Essay On Security Evaluation Of Smart Phone Device

 

A selection of papers concerning smart phone security has been placed  on eLearn in order to get you started. 

 

 

You should investigate exploits and security as it relates to smart phones. 

 

 

For example a security exploit could allow someone to use your phone as a listening device. You should investigate the following:

 

 

1. Basic principles and theory of smart phone security exploits.

 

 

2. The state of smart phone security from the past five years.

 

 

3. You should include the current state of smart phone security.

 

 

4. Your analysis of the likely future importance and effectiveness of smart phone security exploits.

 

 

5. A mark scheme for the assignment can be found here.

 

1. Analyse potential threats to computer systems and networks and evaluate countermeasures

 

 

2. Critically evaluate  security policies and techniques

 

 

3. Research and report on a security-related topic, using appropriate literature

 

 

The Use Of Smartphones Has Substantially Increased Recently. Mostly Because, Smartphones Deliver Customers With a Variety Of Services Including Phone Conversations, internet access, data exchange and storage, online and offline gaming, and other amusing applications. A smartphone is associated with difficulties such as privacy and security because these services generally have access to the user’s private information. The journey of the smartphone industry began, with Steve Jobs, Apple’s ex-CEO, when he introduced a plastic, microprocessor, and metal-made object to the global audience at Apple-Expo (Kuswoyo and Siregar, 2019). Furthermore, as he had promised to audiences, the smartphone has revolutionised how people live their lives (Ducich, 2017).

 

But understanding mobile computing is crucial before talking about smartphones. The usage of portable computer systems alongside mobile communication technology is what this phrase refers to (Liao et al., 2020). With the help of mobile computing, information, audio, and video may be sent wirelessly from one computing device to another without the need for a permanent physical connection. There are several ways to access the network, including the internet, LAN, intranet, WLAN, WAN and numerous other related techniques (Samshan et al., 2022). In the following sections, this study will discuss and provide a detailed overview of the issues related to smartphone security, along with preventive measures for these issues. Furthermore, this study will make its prediction(s) using a proper literature review related to smartphones and cloud security.

 

Mobile security is all about protecting private and  organisational data from unauthorised access and use. The mobile information security disciple is based on three tenets, which are known as CIA triad (WhatIs.com, 2022). These three tenets are confidentiality, integrity, and authentication. In the following sections, this study has thoroughly discussed the security issues within the mobile devices, which are evaluated based on their impacts over these three security tenets. 

 

Fig 1: CIA Data Security Triad

 

From the beginning, mobile devices had access and control over all the personal information of the users and their interests, as it helped the users to communicate from anywhere, anytime relying on aural networks as well as wireless data. As a result, cell phones have emerged as the entry point for both local and cloud-based personal information, which leads to information leaking the smartphone owners as well as their co-workers, including their contact information, texts, meetings, logbooks, and whereabouts. It is crucial to understand the most prevalent difficulty with cell phones is cybersecurity, which is and will continue to be one of the largest challenges of smartphone usage. Pushing malware applications is becoming the most common form of malicious activity and cybersecurity issue within handheld devices. The biggest smartphone OS (operating system) providers in the smartphone world are Google and Apple, who are constantly identifying and fixing any exposed vulnerabilities through OS and security patch updates, still every year millions of users getting affected by various kinds of attacks such as:

 

Phishing attacks are more of a traditional form of attack, where the attacker sends a fake email containing a malicious link and as soon as the user clicks on the link the privacy of the user will be breached (Energy Live News, 2022). However, at present, users have learned to spot fake emails and the spam filters of modern email servers are also able to block these types of malicious emails. But the technology and tactics have not only advanced for the users, but it has advanced for the attackers too. At present malicious actors are sending sketchy messages through Whatsapp or even using third-party applications (such as mobile games) available on Playstore or Appstore.

