Smart Phones and Tablets: Security Issues

1. Smart Phones and Tablets: Security Issues S. Roy

2. Acknowledgement In preparing the presentation slides and the demo, I received help from • Professor Simon Ou • Professor Gurdip Singh • Professor Eugene Vasserman • Fengguo Wei

3. What is a Smart Phone? • Smart Phone = Phone + Computer + Sensors • Provides various services • phone call, SMS, computation, storage, accessing the Internet, data download, GPS, camera, and so on … • OS: Android, iOS, Windows Mobile, BlackBerry • OS Make: Google, Apple, Microsoft, BlackBerry • Device Make: Samsung, Apple, HTC, BlackBerry • Popular models: Galaxy S III, iPhone 5 • Connection/Service Providers: Att, Verizon, T-mobile • Connection types: 3G, 4G, Wi-Fi, Bluetooth

4. What is a Tablet? • Tablet is a specialized mobile computer with a big screen • primarily operated by touching the screen • used for reading books, watching videos, accessing the Internet, and so on • wireless connections: 3G, 4G, Wi-Fi, Bluetooth • OS: Android, iOS • popular models: Samsung Galaxy Tab, Apple iPad

5. Why to Secure Smart Phones/Tablets? • These devices can do most of what a computer (e.g. a laptop) does. • Smartphones have extra features, such as GPS, phone calls, SMS. • Smartphones/tablets probably contain lot of personal information. • There is some chance that we can lose these devices. • Recent study shows these devices are a growing target for malware. • Smartphones and tablets need to meet the same security standards as any computer. • The security issues of a smart phone are similar to those of a tablet. • So, without loss of generality, we will focus only on smart phone security in this class.

6. Risks a Smart Phone Faces • Include risks of insecure Wi-Fi • if this device uses an open Wi-Fi • Include risks of insecure Web browsing • if done from this device • Include additional risks: • Physical vulnerability (e.g. attacker physically capturing the phone and performing comprehensive scan) • Sensitive information (GPS location, photo, contact list, etc.) leakage

7. Installing a VPN Client • To avoid the risk of using a smartphone in a public Wi-Fi, you may install a VPN client • As an example, visit KSU ITS website to get the instructions for installation • Android : https://www.ksu.edu/its/security/vpn/androidinstall.html • iOS: https://www.ksu.edu/its/security/vpn/iosinstall.html • Finally, you can use your KSU eID as the username and KSU password as the password to connect to the KSU VPN server.

8. Installing the VPN App on Android: Step 1

9. Installing the VPN App on Android: Step 2

10. How to Start the KSU VPN Client?

11. Connected to the KSU VPN Server

12. Accessing the IEEE Xplore Library from any Physical Location

13. Now let’s do the Hands-On Activity • Search the Cisco VPN client app at the App store, and download it on your phone • Install it and make the proper setting so that it can connect to the KSU VPN server • Start / Run the VPN client; then securely browse web sites (e.g. yahoo email) • Take screenshots of your activities • Connect your phone to your computer to transfer the screenshots • Use a “paint/photo” edit software to erase any private information present on the screenshots • You may need to submit the screenshots while doing the homework

14. Minimize the Phone Data Loss Risk: Using a PIN or Password • Auser should lock the phone screen with a numeric PIN or a password. • How long/complex should this PIN be to thwart cracking in a reasonable amount of time? • Set a timeout (after this interval the phone gets locked and the user needs to enter PIN) • Before doing the PIN setup, ensure that your Android device has the latest updates. 

15. Setting Lock in an Android Device: Step 1 • Navigate to your devices settings, and selectSecurity, then select Set up screen lock.   Acknowledgement: http://xbase.ucdavis.edu/itexpress

16. Setting Lock in an Android Device: Step 2 • Choose one option among the available ones: aPattern, PIN, or Password. 

17. Setting Lock in an Android Device: Step 3 • Depending on which option you chose, you will see one of the following three screens:

18. Setting Lock in an Android Device: Step 4 • Return to the Security settingsand set the lockout time. • This feature locks your phone after it has been inactive for the length of time you choose.

19. Setting Lock in an iOS Device: Step 1 • To set a passcode navigate through the following: Settings > General > Passcode Lock > Turn Passcode On. Acknowledgement: http://xbase.ucdavis.edu/itexpress

20. Setting Lock in an iOS Device: Step 2 • Enter a four digit passcode twice and then return to the Passcode Lock settings page. Acknowledgement: http://xbase.ucdavis.edu/itexpress

21. Setting Lock in an iOS Device: Step 3 • You can create a more complex passcode with spaces and alphanumeric characters, not just numbers. • You can also change the Require Passcode timing. This feature locks your phone after it has been inactive for the length of time you choose • At this location you can also enable the Erase Data feature, which will wipe your personal information from your phone after 10 failed passcode attempts. Acknowledgement: http://xbase.ucdavis.edu/itexpress

22. Unlocking an iOS Device • Your passcode should unlock your iOS device once the screen has been turned off for the specified Require Passcode timing.   Acknowledgement: http://xbase.ucdavis.edu/itexpress

23. Further Improvement on Security • Back up data on the device • to be sure the data can be recovered • Turn off unused services if any • such as Wi-Fi, Bluetooth or VPN. • unused services could expose your device to unwelcome remote connections. • turning off unused services can also prolong the device’s battery life • Label the device with minimal contact information • such as an email address or office phone number. • If you lose the device, report the loss to police.

24. Encryption and Remote Wipe Options • An iPhone (and an android phone) can encrypt all the data stored using the user’s passcode. • by using the feature available on your smartphone • or consider using a reputable data encryption app. • You may protect yourself for when you lose a mobile device • by using the “remote wipe” feature, which can work via a Microsoft Exchange server • but the benefit of “remote wipe” feature is debatable

25. How an App can Exploit the Security Model • An example with Android: • the user installs a third-party app P from the Android market • P does not demand (to require) “Internet” permissions during the installation time, so the user does not suspect P • later P sends a request (called Intent) to the standard “browser” app to open an Internet connection on behalf of P • thus P exploits the permission model and can harm the user (e.g. by leaking the user’s sensitive information to outside). • Mitigation: • Android market or you should have a tool for rigorous vetting of an app before the user install/use it • User should think twice before granting critical permissions during the app installation • We should always upgrade the apps and the system

26. Comparing the Security Model of Android and iPhone (iOS) • Android allows anybody to develop an app and make it available in the market with minimal vetting process; • On the other hand, Apple claims to rigorously vet a third-party app before it goes into the App Store. • The user grants permissions to an Android app during the installation time (all or none permission policy) and there is no run-time monitoring • iOS may ask the user for permission in run-time (and an app can run with partial permission set).

27. Managing the Phone Settings • In the default setting, numerous apps open themselves in an automated fashion on a smart phone. The user needs to be informed. • As an example, on an Android phone all Google apps (Gmail, Google Plus, etc.) are always ON by default. • The user needs to modify the settings to securely manage the apps: email apps, social network apps, messaging apps, etc.

28. Summary • We discussed common security issues of smart phones/tablets. • We presented a few standard countermeasures to mitigate the risks • Remainder: • the next homework is due before the next class (1pm on March 7) • the next class will be held in Room 128