mobile handsets: a panoramic overview. outline introduction handset architecture handset operating...

63
Mobile Handsets: A Panoramic Overview

Upload: sheena-grant

Post on 20-Jan-2016

232 views

Category:

Documents


0 download

TRANSCRIPT

Page 1: Mobile Handsets: A Panoramic Overview. Outline Introduction Handset Architecture Handset Operating Systems Networking Applications Security Risks and

Mobile Handsets: A Panoramic Overview

Page 2: Mobile Handsets: A Panoramic Overview. Outline Introduction Handset Architecture Handset Operating Systems Networking Applications Security Risks and

Outline

• Introduction• Handset Architecture• Handset Operating Systems• Networking• Applications• Security Risks and Mitigation

Strategies

Page 3: Mobile Handsets: A Panoramic Overview. Outline Introduction Handset Architecture Handset Operating Systems Networking Applications Security Risks and

What Is A Mobile Handset?

• A mobile handset (handset) is an electronic device that provides services to users, e.g.:– Managing address book– Scheduling calendar– Cellular telephony– Accessing Internet,

email

• Handsets include smartphones and PDAs

Example handsets:Apple iPhone, BlackBerry Storm, Palm TreoPro

Page 4: Mobile Handsets: A Panoramic Overview. Outline Introduction Handset Architecture Handset Operating Systems Networking Applications Security Risks and

Handsets: Your Next Computer?

• Handsets’ small form factor, mobility have yielded meteoric sales [1]– 3.3 billion mobile phone subscriptions as of

Jan. 2008 (how about 2013 or 2014?)– 2.7 billion subscriptions correspond to one

person; some people have multiple phones!

• Rapid replacement rate: young adults replace phones every 6 months in South Korea [1]

• These statistics are just for phones • Your handset: your next computer? [2]

Page 5: Mobile Handsets: A Panoramic Overview. Outline Introduction Handset Architecture Handset Operating Systems Networking Applications Security Risks and

What’s Inside a Mobile Handset?

Source: [3]

Page 6: Mobile Handsets: A Panoramic Overview. Outline Introduction Handset Architecture Handset Operating Systems Networking Applications Security Risks and

Handset Architecture (1)

• Handsets use several hardware components:– Microprocessor– ROM– RAM– Digital signal processor– Radio module– Microphone and speaker– Hardware interfaces– LCD display

Page 7: Mobile Handsets: A Panoramic Overview. Outline Introduction Handset Architecture Handset Operating Systems Networking Applications Security Risks and

Handset Architecture (2)

• Handsets store system data in electronically-erasable programmable read-only memory (EEPROM)– Service providers can reprogram phones

without requiring physical access to memory chips

• OS is stored in ROM (nonvolatile memory)

• Most handsets also include subscriber identity module (SIM) cards

Page 8: Mobile Handsets: A Panoramic Overview. Outline Introduction Handset Architecture Handset Operating Systems Networking Applications Security Risks and

Handset Microprocessors

• Handsets use embedded processors– Intel, ARM architectures dominate market.

Examples include:• BlackBerry 8700, uses Intel PXA901 chip [4]• iPhone, uses Samsung ARM 1100 chip [5]

– Low power use and code size are crucial [3]– Microprocessor vendors often package all

the chip’s functionality in a single chip (package-on-package) for maximum flexibility

Page 9: Mobile Handsets: A Panoramic Overview. Outline Introduction Handset Architecture Handset Operating Systems Networking Applications Security Risks and

Example: The iPhone’s CPU

• The iPhone: a real-world mobile handset [6–7]– Runs on Samsung

S3C6400 chip, supports ARMv6 architecture

– Very few details are known about the “ARM Core”, esp. given Apple’s secrecy

– Highly modular architecture

• Similar to Apple’s iPod Touch, which lacks telephony capability [8]

Source: [6]

Page 10: Mobile Handsets: A Panoramic Overview. Outline Introduction Handset Architecture Handset Operating Systems Networking Applications Security Risks and

