiere mit und stelle Fragen: Jetzt kostenlos anmelden!
lima-city: Gratis werbefreier Webspace für deine eigene Homepage
