CSCU Module 13 Securing Mobile Devices.pdf

Securing Mobile Devices Module 13

Simplifying Security.

1

Copyright © by EC-Council All Rights Reserved. Reproduction is Strictly Prohibited.

May 16, 2011

Android Malware Jumps 400 Percent as All Mobile Threats Rise Mobile security is the new malware battlefield as attackers take advantage of users who don’t think their smartphones can get compromised. Cyber‐attackers are gunning for Google’s Android as they take advantage of a user base that is “unaware, disinterested or uneducated” in mobile security, according to a recent research report. Malware developers are increasingly focusing on mobile devices, and Android malware has surged 400 percent since summer 2010, according to the Malicious Mobile Threats Report 2010/2011 released May 11. The increase in malware is a result of users not being concerned about security, large number of downloads from unknown sources and the lack of mobile security software, according to the Juniper Networks Global Threat Center, which compiled the report. “That’s where the momentum is for 2011,” said Dan Hoffman, Juniper’s chief mobile security evangelist. It’s important to remember that mobile malware still accounts for less than 1 percent of all malware detected globally.

http://www.eweek.com

2


Mobile Hacking Sets Off Security Gold Rush Wed May 18, 2011 10:33am EDT

(Reuters) ‐ Hackers are increasingly aiming attacks at smartphones, touching off a race among software giants, startups and telecom operators seeking to cash in on ways to help consumers protect themselves. As the previously fragmented smartphone market coalesces around big operating systems like Apple's iPhone and Google's Android, it has become a more attractive target for hackers seeking to maximize damage with one hit. That's creating a big business opportunity for everyone from traditional antivirus players like Intel's McAfee to mobile operators like France Telecom and handset makers like Nokia. Market research firm Infonetics forecasts sales of mobile security software will grow 50 percent a year through 2014 to hit $2 billion. http://www.reuters.com

3


Module Objectives Mobile Phone Anti‐Virus Tools

Mobile Device Security

Secure Bluetooth Connectivity

Mobile Phone Services

Securing iPhone and iPad

Mobile Device Security Risks

Securing Blackberry and Windows Phone 7 Mobiles

Mobile Malware Threats to Bluetooth Devices

Mobile Security Tools

Mobile Security Procedures

Mobile Phone Security Checklists

4


Module Flow Introduction to Mobile Security

Mobile Security Threats



Securing BlackBerry and Windows Phone 7 Mobiles

Securing iPhone, and iPad

5


Mobile Device Security 461,318.2

Nokia

281,065.8

Samsung

Worldwide Mobile Device Sales to End Users in 2011 •

114,154.6

LG Electronics

• Apple

Sony Ericson Motorola ZTE

46,598.3 41,819.2 38,553.7 28,768.7

HTC

24,688.4

Huawei

23,814.7

•

488,569.3

Others

The rate of mobile device adoption and sophistication is increasing rapidly Mobile devices such as smartphones, PDAs, and laptops facilitate seamless communication and information storage and have been an incalculable productivity boon for today's enterprises Mobile devices offer flexibility and convenience, while at the same time mobility presents significant security challenges for IT security administrators and other users

http://www.gartner.com 6


Worldwide Smartphone Sales to End Users by Operating System in 2011 Market Shares

Android

67,224.5 Symbian

111,576.7

37.6% A smartphone is a mobile phone that has an identifiable operating system and offers more advanced computing ability and connectivity than a contemporary feature phone

22.7%

15.7% 4.2%

46,598.3

3.8% iOS

12,378.2 11417.4 Other OS

Microsoft

http://www.gartner.com 7


Mobile Phone Services

8


IMEI Number International Mobile Equipment Identity (IMEI) is a number unique to every mobile phone

It can also be displayed on phone’s screen by entering *#06#

IMEI is a 15 digit number and is usually found printed inside the battery compartment of the phone

It is used to deactivate the phone if it is stolen or lost

Note: The *#06# does not work for all mobile phones

9








10


Mobile Device Security Risks With the enormous growth in the usage of mobile devices, various new risks and threats have made their way into the mobile platform