SIM Cards

• They include their own microprocessor and 16 KB – 4 MB EEPROM

• They come in two sizes• Their versatility arises from portability of

information– SIM card identifies subscriber to network– Stores personal information, address books,

messages, service-related information

Page 11: Mobile Handsets: A Panoramic Overview. Outline Introduction Handset Architecture Handset Operating Systems Networking Applications Security Risks and

Other Memory Cards

• Some handsets include other peripheral memory cards:– Compact Flash– Multimedia Card– Secure Digital

• Handsets synchronize with a computer• Nowadays, computers include slots of

various sizes to hold these memory cards

Page 12: Mobile Handsets: A Panoramic Overview. Outline Introduction Handset Architecture Handset Operating Systems Networking Applications Security Risks and

Handset Operating Systems

• Currently, handsets run several OSes:– Symbian OS – iPhone OS (an embedded version of OS X)– Windows Mobile– BlackBerry OS– Google Android Platform (based on Linux)

• With the exceptions of Symbian and Android, these OSes are proprietary [9–10]

• Telecom carriers frequently “lock down” handset firmware, OSes to prevent user modifications

Page 13: Mobile Handsets: A Panoramic Overview. Outline Introduction Handset Architecture Handset Operating Systems Networking Applications Security Risks and

Handset OS Usage

• According to British analysis firm Canalys, handset OS usage in 3Q 2008 had the following ranking (most to least): [11]

1. Symbian OS2. iPhone OS3. BlackBerry OS4. Windows Mobile5. Linux (Android, etc.) 6. Others

• iPhone OS surged ahead of BlackBerry OS, but with new BlackBerries and Android phones, this ranking may easily change in the future [11] (What is the ranking now?)

• We’ll now examine each OS individually

Page 14: Mobile Handsets: A Panoramic Overview. Outline Introduction Handset Architecture Handset Operating Systems Networking Applications Security Risks and

Symbian OS

• Dominant OS in the mobile handset market (This is the case of 2008. How about now? why?)

• Runs exclusively on ARM processors• Owned by British firm Symbian Ltd.• Descendant of Psion EPOC OS (dev. in 1990s)• Sony Ericsson, Nokia, et al. bought shares in

the firm until Nokia bought Symbian in 2008, formed Symbian Foundation to further future open handset development [12]

• Nokia plans to open-source the OS by 2009 [9]

Page 15: Mobile Handsets: A Panoramic Overview. Outline Introduction Handset Architecture Handset Operating Systems Networking Applications Security Risks and

Design of Symbian OS

• Based on Psion EPOC; desktop OS features include: [13]– “Bare-bones” microkernel (nanokernel)– Pre-emptive multitasking– Memory protection

• Handset-centric design, can operate several months without reboot

• Supports multiple UIs based on smartphone form factor (e.g., 320 × 240)

Page 16: Mobile Handsets: A Panoramic Overview. Outline Introduction Handset Architecture Handset Operating Systems Networking Applications Security Risks and

Symbian OS Devices

• Numerous handsets use Symbian OS; UIs largely based on manufacturer & device– Nokia S60: includes J2ME, std. UI (mostly

Nokia phones)– Nokia S80: QWERTY keyboard, Web browser,

enterprise office-doc. support (older Nokia Communicators)

– Nokia S90: used only on Nokia 7710– UIQ: Sony Ericsson/Motorola GUI platform used

primarily on those companies’ handsets– FOMA platform: closed-dev. software platform

used by handsets on NTT DoCoMo’s network (Japan)

Page 17: Mobile Handsets: A Panoramic Overview. Outline Introduction Handset Architecture Handset Operating Systems Networking Applications Security Risks and

Symbian OS v9 Architecture

Source: [15] (heavily modified)

Page 18: Mobile Handsets: A Panoramic Overview. Outline Introduction Handset Architecture Handset Operating Systems Networking Applications Security Risks and

Symbian OS Development

• Native language is C++– Nokia provides free Eclipse-based Carbide.c++

development tools, Carbide.vs Visual Studio plugin– Mac & Linux development is possible

• Can program in many other languages: C, Java, Ruby, Python, Perl, OPL, Visual Basic, Simkin

• Applications needing any capabilities beyond bare minimum must be cryptographically signed (see http://www.symbiansigned.com)

