Smartphone Platform Security

Transcription

1 Smartphone Platform Security What can we learn from Symbian? Craig Heath Independent Security Consultant 15 Jan 2015 Franklin Heath Ltd

2 Discussion Points Was Symbian OS platform security a success? Did developer difficulties with platform security contribute to Symbian s downfall? Could those difficulties have been prevented? Did Symbian s platform security have anything better than today s successful platforms? 2

3 Symbian OS Versions Without Platform Security Year Ver. UI Layer Typical Phone Series 80 Nokia S60 1 st Edition+FP1 Nokia 7650 MOAP(S) Fujitsu F UIQ 2.0 (& 2.1) Sony Ericsson P S S60 2 nd Edition+FP1 Nokia a S60 2 nd Edition FP2 Nokia a S60 2 nd Edition FP3 Nokia N b MOAP(S) Fujitsu F905i With Platform Security Year Ver. UI Layer Typical Phone S60 3 rd Edition Nokia 3250 UIQ 3.0 Sony Ericsson P S60 3 rd Edition FP1 Nokia N95 UIQ 3.1 & 3.2 Motorola Z S60 3rd Edition FP2 Samsung i8510 Nokia S60 5 th Edition 2009 Nokia N ^2 MOAP(S) Fujitsu F-07B ^3 S60 Nokia N Anna S60 Nokia E6 3

4 Symbian Platform Security Architecture Run-time controls on system and applications Based on long-established security principles e.g. Trusted Computing Base, Least Privilege Designed for mobile device use cases low-level, highly efficient implementation Capabilities determine process privileges checked by APIs which offer security-relevant services Data Caging protects stored data protected directories for system and for applications Secure identifiers ( SIDs ) for applications verified at install-time 4

5 Symbian OS New Malware Strains and Variants Per Month First phones introduced with platform security New Variant 5

6 Developer Difficulties Compatibility break Used as an excuse for fixing accumulated technical debt Additional complexity SIDs, data caging, etc. How do I know what capabilities I need? Difficulty of debugging Why can t you just turn the security off? Cost of approval and signing...even though it was steadily reduced over time Delays caused by approval and signing process Rejections were common 6

7 Aside: Symbian OS C++ Same language and environment for apps as the OS (and/or UI) In principle allows third party developers to produce powerful apps... but harder to work with in-progress documentation and finicky tools Non-standard C++ idioms Descriptors, active objects, cleanup stack ANSI exception handling came too late Technically good (vastly more power efficient)... but steep learning curve Alternatives were either too little (CDC Java, MIDP Java)... or too late (PIPS, Qt) 7

8 Symbian Signed Capability Groups User Extended (System) Extended (Restricted) Manufacturer LocalServices Location NetworkServices ReadUserData UserEnvironment WriteUserData PowerMgmt ProtServ ReadDeviceData SurroundingsDD SwEvent TrustedUI WriteDeviceData CommDD DiskAdmin NetworkControl MultimediaDD AllFiles DRM TCB 8

9 Symbian Signed Capability Groups Group Additional Capabilities Permitted User 6 Extended (System) Extended (Restricted) 7 4 Manufacturer 3 Unsigned or Self-signed install-time user prompt Unverified Developer Certificate per IMEI(s) Yes Developer Certificate per IMEI(s) Yes OEM approval Verified with Publisher ID Express Signed Yes Certified Signed Yes OEM approval 9

10 Symbian Signed Costs 2004, initially a branding / co-marketing programme All outsourced costs passed to publisher (could be over $1000 per app) Most developers were their own publisher 2006, required for non-user-grantable platform security capabilities Standardised testing, lowest price 195 Still required $395 publisher ID annually 2007, reduced costs but increased complexity Publisher IDs reduced to $200 Express Signed $20 subset of extended capabilities, self-testing with random auditing afterwards 2010, streamlined test criteria Express Signed 10, Certified Signed , Nokia pays for and performs signing for Ovi Store submissions 10

11 What Could We Have Done Differently? Needed more clout and/or money Google were able to ignore operator demands Apple were able to phase out DRM Apple were able to subsidise approval process CA-issued publisher IDs were probably a mistake Self-signed works for Google Android Didn t help us track down malicious actors Robustness was pretty good User experience was pretty good 11

12 Discussion Points Was Symbian OS platform security a success? Did developer difficulties with platform security contribute to Symbian s downfall? Could those difficulties have been prevented? Did Symbian s platform security have anything better than today s successful platforms? 12