Security Risks

11

Mobile Malware

Application Vulnerabilities

Lost or Stolen Devices

Unauthorized Access


Mobile Malware Mobile malware comes through emails, IMs, Bluetooth, memory cards, and Wi‐Fi Malware may spread when rogue software is installed An infected PC can infect a mobile phone via IR and Bluetooth

Mobile malware can monitor and record all the actions on a mobile phone

Mobile malware may allow an attacker to silently turn the phone on and listen to the conversation

Mobile malware can capture emails, text, and multimedia messages

12

Mobile malware can make the phone work slowly, crash the phone, and wipe out contacts and other information on the phone


Mobile Application Vulnerabilities The latest mobile devices provide openness platform functionality. This gives the user the flexibility to operate and program any type of mobile applications that are supported by and compatible with their smart phones. Openness also leads to unrestricted access to mobile resources and applications Vulnerabilities in applications can be used by attackers to access the device

Mobile Operating Systems 1. 2. 3. 4. 5. 6. 7.

Applications

Symbian Windows Phone 7 Windows Mobile Pocket PC iOS RIM Android

1. Web browser 2. Mobile banking application 3. Mobile gaming

13


Threats to Bluetooth Devices Bluetooth is an open standard wireless technology for exchanging data over short‐range radio frequencies from fixed to mobile devices by creating Wireless Personal Area Networks (WPANs)

Bluejacking

Bluesnarfing A Bluesnarfing attack is launched using the Bluejacking technique

Bluejacking refers to anonymously sending an electronic business card or photo to another Bluetooth user

It allows an attacker to access the address book, contact information, email, and text messages on another user's mobile phone

Bluesniping

War Nibbling

Bluesniping uses a highly directional antenna and laptop to establish connections with Bluetooth‐enabled devices from more than half a mile away

War nibbling refers to finding unsecured or unpatched Bluetooth connections and cruising for open 802.11 networks

14








15


Mobile Security Procedure Patch mobile platforms and applications Avoid mobile device theft Use power‐on authentication Regularly back up important data Use encryption to secure data in a mobile device Enable auto‐lock feature Install only signed applications Install mobile phone antivirus Secure Bluetooth connectivity

16


Patching of Mobile Platforms and Applications All the mobile platforms and applications should be updated regularly with the patches released by the vendor Patching enhances the performance of a mobile device, updates the operating system, fixes security holes and bugs, etc.

Download your phone's update to your mobile device to install the patch Back up all the data and files on your mobile phone Install the patch file to your device Turn off your mobile for 5 to 10 minutes before you start using the mobile phone

Updating 17

Updated Copyright © by EC-Council All Rights Reserved. Reproduction is Strictly Prohibited.

Avoid Mobile Device Theft Mobile phone thefts are increasing day by day and thousands of people lose their mobile handset every day around the world Loss of mobile phone results in, loss of important data, contacts, messages, images, and videos stored in the mobile phone

Pointers to Avoid Mobile Theft Avoid lending mobile phone to strangers

Use PIN codes to lock the phone

Do not talk while driving

Turn off the ringer

Do not leave the handset in the vehicle

Don’t walk and text

Never leave the phone unattended

Record the unique 15 or 17 digit code IMEI number

18


What to Do if Your Mobile is Lost or Stolen? Use anti‐theft software to remotely wipe the data and make the device unusable

Inform the local police and file First Information Report (FIR)

Contact the service provider and tell them to cancel the SIM card

Claim the mobile phone insurance to replace the cost of the handset

19


Use Power-on Authentication Set Power‐on Authentication in your phone to ensure maximum security and no other unauthorized user can use it Power‐on Authentication helps protect valuable information from malicious users who can gain access to a mobile phone Use tool WaveSecure to lock your mobile phone

20


Regularly Back Up Important Data Most phones today come with suites and applications that allow a user to easily manage and back up important data To prevent losing important data such as contact details, calendar entries, messages, etc., regularly back up your phone data A user can use third party tools and services like mobical.net to back up their mobile data

21


Use Encryption to Secure Data in Mobile Device Encrypt the data stored in mobile phones such as telephone numbers, important messages, voice calls, and emails to keep them safe from prying eyes