• Can also program in Adobe Flash Lite (mobile version of Flash)

Page 19: Mobile Handsets: A Panoramic Overview. Outline Introduction Handset Architecture Handset Operating Systems Networking Applications Security Risks and

iPhone OS

• Runs on both the iPhone and iPod Touch• Variation of Mach microkernel-based OS

X that fits in 512 MB flash memory, runs on ARM architecture [21]

• Four abstraction layers: Core OS, Core Services, Media, Cocoa Touch [22]

• Core Animation and PowerVR MBX 3D hardware provide interface animations

• 320 × 480 LCD display that supports multi-touch gestures

Page 20: Mobile Handsets: A Panoramic Overview. Outline Introduction Handset Architecture Handset Operating Systems Networking Applications Security Risks and

iPhone Developer Program

• iPhone Developer Program provides dev. tools, iPhone emulator, means to upload to App Store (SDK)

• To download SDK, you must apply to be a member, pay fees– Standard Developer: $99– Enterprise Developer: $299– Exception: Apple’s free iPhone Developer

University Program for higher-ed. institutions [23]

• SDK only runs on Mac OS X Leopard on Intel-based Macs (go figure)

Page 21: Mobile Handsets: A Panoramic Overview. Outline Introduction Handset Architecture Handset Operating Systems Networking Applications Security Risks and

iPhone Web App Development

• You can develop Web apps for iPhone – so long as they run on Safari [24]

• Safari features: [25–26]– Auto-resizes Web pages to fit browser size– Multi-touch functionality– XHTML 1.1, CSS 2.1, JavaScript, W3C DOM Level 2,

AJAX technology, cookies, …

• Does not support Flash or Java• iPhone Web apps should:

– Minimize user awareness of browser experience– Reproduce control style, layout, behavior of iPhone

apps– Integrate with built-in iPhone features & services

Page 22: Mobile Handsets: A Panoramic Overview. Outline Introduction Handset Architecture Handset Operating Systems Networking Applications Security Risks and

BlackBerry OS

• BlackBerry OS is Research in Motion’s (RIM’s) proprietary OS for its BlackBerry handsets

• Provides multitasking, heavily uses BlackBerry input devices, e.g., thumbwheel

• Current OS 4 provides a subset of Java’s Mobile Information Device Profile (MIDP) 2.0

• Developers can use these APIs, proprietary APIs to write software

• All applications must be digitally signed so to “link” an app with the developer

Page 23: Mobile Handsets: A Panoramic Overview. Outline Introduction Handset Architecture Handset Operating Systems Networking Applications Security Risks and

BlackBerry Software• Email from BlackBerry service, MS Exchange,

Domino, Yahoo, etc. can be “pushed” to the handset• Can view PDF, MS Word, Excel, PowerPoint

attachments• BlackBerry Browser (only supports JavaScript)• Other online apps include:

– BlackBerry Maps– Facebook services– Yahoo Messenger, Google Talk

• Calendar, Address Book, and PIM Sync via USB• GPS• See http://www.blackberry.com for much more

information about handset and desktop software

Page 24: Mobile Handsets: A Panoramic Overview. Outline Introduction Handset Architecture Handset Operating Systems Networking Applications Security Risks and

BlackBerry Wireless Platform

• RIM provides standards-based platform and developer tools to develop and deploy custom wireless applications– HTML Web browser– Java Mobile Edition development tools– .NET applications

• BlackBerry handsets support standard networking protocols and connect to any type of server application

Page 25: Mobile Handsets: A Panoramic Overview. Outline Introduction Handset Architecture Handset Operating Systems Networking Applications Security Risks and

BlackBerry Mobile Data System

• BlackBerry Mobile Data System (MDS) supports MS Exchange, Lotus Domino, Novell GroupWire, and RIM’s own MDS systems for messaging applications

Page 26: Mobile Handsets: A Panoramic Overview. Outline Introduction Handset Architecture Handset Operating Systems Networking Applications Security Risks and

BlackBerry Mobile Voice System

• With this service, there’s only one business number BlackBerry users must remember

• Calls are routed to a BlackBerry handset, regardless of whether the call is directed to an office or mobile phone [27]

