wiki:Other/Summer/2015/fSec

Mobile Security

Table of Contents

  1. 2015 Winlab Summer Internship
    1. Projects
    1. Indoor Localization
    2. Introduction
      1. Motivation
      2. What is ORBIT Lab?
      3. Overall Approach
      4. Resources
      5. Procedure
      6. Plan of Action
      7. Weekly Presentations
      8. Team
    1. SDR in ORBIT: Spectrum Sensing
      1. Introduction
      2. Team
      3. Objectives
      4. Weekly Progress
      5. Experiments
    1. LTE Unlicensed (LTE-U)
      1. Introduction
      2. Objectives
      3. Theory
      4. Analyzing Tools
      5. Experiment 1: Transmit and Receive LTE Signal
      6. Experiment 2: The Waterfall Plot
      7. Experiment 3: eNB and UE GUI
      8. Experiment 4: Varying Bandwidths
      9. Experiment 5: Working with TDD or FDD
      10. Experiment 6: TDD with Varying Bandwidths
      11. Experiment 7: TDD Waterfall Plot
      12. Poster
      13. Members
      14. Materials
      15. Resources
    1. Distributed Simulation of Power Grid
      1. Introduction
      2. Objectives
      3. People
      4. Resources
    1. Context-Aware IoT Application on MobilityFirst
      1. Introduction
      2. Objectives
      3. System Architecture
      4. Network Diagram
      5. Experiment Tools
      6. Results
      7. Future Work
      8. Team member
    1. Real-Time Cyber Physical Systems Application on MobilityFirst
      1. Github Repo
      2. Introduction
      3. Preliminary Goal
      4. Outline of the Project
      5. Tasks
      6. Image Processing
      7. Weekly Summary
      8. Team
      9. Presentation Slides
    1. GNRS Assited Inter Domain Routing
      1. Introduction
    1. GNRS Management
      1. Introduction
      2. Work Milestones
    1. Effective Password Cracking Using GPU
      1. Introduction
      2. Objectives
      3. GPU
      4. Experiment
      5. Tools and Resources
  2. Body Sensor Networks
    1. Introduction
    2. Project Overview
    3. Data Collection
      1. Initial BCI data
    4. Data Analysis
    5. Tools/ Resources
    1. Unity Traffic Simulation
      1. Introduction
      2. Objectives
      3. People
    1. Mobile Security
      1. Introduction
      2. Motivation
    2. Resources
  3. Dynamic Video Encoding
    1. Introduction
    2. Goals
    3. Background Information
      1. Anatomy of a Video File
      2. What is a CODEC?
      3. H.264 Compression Algorithm
      4. Scalable Video Coding
      5. Network Emulator Test Results
      6. DASH Multi-Bitrate Encoding
      7. DASH Content Generation
      8. Bitrate Profiles
      9. Video Encoding Algorithms
      10. GPAC
    4. Presentations
    5. People

Introduction

Mobile security or mobile phone security has become increasingly important in mobile computing. It is of particular concern as it relates to the security of personal and business information now stored on smartphones. More and more users and businesses employ smartphones as communication tools, but also as a means of planning and organizing their work and private life. Within companies, these technologies are causing profound changes in the organization of information systems and therefore they have become the source of new risks. Indeed, smartphones collect and compile an increasing amount of sensitive information to which access must be controlled to protect the privacy of the user and the intellectual property of the company.

A smartphone is always exposed to various threats when it is used by the users. These threats can disrupt the operation of smartphone, modify or access the data. Smartphone threat model divides a phone into three layers: Application layer which includes all of the smartphone's apps, such as social networking software, email, text messaging, and synchronization software. Communication layer includes the carrier networks, Wi-Fi connectivity, Bluetooth network, Micro USB ports, and MicroSD slots. Malware can spread through any of these channels. Resource includes the flash memory, camera, microphone, and sensors within a smartphone. Because smartphones contain sensitive data, malware can target their resources to control them and manipulate data from them [3].

Prime targets for the attackers are: Data:Central data management is a part of a smartphone. Pictures, credit card information, Location, activity logs and private information etc. may be present as data in the smartphone. Identity:Smartphones belong to a specific user and are highly customizable. It can contain information related to the owner of the mobile contract or etc. Availability:An attacker can limit access to the smartphone by attacking it and this can lead to denial of service to the user.

Threats and Attacks:

  • Device Loss: If a person leaves a smartphone in public places, sensitive data such as customer information or corporate intellectual property can be put at risk.
  • Application security: Mobile applications that requests too many permissions, which allows them to access various information of the device.
  • Device data leakage: It is unauthorized transmission of personal information or corporate data. Malicious applications can steal personal information like location, bank details or contact details. For example, an attacker could use ZitMO for Symbian, Blackberry, android devices to steal one time passwords sent by banks to authenticate mobile transactions.
  • Sniffing captures and decodes packets as they pass over airwaves.
  • Spam can be carried through email or MMS messages. These messages can include URLs that direct users to phishing or pharming websites.
  • Phishing attack can be disguised as a trusted party to steal personal information. For example, a malicious application could include a “Share on Facebook” button that redirects users to a spoofed target application, which could request the user’s secret credentials and steal the data.
  • Pharming attackers redirect Web traffic on a smartphone to a malicious or bogus website. By collecting the subscriber’s smartphone information, a pharming attack can lead to other attacks. For example, when a user browses a website on a smartphone, the HTTP header usually includes information about the smartphone’s operating system, browser, and version number. With this information, an attacker can learn the smartphone’s security vulnerabilities and start other directed attacks.
  • Vishing (short for voice phishing): In this attack malicious users try to gain access to financial records and other private information.
  • Jamming device is used to disrupt the communication between the smartphone and its base station.

Motivation

Resources

Research Papers

Last modified 2 years ago Last modified on 07/29/15 15:48:09