Mobile security

Mobile security, or mobile device security, is the protection of smartphones, tablets, and laptops from threats associated with wireless computing. It has become increasingly important in mobile computing. The security of personal and business information now stored on smartphones is of particular concern. Increasingly, users and businesses use smartphones not only to communicate but also to plan and organize their work and private life. Within companies, these technologies are causing profound changes in the organization of information systems and have therefore become the source of new risks. Indeed, smartphones collect and compile an increasing amount of sensitive information to which access must be controlled to protect the privacy of the user and the intellectual property of the company. The majority of attacks target smartphones. These attacks take advantage of vulnerabilities discovered in smartphones that can result from different modes of communication, including Short Message Service (SMS, text messaging), Multimedia Messaging Service (MMS), wireless connections, Bluetooth, and GSM, the de facto international standard for mobile communications. Smartphone operating systems or browsers are another weakness. Some malware makes use of the common user's limited knowledge.…

Mobile security, or mobile device security, is the protection of smartphones, tablets, and laptops from threats associated with wireless computing. It has become increasingly important in mobile computing. The security of personal and business information now stored on smartphones is of particular concern. Increasingly, users and businesses use smartphones not only to communicate but also to plan and organize their work and private life. Within companies, these technologies are causing profound changes in the organization of information systems and have therefore become the source of new risks. Indeed, smartphones collect and compile an increasing amount of sensitive information to which access must be controlled to protect the privacy of the user and the intellectual property of the company. The majority of attacks target smartphones. These attacks take advantage of vulnerabilities discovered in smartphones that can result from different modes of communication, including Short Message Service (SMS, text messaging), Multimedia Messaging Service (MMS), wireless connections, Bluetooth, and GSM, the de facto international standard for mobile communications. Smartphone operating systems or browsers are another weakness. Some malware makes use of the common user's limited knowledge. Only 2.1% of users reported having first-hand contact with mobile malware, according to a 2008 McAfee study, which found that 11.6% of users had heard of someone else being harmed by the problem. Yet, it is predicted that this number will rise. As of December 2023, there were about 5.4 million global mobile cyberattacks per month. This is a 147% increase from the previous year. Security countermeasures are being developed and applied to smartphones, from security best practices in software to the dissemination of information to end users. Countermeasures can be implemented at all levels, including operating system development, software design, and user behavior modifications. ===Consequences=== When an attacker infects a smartphone, the attacker can attempt several things: The attacker can manipulate the smartphone as a zombie machine: a machine with which the attacker can communicate and send commands which will be used to send unsolicited messages (spam) via SMS or email. The attacker can easily force the smartphone to make phone calls. For example, one can use the API (library that contains basic functions not present on the smartphone) PhoneMakeCall by Microsoft, which collects telephone numbers from any source (such as yellow pages) and then calls them. The attacker can use this method to call paid services, resulting in charges to the smartphone owner. Dangerously, the smartphone could call and disrupt emergency services. A compromised smartphone can record conversations between the user and others and send them to a third party. This can cause user privacy and industrial security problems. An attacker can also steal a user's identity, usurp their identity (with a copy of the user's SIM card or even the telephone itself), and thus impersonate the owner. This raises security concerns in countries where smartphones can be used to place orders, view bank accounts, or are used as an identity card. The attacker can reduce the usability of the smartphone by discharging the battery. For example, they can launch an application that will run continuously on the smartphone processor, requiring a lot of energy and draining the battery. Frank Stajano and Ross Anderson first described this form of attack, calling it an attack of "battery exhaustion" or "sleep deprivation torture". The attacker can make the smartphone unusable. This attack can delete the boot scripts, resulting in a phone without a functioning operating system; modify certain files to make it unusable, such as a script that launches at startup that forces the smartphone to restart; or embed a startup application that will empty the battery. The attacker can remove the user's data, whether personal (photos, music, videos) or professional (contacts, calendars, notes). ====GSM networks==== The attacker may try to break the encryption of