| | 8 | |
| | 9 | A smartphone is always exposed to various threats when it is used by the users. These threats can disrupt the operation of smartphone, modify or access the data. Smartphone threat model divides a phone into three layers: |
| | 10 | Application layer which includes all of the smartphone's apps, such as social networking software, email, text messaging, and synchronization software. |
| | 11 | Communication layer includes the carrier networks, Wi-Fi connectivity, Bluetooth network, Micro USB ports, and MicroSD slots. Malware can spread through any of these channels. |
| | 12 | Resource includes the flash memory, camera, microphone, and sensors within a smartphone. Because smartphones contain sensitive data, malware can target their resources |
| | 13 | to control them and manipulate data from them [3]. |
| | 14 | |
| | 15 | Prime targets for the attackers are: |
| | 16 | Data:Central data management is a part of a smartphone. Pictures, credit card information, Location, activity logs and private information etc. may be present as data in the |
| | 17 | smartphone. |
| | 18 | Identity:Smartphones belong to a specific user and are highly customizable. It can contain information related to the owner of the mobile contract or etc. |
| | 19 | Availability:An attacker can limit access to the smartphone by attacking it and this can lead to denial of service to the |
| | 20 | user. |
| 21 | | === Current Objective === |
| 22 | | 1. Looking for more security threats in IPhone and Android. |
| 23 | | 2. Writing a detailed Report. |
| | 34 | === Android === |
| | 35 | |
| | 36 | Android is the most popular smartphone open source operating system based on linux kernel. It was first released in 2008 on HTC dream smartphone. Android applications are written in java programming language combined to form an archive file with .apk sux. Android app runs in an isolated area of operating system called sandbox which does not have access to rest of the system's resources unless user grants the permission. Despite the security measures taken by Google Inc. , android is still vulnerable to attacks. In this study, android version x4.3- x5.1.1 was studied using Nexus 5 and Nexus 4. |
| | 37 | |
| | 38 | '''Google Wallet''': |
| | 39 | Google Wallet is a free digital wallet that securely stores your credit cards, debit cards, gift cards, loyalty cards, offers, and more. With Google Wallet, you can shop in stores,buy online, and send money. User can purchase using Google wallet card or NFC tap and pay if NFC feature available with the device. There is a serious threat in this, if a user has never used Google wallet but had previously purchased something from Google store, all the details of the user's credit card/ debit card will be saved in that account. Somehow device is lost in unlock mode with signed in Gmail account, anyone can set up the Google wallet account. All the credit card details will come up without even asking any authentication. Second threat is, user has to lock the wallet manually, it does not get locked when device is locked using a pin or password. User can use the wallet simply by unlocking the phone. |
| | 40 | |
| | 41 | '''Android Applications''' |
| | 42 | There are numerous applications in android which access location, modify text messages, and other personal details even though it is not required. Applications can make your |
| | 43 | profile saving your unique mobile id and other personal details on their servers. The application can be malicious application, accessing all your private information without |
| | 44 | your knowledge. To combat malicious applications, Google internally developed a malware blocking tool code named Bouncer. Google announced that Bouncer had been checking for malicious apps in Market for a while now", and as a result malware was declining. |
| | 45 | |
| | 46 | '''Smart Lock: Trusted Device''' |
| | 47 | Google rolled out this feature with Google Lollipop, in order to increase the security of the devices and making life easier. Smart Lock keeps the phone or tablet unlocked when it is in a safe environment, but you need to lock it manually when you feel it is not a safe environment.[[BR]] |
| | 48 | |
| | 49 | Settings->Trusted Agents-> Smart Lock[[BR]] |
| | 50 | |
| | 51 | This feature keep the phone unlocked when a trusted device is connected. Bluetooth watches, fitness trackers or speakers can be set as a trusted device. It is really important that trusted device is connected not an imitated version. Different devices supports different Bluetooth standard secure capabilities. There is possibility that someone could keep the phone unlocked by the imitating the Bluetooth connection.[[BR]] |
| | 52 | |
| | 53 | '''Smart Lock:Trusted Place''' |
| | 54 | This feature keeps the device unlocked, whenever the device is at a trusted location. For this to function you need to have an Internet connection and allow the device to use |
| | 55 | the current location for the trusted place. The Trusted location is an estimate and it could keep the device unlocked within a radius of up to 80 meters. If the device is lost from the trusted location, unwanted user can access all your information.[[BR]] |
| | 56 | |
| | 57 | '''Smart Lock:Trusted Face'''[[BR]] |
| | 58 | |
| | 59 | Settings->Smart Lock->Trusted Face[[BR]] |
| | 60 | |
| | 61 | Device uses the facial recognition technique to unlock the phone. After setting this feature, device will search for the owner's face and unlock it if it recognizes. This feature is less secure than pattern or pin because if someone looks similar to the device's owner, device can be unlocked. It does not works by saving photo on its server. Therefore, looks for the sharp features recorded at the time of the training. |
| | 62 | |