• Provides security and authentication through BlackBerry Enterprise Servers [28]

• IT administrators can lock down handsets, route calls through their telecom infrastructure, etc. [27–28]

Page 27: Mobile Handsets: A Panoramic Overview. Outline Introduction Handset Architecture Handset Operating Systems Networking Applications Security Risks and

BlackBerry Internet Services

• BlackBerry Internet Service leverages centrally-hosted wireless gateways, allowing users to access up to 10 supported email accounts, browse Internet

Page 28: Mobile Handsets: A Panoramic Overview. Outline Introduction Handset Architecture Handset Operating Systems Networking Applications Security Risks and

BlackBerry Developer Tools

• RIM provides several development tools:– BlackBerry MDS Studio

• Developers can quickly create rich client apps using component-based drag-and-drop approach

• Tool requires MDS runtime

– BlackBerry plugin for MS Visual Studio (development on MDS platform)

– BlackBerry Java Development Environment (JDE)

• Provides IDE, simulation tools for Java ME app for Java-based BlackBerry so developers can create standalone or client-server apps

Page 29: Mobile Handsets: A Panoramic Overview. Outline Introduction Handset Architecture Handset Operating Systems Networking Applications Security Risks and

Windows Mobile

• Windows Mobile is powered by Microsoft’s Windows CE embedded OS; Windows CE runs on x86, MIPS, ARM, Hitachi SuperH processors

• Latest version, 6.1, includes Windows Live services, Exchange 2007 mail access

• Designed to closely mimic desktop Windows:– Windows Mobile 6.1 includes mobile versions of

Office applications, Outlook (w/HTML email), Internet Explorer, Windows Media Player

– SQL Server 2005 included in ROM– .NET Compact Framework 2.0 included

Page 30: Mobile Handsets: A Panoramic Overview. Outline Introduction Handset Architecture Handset Operating Systems Networking Applications Security Risks and

Windows Mobile Development (1)

• Native code is developed with MS Visual C++

• Microsoft strongly recommends development with managed code [19]

– Managed code is written in one of the .NET framework object-oriented languages

– Compiled to MS Intermediate Language (MSIL) that all the languages share

– At execution time, MSIL is compiled “just in time” to native object code

• Contrast with Java:– Java code is compiled to Java

bytecode– Java interpreter interprets

bytecode, dynamically compiles frequently-accessed bytecode into native object code (HotSpot)

.NET Framework in Context. Source: [19]

Page 31: Mobile Handsets: A Panoramic Overview. Outline Introduction Handset Architecture Handset Operating Systems Networking Applications Security Risks and

Windows Mobile Development (2)

• Windows Mobile development tools include:– Plugins for MS Visual Studio 2005,

2008, etc.– SDKs for Windows Mobile-based

handsets– Microsoft gives away Visual Studio to

students for free with its DreamSpark program [20]

Page 32: Mobile Handsets: A Panoramic Overview. Outline Introduction Handset Architecture Handset Operating Systems Networking Applications Security Risks and

Android Mobile Handset Platform

• Android is a software development platform for mobile handsets that is based on Linux

• Developed by Google and Open Handset Alliance (OHA) for different handset manufacturers

– The Alliance includes T-Mobile, Sprint Nextel, Google, Intel, Samsung, Wind River Systems, et al. [29]

– Its purpose is to build a fully free and open mobile handset platform to facilitate development of handsets, software, services [30]

• First Android-based handset is T-Mobile G1 [31]

Page 33: Mobile Handsets: A Panoramic Overview. Outline Introduction Handset Architecture Handset Operating Systems Networking Applications Security Risks and

Android Architecture

Page 34: Mobile Handsets: A Panoramic Overview. Outline Introduction Handset Architecture Handset Operating Systems Networking Applications Security Risks and

Android Features and Software

• Features– 3D: OpenGL ES 1.0– SQLite: Database engine– WebKit: Web browser– Dalvik: Register-based

VM similar to Java VM [32]

– FreeType: Bitmap and vector font rendering

– Connectivity: Bluetooth, 802.11, GPS

• Core Applications– Email client, SMS program,

calendar, Google Maps (and Apps), browser, etc.