a GSM mobile network. The network encryption algorithms belong to the family of algorithms called A5. Due to the policy of security through obscurity, it has not been possible to openly test the robustness of these algorithms. There were originally two variants of the algorithm: A5/1 and A5/2 (stream ciphers), where the former was designed to be relatively strong, and the latter was purposely designed to be weak to allow easy cryptanalysis and eavesdropping. ETSI forced some countries (typically outside Europe) to use A5/2. Since the encryption algorithm was made public, it was proved to be breakable: A5/2 could be broken on the fly, and A5/1 in about 6 hours. In July 2007, the 3GPP approved a change request to prohibit the implementation of A5/2 in any new mobile phones, decommissioning the algorithm; it is no longer implemented in mobile phones. Stronger public algorithms have been added to the GSM standard: the A5/3 and A5/4 (Block ciphers), otherwise known as KASUMI or UEA1 published by ETSI. If the network does not support A5/1, or any other A5 algorithm implemented by the phone, then the base station can specify A5/0 which is the null algorithm, whereby the radio traffic is sent unencrypted. Even if mobile phones can use 3G or 4G (which have much stronger encryption than 2G GSM), the base station can downgrade the radio communication to 2G GSM and specify A5/0 (no encryption). This is the basis for eavesdropping attacks on mobile radio networks using a fake base station commonly called an IMSI catcher. In addition, tracing mobile terminals is difficult since each time the mobile terminal is accessing or being accessed by the network, a new temporary identity (TMSI) is allocated to the mobile terminal. The TMSI is used as the identity of the mobile terminal the next time it accesses the network. The TMSI is sent to the mobile terminal in encrypted messages. Once the GSM encryption algorithm is broken, the attacker can intercept all unencrypted communications made by the victim's smartphone. ====Wi-Fi==== An attacker can try to eavesdrop on Wi-Fi communications to derive information (e.g., username, password). This type of attack is not unique to smartphones, but they are very vulnerable to these attacks because often Wi-Fi is their only means of communication and accessing the internet. The security of wireless networks (WLAN) is thus an important subject. Initially, wireless networks were secured by WEP keys. The weakness of WEP is its short encryption key, which is the same for all connected clients. In addition, several reductions in the search space of the keys have been found by researchers. Now, most wireless networks are protected by the WPA security protocol. WPA is based on the Temporal Key Integrity Protocol (TKIP), which was designed to allow migration from WEP to WPA on the equipment already deployed. The major security improvements are the dynamic encryption keys. For small networks, WPA uses a "pre-shared key" based on a shared key. Encryption can be vulnerable if the shared key is short. With limited opportunities for input (i.e., only the numeric keypad), mobile phone users might define short encryption keys that consist of only numbers. This increases the likelihood that an attacker succeeds with a brute-force attack. The successor to WPA, called WPA2, is supposed to be safe enough to withstand a brute-force attack. The ability to access free, fast Wi-Fi gives a business an edge over those who do not. Free Wi-Fi is usually provided by organizations such as airports, coffee shops, and restaurants for a number of reasons, including encouraging customers to spend more time and money on the premises and helping users stay productive. Another reason is enhancing customer tracking: many restaurants and coffee shops compile data about their customers so they can target advertisements directly to their devices. This means that customers know what services the facility provides. Generally, individuals filter business premises based on Internet connections as another reason to gain a competitive edge. Network security is the responsibility of the organizations, as unsecured Wi-Fi networks are prone to numerous risks. The man-in-the-middle attack entails the interception and modification of data between parties. Additionally, malware can be distributed via the free Wi-Fi network and hackers can exploit software vulnerabilities to smuggle it onto connected devices. It is also possible to eavesdrop and sniff Wi-Fi signals using special software and devices, capturing login credentials and hijacking accounts. As with GSM, if the attacker succeeds in breaking the identification key, both the phone and the entire network it is connected to become exposed to attacks. Many smartphones remember wireless LANs they have previously connected to, allowing users to not have to re-identify with each connection. However, an attacker could create a Wi-Fi access point twin with the same parameters and characteristics as a real network. By automatically connecting to the fraudulent network, a smartphone becomes susceptible to the attacker, who can intercept any unencrypted data. Lasco is a worm that initially infects a remote device using the SIS file format, a type of script file that can be executed by the system without user interaction. The smartphone thus believes the file to come from a trusted source and downloads it, infecting the machine. ====Bluetooth==== Security