Encrypting stored files on Blackberry smartphones: To encrypt internal files: Turn on the Content Protection option (Options  Security Options  General Settings)

It ensures that even if the mobile phone is lost, the data cannot be accessed once it is encrypted

To encrypt external files: Turn on Media Card Support (Options  Media Card or Options  Memory  Media Card Support)

Mobile phones such as Blackberries can encrypt data as a standard feature whereas other mobile phones require special applications to encrypt data

Set the encryption mode for the external file system. The BlackBerry smartphone encrypts files stored on the media card Choose whether to encrypt media files in external memory only on the BlackBerry smartphone

22


Enable Auto-Lock Feature Auto‐lock security feature allows only authorized viewing of mobile phone data An unauthorized user cannot view or even use the phone once the auto‐lock option is enabled. In most cases valid pin number has to be entered

General steps to enable auto‐lock option on mobile phones: Navigate to your cell phone’s main menu screen and select the icon labeled Settings

Press the OK or Home button on your keypad to begin setting the auto lock feature

Press the OK or Home button on the keypad to select the settings menu

Choose a PIN number that you will remember to unlock your device once the auto lock feature has been saved

Locate the Security option and press OK or Home to select it

Type your four to eight digit PIN code on the keypad. Press the Save button to save your pin, and initiate the auto lock feature

Scroll down and find the Auto Lock feature on the list of security options

Press the End button to return to the main menu

23


Install Only Signed Applications Smart phones today provide open platform functionality and deliver the ability to install, remove, or update applications multiple times The openness gives unrestricted access to mobile resources and APIs Unrestricted access to mobile resources presents challenges and risks and unsigned applications that may likely increase the complexity and security risks

To reduce the risk of malware and installing unsigned applications, follow the guidelines: Identify the files created on the phone by the application during the installation Always install the applications on external storage memory cards Do not download mobile software from any untrusted third party vendors Ensure the quality and accountability of mobile applications by carefully investigating the vendor Always try to download the applications from the market place provided by the mobile manufacturer

24


Install Mobile Phone AntiVirus People may unknowingly or knowingly install the virus (programs or .exe files) through direct or indirect transferring Wi‐Fi enabled handsets and Bluetooth may let the malware in if the antivirus is not installed Once in the system, the virus can alter or delete all the contact details, or crash or permanently lock up your mobile phone applications

http://www.f‐secure.com

Antivirus software prevents, detects, and removes malware including viruses, worms, and trojan horses Some of the mobile antivirus software include Norton mobile security, F‐Secure mobile security, Kaspersky mobile antivirus, etc. http://us.mcafee.com

25


Mobile Phone Anti-Virus Tools Norton Mobile Security

Kaspersky Antivirus Mobile

http://us.norton.com

http://www.kaspersky.com

ESET Mobile Antivirus

BitDefender Mobile Security

http://www.eset.com

http://www.bitdefender.com

Trend Micro Mobile Security

Avast! PDA Edition

http://us.trendmicro.com

http://www.avast.com

Symantec Antivirus for Handhelds

Avira AntiVir Mobile http://www.avira.com

http://www.symantec.com

26


Secure Bluetooth Connectivity

Basic Bluetooth security mechanism refers to identifying whether a device is in "Visible/Discoverable" mode or "non‐visible/non‐ discoverable" mode

Turn OFF Bluetooth

Turn off Bluetooth interfaces when not in use, and disable Bluetooth's discovery feature

Bluetooth Security

Use Strong PIN

27

Choose a strong PIN for connecting the Bluetooth








28


Enable Passcode Protection Tap iPhone's Settings app  tap on General  select Passcode Lock  tap Turn Passcode On

Enter a four‐digit passcode that can be remembered; re‐enter it to confirm

Press it again and iPhone will ask you to enter a password to unlock it

Press the power button to put iPhone to sleep

29


Enable SIM PIN Protection Tap iPhone's Settings app  Select Phone  select SIM PIN  tap Change PIN

Enter the current password (if it is for the first time contact, wait and find out the default SIM PIN code) Enter the new password, a four‐digit passcode that can be remembered and re‐enter it to confirm