– Written in Java

• App Framework– Full access to same

framework APIs– Architecture designed for

component reuse

• Runtime– Core C++ library– Multiple Dalvik VMs run in a

process, rely on Linux kernel for process isolation [32]

Page 35: Mobile Handsets: A Panoramic Overview. Outline Introduction Handset Architecture Handset Operating Systems Networking Applications Security Risks and

Android SDK

• Android SDK provides required tools and APIs to develop apps on Android platform using Java– Android is licensed under the Apache open-

source license– The Android Development Tools (ADT) Eclipse

plugin eases development– Download the Android SDK at

http://code.google.com/android/ and the Eclipse plugin at https://dl-ssl.google.com/android/eclipse

Page 36: Mobile Handsets: A Panoramic Overview. Outline Introduction Handset Architecture Handset Operating Systems Networking Applications Security Risks and

A Quick Summary on Handset OSes

36

iOS Android Windows Phone

BlackBerry OS

Symbian OS

Company Apple Open Handset Alliance, Google

Microsoft Research in Motion

Accenture on behalf of Nokia

Open Source? No Yes No No Yes

OS Family Darwin Linux Windows NT QNX Psion’s EPOC

Supported CPU Architecture

ARM, ARM64 ARM, x86, MIPS, 64-bit variants of each

ARM ARM ARM, x86

Programming Language

C, C++,Objective-C, Swift

C, C++, Java C# (.NET), VB.NET, C, C++, DirectX

C, C++,HTML5, JavaScript, Java ME

C, C++, Java ME, Python

Development Cost

$0 (univ.), $99/yr. (person), $299/yr. (corp.)

$0 $0 $0 $0

App Store Publishing cost

Included in dev. cost

$25 one-time $0 (1 yr., student)$19/yr. (person), $99/yr. (corp.)

$0 $0

Page 37: Mobile Handsets: A Panoramic Overview. Outline Introduction Handset Architecture Handset Operating Systems Networking Applications Security Risks and

Handset Networking

• Handsets communicate with each other and with service providers via many networking technologies

• There are two “classes” of these technologies:– Cellular telephony– Wireless networking

• Most handsets support both, some also support physical connections such as USB

Page 38: Mobile Handsets: A Panoramic Overview. Outline Introduction Handset Architecture Handset Operating Systems Networking Applications Security Risks and

Cellular Telephony Basics (1)

• There are many types of cellular services; before delving into details, focus on basics

• Cellular telephony is a radio-based technology; radio waves are electromagnetic waves that antennas propagate

• Most signals are in the 850 MHz, 900 MHz, 1800 MHz, and 1900 MHz frequency bands (Frequency, Bandwidth, Transmission speed?)

Cell phones operate in this frequency range (note the logarithmic scale)

Page 39: Mobile Handsets: A Panoramic Overview. Outline Introduction Handset Architecture Handset Operating Systems Networking Applications Security Risks and

Cellular Telephony Basics (2)

• Digital signal processors (DSPs) are key to radio reception in handsets

• They transform signals from one form to another, e.g.:– Fourier transforms– Discrete cosine

transformSource: [3]

Page 40: Mobile Handsets: A Panoramic Overview. Outline Introduction Handset Architecture Handset Operating Systems Networking Applications Security Risks and

Cellular Telephony Basics (3)

• Cells and base stations– Space is divided into

cells, and each cell has a base station (tower and radio equipment)

– Base stations coordinate themselves so mobile users can access the network

– If you move from one cell to another, the first cell notices your signal strength decreasing, the second cell notices your signal strength increasing, and they coordinate handover so your handset switches to the latter cell

Page 41: Mobile Handsets: A Panoramic Overview. Outline Introduction Handset Architecture Handset Operating Systems Networking Applications Security Risks and

Cellular Telephony Basics (4)

• Statistical multiplexing– Time Division Multiple Access (TDMA)

• A 30 kHz-wide and 6.7 ms-long band is split into 3 time slots

• Each conversation gets the radio 1/3 of the time; voice data is converted to digital information and compressed to use less transmission space