issues related to Bluetooth on mobile devices have been studied and have shown numerous problems on different phones. One easy-to-exploit vulnerability is that unregistered services do not require authentication, and vulnerable applications have a virtual serial port used to control the phone. An attacker only needed to connect to the port to take full control of the device. In another example, an attacker sends a file via Bluetooth to a phone within range with Bluetooth in discovery mode. If the recipient accepts, a virus is transmitted. An example of this is a worm called Cabir. The worm searches for nearby phones with Bluetooth in discoverable mode and sends itself to the target device. The user must accept the incoming file and install the program, after which the worm infects the machine. ===Web browser=== The mobile web browser is an emerging attack vector for mobile devices. Just like common Web browsers, mobile web browsers are extended from pure web navigation with widgets and plug-ins or are completely native mobile browsers. Jailbreaking the iPhone with firmware 1.1.1 was based entirely on vulnerabilities on the web browser. In this case, there was a vulnerability based on a stack-based buffer overflow in a library used by the web browser (LibTIFF). A similar vulnerability in the Android web browser was discovered in October 2008. Like the iPhone vulnerability, it was due to an obsolete and vulnerable library, but significantly differed in that Android's sandboxing architecture limited the effects of this vulnerability to the Web browser process. Smartphones are also susceptible to traditional web-based attacks, including phishing, malicious websites, and background-running malware. Unlike computers, however, robust antivirus solutions for smartphones are not yet widely available. The Internet offers numerous interactive features that ensure a higher engagement rate, capture more and relevant data, and increase brand loyalty. Blogs, forums, social networks, and wikis are some of the most common interactive websites. Due to the tremendous growth of the Internet, there has been a rapid rise in the number of security breaches experienced by individuals and businesses. Mobile browser users can balance usage and caution in several ways, such as reviewing computer security regularly, using secure and secret passwords, and correcting, upgrading, and replacing necessary features. Installing antivirus and anti-spyware programs is the most effective way of protecting the computer, as they offer protection against malware, spyware, and viruses. Additionally, they use firewalls, which are typically installed between trusted networks or devices and the Internet. By acting as a web server, the firewall prevents external users from accessing the internal computer system. ===Security software=== Above the operating system security, there is a layer of security software. This layer is composed of individual components to strengthen various vulnerabilities: prevent malware, intrusions, the identification of a user as a human, and user authentication. It contains software components that have learned from their experience with computer security; however, on smartphones, this software must deal with greater constraints (see limitations). Antivirus and firewall An antivirus software can be deployed on a device to verify that it is not infected by a known threat, usually by signature detection software that detects malicious executable files. A mobile antivirus product would scan files and compare them against a database of known mobile malware code signatures. A firewall, meanwhile, can watch over the existing traffic on the network and ensure that a malicious application does not seek to communicate through it. It may equally verify that an installed application does not seek to establish suspicious communication, which may prevent an intrusion attempt. Visual notifications In order to make the user aware of any abnormal actions, such as a call they did not initiate, one can link certain functions to a visual notification that is impossible to circumvent. For example, when a call is triggered, the called number should always be displayed. Thus, if a call is triggered by a malicious application, the user can see and take appropriate action. Turing test It is important to confirm certain actions by a user's decision. The Turing test is used to distinguish between a human and a virtual user, often in the form of a CAPTCHA. Biometric identification Another method to use is biometrics, a technique of identifying a person by means of their morphology (e.g., by recognition of the face or eye) or their behavior (e.g., their signature or way of writing). One advantage of using biometric security is that users can avoid having to remember a password or other secret combination to authenticate and prevent malicious users from accessing their devices. In a system with strong biometric security, only the primary user can access the smartphone. ===Centralized storage=== One form of mobile protection allows companies to control the delivery and storage of text messages by hosting the messages on a company server rather than on the sender or receiver's phone. When certain conditions are met, such as an expiration date, the messages are deleted. ==Notes==

Text derived from https://en.wikipedia.org/w/index.php?oldid=1378600148 under CC BY-SA 4.0; modifications have been made.