 

It can be seen in the case of Jeff Bezos, whose personal and corporative data got stolen as he clicked on a malicious link sent through Whatsapp (Shires, 2020). In the year 2018, Jeff Bezos received an unexpected Whatsapp video attachment from the Saudi Arabian prince Md. Bin Salman. According to the investigating team, the video file was loaded with malicious codes, and we were able to hack the phone and credentials of the world's richest person. The volume of information that came from Bezos' phone on average each day in the six months before the video download was only approximately 430 kilobytes, which increased after hours of getting the video, and the smartphone began totalling 101 megabytes of transfers for months afterwards. According to the UN reports, this number occasionally increased several orders of magnitude beyond the pre-hack baseline, jumping into the gigabit level, indicating malware-enabled data exfiltration. Additionally, the UN reported that the NSO Group’s Pegasus malware was used for the infiltration (Marczak et al., 2020). 

 

Supply chain compromised attacks are a more elaborated form of attack, as this type of attack contains a trojanized version of the legitimate application that includes also the factory firmware, which is impossible to identify from the original application. Once installed, this application will gain access to the phone’s mic, camera, and storage. A recent example of this form of attack is the SolarWinds attack, where Russian hackers pushed trojanized updates through the SolarWinds’ Orion application to its users gaining access to the US government's multiple departments in the year 2020 (Wolff, Growley and Gruden, 2021).

 

The malicious actors were able to gain access to the software development and delivery pipeline of SolarWinds company provided them with the opportunity of installing malicious code into the company's Orion planform drives called SolarWinds.Orion.BusinessLayer.dll (Sterle and Bhunia, 2021). The form of attack, lets infected file (.dll) go unnoticed for a considerable amount of time and enables the adversary to have an even more serious impact.

 

With the rise of the crypto industry, more and more malicious crypto miners are designing and including malicious codes that include crypto-mining tools within a mobile application, without informing the users. This type of attack does not ask the user for any consent or permission and continues to the victim's device to mine cryptocurrency for their profit, using the processor power and battery of the victim. In recent times Zoom video conferencing platform gain a huge hit due to the Covid-19 pandemic and the malicious actors took advantage of it and merged crypto mining malware with the original software package in 2020 (Tekiner et al., 2021). Another example shows that the ‘Monero’ cryptocurrency browser, Coinhive was abused by the hackers and turned into a crypto jacking platform, which was later banned in 2019(Chen, Meng, and Copeland, 2019).

 

Coinhive embedded site would run coinhive.js named JavaScript file that would mine Monero cryptocurrency on the website visitor’s machine. During 2017 and 2018, hackers started to implement modified coinhive.js scripts on governmental sites, live chat widgets, fundraising sites, YouTube advisements, mobile applications, routers, extensions of different browsers, and desktop applications, which would mine cryptocurrency on behalf of the hacker without knowing of the victim. 

 

There are many websites, which provide rewards for every click, and malicious actors take advantage of this type of website using a victim's mobile device. The hackers generally attack a victim's device by pushing malicious source code to the device and gaining access to the device. Then the hackers use click fraud practices to either increase the revenue of their third-party website or exhaust other advertisers by continuously clicking on the advertisement from the victim’s device. In the year 2020, Google found more than 50 Tekya Auto-clicker-induced applications in the Playstore and removed them from the Playstore (CHEQ, 2022).

 

 

The Tekya Auto-clicker was targeted toward games and puzzles made especially for children to minimise suspicion. Since no virus code allowed the applications to go past Google's inspections, they appeared to be perfectly benign on their own. The malicious component of the code, however, only became active after the mobile applications had been downloaded and the library using SDK (software development kit) had been updated. Once activated, Tekya conceals its automatic activity using Google's native MotionEvent method (Kim, Park and Son, 2021). This is the built-in functionality in Android that tracks user movements including touching, pinching, sliding, and some other activities with the device. The trojan then taps on advertisements inside the compromised apps to bring in money for the malicious hackers.

 

Best practises for mobile security are suggested precautions and standards for safeguarding users' privacy and mobile devices. Manufacturers of hardware and software typically lay forth and promote policies and guidelines that, when correctly followed, should maintain or raise the level of security. However, unexpected vulnerabilities can be found and used by attackers, which makes it impossible to completely ensure the security of mobile devices. Within the following part, this study will look at some preventive practices of mobile devices and applications.