30


Enable Auto-Lock and Re-map Button Enable Auto‐Lock

Re‐map Home Button

Tap iPhone's Settings app  tap General  tap Auto‐Lock Select the amount of idle time you want the iPhone to wait before it goes to sleep

Tap iPhone's Settings app  tap on General  select Home Button Instead of "Phone Favorites," select either Home or iPod

31


iPad Security Auto‐Lock Feature in iPad Set the auto‐lock feature to turn off the display and prevent unintended operation of your iPad To set the amount of time before iPad locks, select General  select Auto‐Lock  specify the time

Passcode Lock To set a passcode, select General  click Passcode Lock  select Turn Passcode On Enter a four‐digit passcode  enter the passcode again to verify iPad then requires you to enter the passcode to unlock it or to display the passcode lock settings

To set how long before your passcode is required, select General  click Passcode Lock  enter passcode Tap Require Passcode and select how long iPad can be idle before you need to enter a passcode to unlock it. To turn the passcode off, select General  click Passcode Lock  click Turn Passcode Off  enter your passcode

32








33


BlackBerry: Setting Device Password On the Home screen or in a folder, click  Options Click Security  Password Click  Set Password Type a password Press the

key  click Save

To turn off the BlackBerry device’s password, clear the Enable check box

34


BlackBerry: Changing the Device Password On the Home screen or in a folder, click the Options icon Click Security  Password  Change Password

35


BlackBerry: Lock Your Device You can lock the screen to avoid pressing it accidentally To lock your BlackBerry device, do one of the following:  If you have set a device password, then on the Home screen or in a folder, click the Password Lock icon  To lock the screen, press the key on the top left area of your device  To unlock your device, type device password  press the Enter  To unlock the screen, press the key again, and if necessary, type your device password

36


BlackBerry: Device Password Setting a limit for device password attempts:

Locking the device when inserted in the holster:

On the Home screen or in a folder, click Options

On the Home screen or in a folder, click Options

Click Security  Password  Change the Number of Password Attempts field

Click Security  Password  select the Lock Handheld Upon Holstering check box Press the

Press the

key click  Save

key click  Save

37


BlackBerry Password Keeper Password keeper stores all the passwords in one place The password keeper is designed to protect your passwords with a password keeper password When you type this password, the password keeper decrypts your passwords. You can also use the password keeper to generate random passwords that contain numbers, letters, and symbols Changing the password in the password keeper 1. On the Home screen or in the Applications folder, click Password Keeper  Highlight a password 2. Press the

key and click Open

3. Change the password information 4. Press the

key Save

Add a password to the password keeper 1. On the Home screen or in the Applications folder, click the Password Keeper icon 2. Press the information

key  New  Type the password

3. Press the

key

38


BlackBerry Password Keeper Prevent password copying On the Home screen or in the Applications folder, click the Password Keeper icon Press the key  Options Clear the Allow Clipboard Copy check box Press the key  Save Set a limit for password attempts in the password keeper On the Home screen or in the Applications folder, click the Password Keeper icon Press the key  Options Set the Password Attempts field Press the key and click Save Hide passwords in the password keeper On the Home screen or in the Applications folder, click the Password Keeper icon Press the key  Options Clear the Show Password check box Press the key  Save

39


Encrypting Data on Your BlackBerry Device When the user turns ON the encryption option in BlackBerry phone, the phone uses a private key to encrypt data A user can encrypt files on the device and on a media card using an encryption key generated by the device Turn on encryption To encrypt data on your BlackBerry device, first set a password for your device. 1. On the Home screen or in a folder, click Options 2. Click Security  Encryption 3. Select the Encrypt check box to encrypt data on your device in the Device Memory section 4. Select the Media Card check box to encrypt the media card files and do one of the following: a. Change the Mode field to Device Key b. Change the Mode field to Device Password c. Change the Mode field to Device Password & Device Key 5. Select the Include Media Files check box to encrypt media files such as pictures, songs, and videos 6. Press the key  Save

