Security and privacy in the smartphone ecosystem: Final progress report Alexios Mylonas Athens University of Economics & Business
Overview 2 Research Motivation Related work Objective Approach Methodology Threat model Smartphone definition & data Contribution Browser controls User practices Malware mitigation Smartphone forensics Future work
Research Motivation 3 Smartphone ecosystem facts: Increase Popularity of devices Installations of third-party apps web browsing Great source of personal and business data Smartphones appealing target for attackers
Related work 4 Android-centered & focused on malware mitigation Permission system Policies, all-or-nothing Static analysis e.g. static analysis on manifest Dynamic analysis e.g. Taint analysis
Related work 4 Android-centered & focused on malware mitigation Permission system Policies, all-or-nothing Problem: Static analysis 1. Require advanced technical skills! manifest Dynamic analysis Taint analysis Instrumentation
Related work 4 Android-centered & focused on malware mitigation Permission system Policies, all-or-nothing Problem: Static analysis 1. Require advanced technical skills! manifest Dynamic analysis Taint analysis Instrumentation
Related work 4 Android-centered & focused on malware mitigation Permission system Policies, all-or-nothing Problem: Static analysis 1. Require advanced technical skills! manifest Dynamic analysis Taint analysis Instrumentation
Objectives 5 Study user practices adoption of security controls User-centric protection Include user input in our approach Users value their data types differently Case study: Smartphone forensics
Methodology 6 Survey of controls Analysis Security Finding (user-centric) Survey of threats Recommendation/Mitigation
Threat model 7 T1. Malicious web ( servers ) WEB
Threat model 7 T2. Physical access
Threat model 7 T3. Malicious apps 12 Users App App App App . Application . Repository . App
A smartphone? 8 Cell\feature phone Smartphone used to access mobile a cell phone network carrier services advanced hardware contains a smartcard capabilities an identifiable OS supports 3 rd -party apps apps from app repository C5. Theoharidou M, Mylonas A, Gritzalis D. A risk assessment method for smartphones. In: Proc. of the 27th IFIP Information Security and Privacy Conference. Springer; AICT-376; 2012. p. 443-456.
Smartphone Data 8 Smartphones host heterogeneous data Application Sensor Device Smartphone Data SIM Card Messaging Usage History C4. Mylonas A, Meletiadis V, Tsoumas B, Mitrou L, Gritzalis D. Smartphone forensics: A proactive investiga- tion scheme for evidence acquisition. In: 27th IFIP International Information Security and Privacy Conferen- ce. Springer; AICT-376; 2012. p. 249 – 260.
Browser controls 9 Manageability of browser security controls PC, smartphones Out-of-the box protection offered C7. Mylonas A, Tsalis N, Gritzalis D. Evaluating the manageability of web browsers controls. In: Proc. of the 9th International Workshop on Security and Trust Management (STM-2013), Springer; LNCS-8203; 2013; p 82-98.