 

In this modern society with the advancement of technology, the most mobile handheld devices are coming with biometric authentication (retina scanning, fingerprint scanning, face unlock) features along with multifactor authentication. The use of these biometric authentication features would mean no one without the user's biometric imprints will be able to access the device, which makes smart handheld devices more secure.

 

For a regular user, it is impossible to keep track of any vulnerabilities within the operating system, whether it is Android or iOS. However, the development team at Apple and Google are continuously monitoring and trying to find any vulnerabilities within the recent version of their OS and other software, which helps them in producing and providing regular updates and security patches. Installing and updating these security patches means the device will more likely to withstand any security threats. Additionally, these patches and updates provide additional performance and security bonuses. 

 

Backing up all data is the best practice against data loss or deletion. A scheduled data backup is one of the best practices, which would help the users in the prolonging lifetime of their data, especially because in this digitised world most of the data is in digitised format. The best choice for the backup would be the remote backup using a private or public cloud, which will allow the users to upload or download their data from any place at any time.

 

Data encryptions convert the form of data from one to another and only the authorised parties are able to decrypt or translate the data using the given hash code or password. The default encryption feature can be used on both device data and remote data, also the encryption is used while transmitting data over the network. However, the general public form of data encryption might lure the users to a false security sense. Additionally, the use of unprotected and unsecured public Wi-Fi can lead to data loss, which can be prevented by using a VPN (a virtual private network), as it provides secure transmission even over public Wi-Fi. 

 

The permissions an application can obtain, such as the device sensors (such as camera, microphone), contact information, or geolocation, are known as permissions. Existing OS versions come in a range of flavours that depend on the provider. The main principle is to only allow permissions that are required for the software to function properly. In other terms, a user must always follow the principle of the least privilege (PoLP), which limits the access of the applications to the requirements to perform the mentioned job.

 

 

Even after maintaining all the precautions does not guarantee a hundred per cent security for mobile or any kind of computing devices and in case of any security breach, the user should be able to remotely wipe all data from the devices by performing a factory reset. Wiping out all data is much better as compared to providing all the sensitive data to malicious actors in case of a security breach. In addition, remote data-wipe will help in case of un-installable malware. 

 

Mobile security is not only the most important component of individuals security but also for an enterprise’s security. And with time the use of mobile devices like smart phone, laptops, remote servers, and other IoT peripherals are continuously increasing within the industrial level, which are widely used in data transfers, applications, remote work, and remote system access (Check Point Software, 2022). This mobile usage already has widened the risk factors mentioned in this study, which have created even more need for the mobile security.

 

 

The way individuals access the internet has changed dramatically thanks to portable smartphones and tablets. Browsers, however, also play a part in the growth and sophistication of cyber-attacks. In response to the constantly evolving complexity of threats, new, cutting-edge security systems are being introduced. Future smartphones are at the most risk. Due to the wide range of threat vectors, they provide a very profitable target. These threats, which range between ransomware and headless worms to two-faced malware, cause a great deal of concern considering everything that is at risk. Even though gestures, security codes, and passwords try their hardest to prevent the uninvited out, your phone is still very susceptible to hackers. At the moment, tech businesses are seeking new solutions to increase security. One future answer to these problems will be the use of more secure biometric security, in form of block-chain based biometric security.

 

Using blockchain technology individuals can store their biometric data on the blocks of blockchain's de-centralised networks, which neither can be accessed nor can be altered by any malicious actors. Furthermore, the two-step authentication will also be the future of mobile security, as in case of a password theft the hacker would not be able to get access to the account only using the password (Wang, Li and Wang, 2018).

 

In conclusion, it can be said that the use of mobile smart devices will continue to increase with time and along with-it new forms of security threats related to mobile security will continue to grow too. Though, OS (operating system) manufacturers are trying their best to implement and provide security through security patches, the support from individual level will be needed to minimise security risks and the best possible way for that will be aware of cybersecurity at the ground level. As most public and private sector employees do not recognise the cybersecurity threats, causes different attacks mentioned in this study, can be changed for future generations by conducting cyber-awareness programs at schools, colleges, and workplaces.

