Mobile Device Security. Image from

Transcription

1 Mobile Device Security Image from

2 Examples of Mobile Devices - Phones ios (iphone), Android, Windows, etc. -USB devices - Tablets (ipad, Dell/HP running Windows, WebOS, etc.) This area looks to be growing rapidly - Laptops (usage decreasing)

3 A Paradigm Shift - Personal vs. Work A growing number of personal devices are used for work Work and documents can be discoverable on personal devices

4 A Quick Overview of Laptops - The same risks as other mobile devices However, they have: - Mature encryption technology - A full keyboard (it s easier to have good passwords that way) - The same protections as a desktop - Antivirus - Regular OS updates - Regular application updates

5 How Powerful are Smart Phones? iphone as a penetration testing tool. Image from

6 General Current Threats - Wireless access - Loss and Theft - Privacy - Malware - Cloud Data Storage

7 A note on web browsing Always use HTTPS if you can, even if you ve already logged in or don t have to. - GOOD VERY BAD

8 Four Types of Wireless - Wifi or Wireless Wireless (802.11x) Texas State Campus, Home, Airport, etc. Medium range, much faster Sometimes encrypted, sometimes not - Data Service (3G, 4G/WiMAX/HSPA+) Slower but more widespread and more secure - NFC (Near field communication) Used for mobile payments, public transportation ticketing, etc - Bluetooth Short range, good for device to device communication Wireless keyboards, mobile phone earpieces

9 Wifi Snooping Malicious user at coffee shop/airport Image from:

10 Firesheep

11 More Wifi Snooping Google Streetview Cars Google ClientLogin Issue

12

13 VPN Can Help!

14 VPN Products VPN can protect you from a majority of wireless threats. Support for mobile devices is limited but growing. We are currently testing Texas State VPN for the ipad. Texas State VPN

15 A Wireless Usage Suggestion Use your data service. Disable wifi/wireless and bluetooth unless you really need them.

16 NFC (Near Field Communications)

17 Loss and Theft Consequences Identity Theft work , apps with personal information saved credit cards, SSNs If your phone is used for payment (NFC/Near Field Communications), someone may be able to use your phone for purchases FERPA violations work

18 Locking Your Phone Now More Important Than Ever Download an app, wave your phone in front of a scanner and get a latte Image from

19 Loss and Theft basics - Enable autolock with a password/swipe pattern - Enable autowipe after a certain number of login attempts Passwords for an iphone under Settings, General, Passcode lock:

20 Android Lock Image from

21 Image from

22 Remote Wipe/Lock - Mobile Defense for Android locate, lock, backup and wipe - Android 2.2 and above support a remote Exchange wipe - iphone supports remote wipe through Exchange - iphone/ipad also support remote wipe through MobileMe/iCloud Image from

23 Device Encryption - iphone 3GS and newer as well as ipads are encrypted at the hardware level. This encryption is only useful if your passcode is not easy to guess or crack - Android has software based-encryption (Part of WhisperCore) - Windows 7 does not look like it supports on-device encryption as of yet - DARPA has released a request for technology for encrypting many common mobile devices April 11 th, 2011

24 USBs and Encryption Use encryption. Ironkey has great (waterproof) and easy to use products. Some USB security is sub-par, make sure the USB has hardware/chip level encryption. Image from:

25 An Important Tip! Keep your device in a pocket or in some way attached to you. This can be annoying but much better than the alternative. VERIZON SAMSUNG FASCINATE 6/13/ :20 iphone 4 in blue case 6/13/2011 9:09 NIKON D50 CAMERA, LENS, 2 SD MEMORY CARDS IN BAG 6/13/2011 8:27 nokia cell phone 6/13/2011 6:45 LG Rumor Touch cellphone 6/12/2011 6:43 blackberry curve 6/11/ :05 IPOD TOUCH 32 GB BLACK in a black "rubber" case 6/11/ :03 Blackberry curve 6/11/ :51 Droid 6/10/ :57 iphone4 6/10/ :43 Steel I-pad in black "InCase" case 6/10/ :52 Steel I-pad in black "InCase" case 6/10/ :52 iphone 6/10/ :46 White iphone 3Gs, white sticker on back, cracked top 6/10/2011 9:02 Nikon D3100 Camera in black case 6/10/2011 0:00 Two backpacks, laptop, Australian passport 6/8/ :12 iphone 4 lost in Northside cab service 6/8/ :33 Gucci sandal 6/8/2011 9:32 Black Purse with ID, Phone, Ipod, etc. 6/7/ :44 iphone 4 with white case 6/7/2011 8:36 Cell Phone 6/7/2011 6:45 Small Cingular cellphone 6/6/ :07 Iphone 4 6/6/ :54 REWARD Black iphone 4G with Black Case mountain on screen 6/6/2011 6:31 iphone 4 6/6/2011 6:04 LG Optimus black cell 6/5/ :05 cell phone (DROID) 6/5/2011 6:58 Silver Sony Viao in black case lost on 5/30 6/4/ :57 Samsung phone 6/4/ :02 Black 32gb iphone 3GS 6/4/ :39 REWARD: Lost Sony Vaio laptop and bag 6/4/ :44 iphone 4G black w/ black case 6/4/2011 7:22 iphone black 6/4/2011 6:40 iphone4 6/4/2011 6:33

26 Mobile Devices and Malware (viruses, worms, trojans, oh my ) Image from

27 USBs and Malware - Incidents on campus with plugging infected USBs in to machines and vice versa - Social engineering is an issue leave a USB lying around at an organization and it s highly likely someone will pick it up and plug it in

28 Desktop malware migrates to mobile platforms Image from

29 Android Gemini - Comes from third party app store in China - Steals most information: Installed/Running applications Subscriber information (IMSI number, SIM serial number, network provider, etc.) Phone information (IMEI number, manufacturer, model, etc.) Current user s location (via GPS) - Probable precursor to a mobile botnet

30 Jailbroken iphones Jailbroken phones are at much higher risk for attack and infection. It s HIGHLY recommended that you don t do this. Image from

31 Mobile Security

32 Privacy - User tracking. From the Wall Street Journal in December of 2010 Of 101 iphone apps: 56 transmitted phones unique device ID without users awareness or consent 47 transmitted the phone s location 5 sent age, gender and other personal details Also, Google makes a very large amount of money through advertising. More target advertising tends to be more profitable, therefore the more they know about your habits the more profitable they are

33 What is Cloud Storage? Image from

34 Cloud Storage products From the Dropbox terms of service: You acknowledge and agree that you should not rely on the Site, Content, Files and Services for any reason. You further acknowledge and agree that you are solely responsible for maintaining and protecting all data and information that is stored, retrieved or otherwise processed by the Site, Content, Files or Services.

35 More Cloud Storage

36 Q & A