Browser Controls 9 Web threats Unavailability of controls Identification and Survey of controls Out-of-the-box protection manageability Usability issues Control enumeration Common controls (33) in browser UIs Usability Browser, Chrome, Firefox, Security-oriented Safari, IE, Opera, Opera Mini Default values configuration settings Configurability UI suggestions
Browser controls 1 0 Availability of controls PC vs. smartphone Smartphones browsers offer less controls
Browser controls 1 0 Availability of controls PC vs. smartphone Smartphones browsers offer less controls Blame the sandbox ? Counterexamples Android and iOS (10) e.g. block location data, block third-party cookies, enable DNT, certificate warning, private browsing, ... (c.f. C.7) Android (5) i.e. block referrer, disable plugin, malware protection, master password, search engine manager
Mitigation of web threats 1 1 identified controls (32) Web threats enabled by-default ICT web threats editable Smartphone threats b) control manageability/threat a) default protection/threat
Default protection /threat 1 2 12.09.2013 - Evaluating the Manageability of Web Browsers Controls
Default protection /threat 1 2 12.09.2013 - Evaluating the Manageability of Web Browsers Controls
Default protection /threat 1 2 12.09.2013 - Evaluating the Manageability of Web Browsers Controls
Manageability of controls /threat 1 3 12.09.2013 - Evaluating the Manageability of Web Browsers Controls
Manageability of controls /threat 13 12.09.2013 - Evaluating the Manageability of Web Browsers Controls
Manageability of controls /threat 13 12.09.2013 - Evaluating the Manageability of Web Browsers Controls
Manageability of controls /threat 13 12.09.2013 - Evaluating the Manageability of Web Browsers Controls
Recommendations 14 Vendor Settings & UI Proposed Settings & UI Functionality-oriented Security-oriented all controls configurable & Users can disable controls enabled without confirmation discourage changes Security settings mixed with certificate warning, malware/ other settings phishing protection confirmation for update settings ask default value block cookies, block location data, block 3 rd party cookies, enable DNT, and master password
Recommendations 14 Proposed settings restrictive Security vs. user experience Local blacklist Per-site configuration of controls User awareness Users trained to use control(s) correctly Users aware of web threats
User practices 15 Adoption of controls Physical attacks Malicious apps Statistical analysis (n=458, Athens, Fall 2011) C6. Mylonas A, Gritzalis D, Tsoumas B, Apostolopoulos T. A qualitative metrics vector for the aware- ness of smartphone security users. In: 10th International Conference on Trust, Privacy & Security in Digital Business. 2013.p. 173 – 84. J1. Mylonas A, Kastania A, Gritzalis D. Delegate the smartphone user? Security awareness in smart- phone platforms. Computers & Security 2013;34(0):47 – 66.
User practices against physical access 10 Physical threat User survey of Exposure to physical threat Survey of controls adoption (vulnerability) Control enumeration Common controls in handsets • Password protection • remote locator Risk Assessment • remote wipe Android, BlackBerry, iOS, method • encryption Symbian, Windows Phone Training Adoption of controls Statistical analysis
User practices against physical access 16 Poor adoption of physical access controls 70 60 50 40 30 20 10 0 remote device remote data encryption device none password wipe locator % of adoption 64,4 22,7 15,1 23,1 27,9
User practices against malware 10 Threat of malicious apps User survey of Exposure to malicious apps Survey of controls adoption (vulnerability) Control enumeration Security indicators by security models • security messages • reputation Risk Assessment • reviews Android, BlackBerry, iOS, method Symbian, Windows Phone Third-party security software Prediction model User practices Training Statistical analysis
User practices against malware 17 User practises when installing apps from the app repository Finding 5: Users who occasionally inspect security messages or ignore them at all are more likely to disable encryption 70 Finding 6: Users who always inspect security messages are more likely 60 technically and security savvy users 50 Finding 7: Users who ignore security messages are more likely to also ignore 40 agreement messages 30 20 10 0 agreement pirated reputation reviews security msgs msgs apps % of adoption 10 8,7 10,5 38,6 60,7
User practices against malware 17 Poor use of smartphone security software Finding 5: Poor adoption of physical security controls 100 Finding 5.1: Encryption (22.7%) 80 Finding 5.2: Remote data wipe (15.1%) 60 Finding 5.3: Remote device locator (23.1%) 40 Finding 5.4: No adoption of any physical security control (27.9%) 20 Finding 6: Users tend to have disabled smartphone secsoft along 0 searched free Unaware of smartphone secsoft with encryption, device password lock and remote device PC secsoft smartphone smartphone secsoft essential secsoft secssoft locator % of adoption 85,8 24,5 34,3 40 27
User practices against malware 17 Users believe that installing apps from the repository is secure (~3/4 users) These users are exposed to malware Unaware users of smartphone malware more likely trust the app repository Users who trust the repository tend to be unaware about smartphone secsoft Users who trust app repository are less likely to scrutinize security msgs
Recommend
More recommend