 

Check Point Software. 2022. What is Mobile Security? - Check Point Software. [online] Available at: <https://www.checkpoint.com/cyber-hub/threat-prevention/what-is-mobile-security/#:~:text=Effectively%20Protecting%20Mobile%20Devices,of%20compromise%20by%20infected%20devices.> [Accessed 28 July 2022].

 

 

Chen, G., Meng, W. and Copeland, J., 2019, May. Revisiting mobile advertising threats with MAdLife. In The World Wide Web Conference (pp. 207-217).

 

 

CHEQ |. 2022. The biggest ad fraud cases of 2020, and what we learned. [online] Available at: <https://cheq.ai/biggest-ad-fraud-cases-in-2020/> [Accessed 23 July 2022].

 

 

Ducich, S., 2017. These Walls Can Talk: Securing Digital Privacy in the Smart Home under the Fourth Amendment. Duke L. & Tech. Rev., 16, p.I.

 

 

Energy Live News. 2022. Energy industry ‘most-hit’ for mobile phishing attacks - Energy Live News. [online] Available at: <https://www.energylivenews.com/2021/11/03/energy-industry-most-hit-for-mobile-phishing-attacks/> [Accessed 23 July 2022].

 

 

Kim, J., Park, J. and Son, S., 2021, February. The Abuser Inside Apps: Finding the Culprit Committing Mobile Ad Fraud. In NDSS.

 

 

Kuswoyo, H. and Siregar, R.A., 2019. Interpersonal metadiscourse markers as persuasive strategies in oral business presentation. Lingua Cultura, 13(4), pp.297-304.

 

 

Liao, B., Ali, Y., Nazir, S., He, L. and Khan, H.U., 2020. Security analysis of IoT devices by using mobile computing: a systematic literature review. IEEE Access, 8, pp.120331-120350.

 

 

Marczak, B., Anstis, S., Crete-Nishihata, M., Scott-Railton, J. and Deibert, R., 2020. Stopping the press: New York Times journalist targeted by Saudi-linked Pegasus spyware operator.

 

 

Shamsan, A.H., Raskar, S.B., Saha, S., Suleimenova, K., Madkar, S. and Sagybekova, A., 2022, April. Network Communication Technologies and its Role in Enabling Effective Communication. In 2022 6th International Conference on Trends in Electronics and Informatics (ICOEI) (pp. 697-702). IEEE.

 

 

Shires, J., 2020. The Simulation of Scandal: Hack-and-Leak Operations, the Gulf States, and US Politics (Fall 2020). Texas National Security Review. 

 

 

Sterle, L. and Bhunia, S., 2021, October. On SolarWinds Orion Platform Security Breach. In 2021 IEEE SmartWorld, Ubiquitous Intelligence & Computing, Advanced & Trusted Computing, Scalable Computing & Communications, Internet of People and Smart City Innovation (SmartWorld/SCALCOM/UIC/ATC/IOP/SCI) (pp. 636-641). IEEE.

 

 

Tekiner, E., Acar, A., Uluagac, A.S., Kirda, E. and Selcuk, A.A., 2021, September. SoK: cryptojacking malware. In 2021 IEEE European Symposium on Security and Privacy (EuroS&P) (pp. 120-139). IEEE.

 

 

Wang, D., Li, W. and Wang, P., 2018. Measuring two-factor authentication schemes for real-time data access in industrial wireless sensor networks. IEEE Transactions on Industrial Informatics, 14(9), pp.4081-4092.

 

 

WhatIs.com. 2022. What is the CIA Triad? Definition, Explanation, Examples - TechTarget. [online] Available at: <https://www.techtarget.com/whatis/definition/Confidentiality-integrity-and-availability-CIA> [Accessed 28 July 2022].

 

 

Wolff, E.D., Growley, K.M. and Gruden, M.G., 2021. Navigating the solarwinds supply chain attack. The Procurement Lawyer, 56(2).