40


Windows Phone 7 Mobile: Use of PIN to Lock SIM Card You can use a PIN for the SIM (Subscriber Identity Module) card in your phone to prevent people from making unauthorized phone calls After turning on SIM security, you will be prompted to enter your SIM PIN each time you start your phone

Steps to turn ON SIM security On Start, click/tap Phone  Turn on SIM Security

 click More

 click Call Settings

It prompts you to Enter SIM PIN  enter the PIN for your SIM card by doing one of the following: If you are setting the PIN for the first time, try typing 1234  tap Enter If you have already set a PIN for the SIM card, type your PIN and tap Enter

41


Windows Phone 7 Mobile: Changing the Password of the Phone 1

On Start  flick left to the App list  tap Settings

2

In Settings, tap Lock & wallpaper

3

To set up a password for the first time  turn ON Password  enter a password in the New password text box  reenter it in the Confirm password text box

4

If the phone already has a password and you want to change it, tap Change password  enter the phone's current password in the Current password text box before entering your new password

5

Tap Done to save your changes

42


Windows Phone 7 Mobile: Changing the Password of the Phone

43








44


Mobile Security Tools: PhoneBAK Anti-theft PhoneBAK protects a PDA phone from theft and risk of unauthorized access to sensitive information and, if stolen, tracks down the thief via his/her mobile phone number PhoneBAK checks on any Subscriber Identity Module (SIM) card inserted into the PDA phone and if unauthorized, it sends SMS text alerts to notify the theft and wipes out all video, photos, and documents!

http://www.bak2u.com

45


Mobile Security Tools WaveSecure

Resco Backup for Pocket PC

https://www.wavesecure.com

http://www.resco.net

Sprite Terminator

SecuBox

http://www.spritesoftware.com

http://www.aikosolutions.com

Airscanner Mobile Encrypter

eWallet

http://www.airscanner.com

http://www.iliumsoft.com

Mobile Security

Kaspersky Mobile Security

http://www.f‐secure.com

http://usa.kaspersky.com

46


Module Summary  Mobile phones are becoming the new PCs to check email and browse the Internet  Mobile malware comes through email, IMs, Bluetooth, memory cards, and WiFi  Bluetooth is an open standard wireless technology for exchanging data over short‐ range radio frequencies from fixed to mobile devices by creating Wireless Personal Area Networks (WPANs)  All applications should be updated regularly with the patches released by the vendor  Use antivirus software to prevent, detect, and remove malware including viruses, worms, and Trojan horses  Bluetooth devices should be configured by default as, and remain, undiscoverable except as needed for pairing

47


Bluetooth Security Checklist Change the default settings of the Bluetooth device Choose PIN codes that are sufficiently random and long Bluetooth devices should be configured by default as, and remain, undiscoverable except as needed for pairing Ensure that Bluetooth devices are turned off when they are not in use Ensure that portable devices with Bluetooth interfaces are configured with a password to prevent unauthorized access if lost or stolen Install antivirus software on Bluetooth‐enabled hosts that are frequently targeted by malware Install Bluetooth software patches and upgrades regularly

48


Bluetooth Security Checklist Users should not accept transmissions of any kind from unknown or suspicious devices Users should perform pairing of Bluetooth devices as infrequently as possible Unnecessary Bluetooth services, user controls, and applications should be removed from the host device Devices should support only a single headset connection between one headset and one handheld device If a Bluetooth device is lost or stolen, unpair the missing device from all other Bluetooth devices with which it was previously paired The user should authorize all initial incoming connection requests

Ensure that Bluetooth devices are turned off when they are not in use

49


Mobile Phone Security Checklist Create a password to access the device and change the default Bluetooth password Keep mobile phone operating system and other applications up‐to‐date

Use antivirus and antispyware software for mobile devices

Encrypt sensitive data on the device and regularly back up mobile data to a PC

When entering a crowded zone, make sure the Bluetooth is switched off

Never follow links from unsolicited email or text messages Never transmit sensitive information when connected to the Internet at public places (shopping malls, cafes, etc.) Wipe all the data before disposing of wireless devices and Properly read the device user manuals to ensure appropriate protection

50


CSCU Module 13 Securing Mobile Devices.pdf

Recommend Documents