Page 42: Mobile Handsets: A Panoramic Overview. Outline Introduction Handset Architecture Handset Operating Systems Networking Applications Security Risks and

Cellular Telephony Basics (5)

• Statistical multiplexing cont’d.– Frequency Division Multiple Access

(FDMA)• Analogous to TDMA, but each conversation

uses a different frequency in the same band

– Code Division Multiple Access (CDMA) [38]

• Uses spread-spectrum technology and different pseudo-noise codes so multiple users share the same physical channel

Page 43: Mobile Handsets: A Panoramic Overview. Outline Introduction Handset Architecture Handset Operating Systems Networking Applications Security Risks and

Cellular Telephony

• It is useful to think of cellular telephony in terms of generations: [33–37]– 0G: Briefcase-size mobile radio telephones– 1G: Analog cellular telephony– 2G: Digital cellular telephony– 3G: High-speed digital cellular telephony

(including video telephony)– 4G: IP-based “anytime, anywhere” voice, data,

and multimedia telephony at faster data rates than 3G (to be deployed in 2012–2015)

Page 44: Mobile Handsets: A Panoramic Overview. Outline Introduction Handset Architecture Handset Operating Systems Networking Applications Security Risks and

Other Handset Networks

• Many handsets not only support cellular telephony, they support other networking technologies as well:– Wireless

• Bluetooth (100 m max, 10 m for handsets)• IEEE 802.11 (longer range)• Infrared Data Association (IrDA)

– Wired• USB, etc.

Page 45: Mobile Handsets: A Panoramic Overview. Outline Introduction Handset Architecture Handset Operating Systems Networking Applications Security Risks and

Bluetooth

• Bluetooth is a technology specification for small form factor, low-cost, short-range wireless links between mobile handsets, Internet connectivity

• Max range is 100 m in 2.4 GHz frequency band (handsets: 10 m radios)

• There is possible interference with IEEE 802.11b WLANs operating in this band

• Max bandwidth is 3 Mbps for Bluetooth 2.x with Enhanced Data Rate

Page 46: Mobile Handsets: A Panoramic Overview. Outline Introduction Handset Architecture Handset Operating Systems Networking Applications Security Risks and

IEEE 802.11 Networks

• The IEEE 802.11 standards specify how electronic devices communicate with each other in wireless fidelity (Wi-Fi) networks

• Many handsets can communicate with each other this way

• There are many 802.11 standards [53]; we’ll only look at 802.11b, 802.11g, and WiMax here

• Other 802.11 standards provide greater security, which we’ll discuss later

Page 47: Mobile Handsets: A Panoramic Overview. Outline Introduction Handset Architecture Handset Operating Systems Networking Applications Security Risks and

IEEE 802.11 & WiMax Specs.

• 802.11b (1999): [51, 53]– Operates in the 2.4 GHz frequency band– Provides max 11 Mbps data rate– 38 m indoor range

• 802.11g (2003): [51, 53]– Operates in either 2.4 GHz or 5 GHz frequency bands– Provides max 54 Mbps data rate– 38 m indoor range

• WiMax (802.16): [52]– Operates in 2.3 GHz, 2.5 – 2.6 GHz frequency bands– Provides max 40 Mbps data rate now, 300 Mbps later– 3 km cell range

Page 48: Mobile Handsets: A Panoramic Overview. Outline Introduction Handset Architecture Handset Operating Systems Networking Applications Security Risks and

Wired Networks: USB

• The Universal Serial Bus (USB) is a ubiquitous standard for transferring data between computers (including handsets!) [55]– By definition, data is transferred one bit at a

time– USB 1.1 (1998): max 1.5 Mbps (low-speed), 12

Mbps (full-speed)– USB 2.0 (2000): max 480 Mbps– USB 3.0 (to be released in 2009 – 2010): max

5 Gbps

Page 49: Mobile Handsets: A Panoramic Overview. Outline Introduction Handset Architecture Handset Operating Systems Networking Applications Security Risks and

Handset Applications

• Many handset applications mirror those of computers, e.g., managing one’s schedule, Web browsing, etc.

• But handsets’ mobility is opening up new markets– Global mobile gaming market value expected to

reach €2.6 billion ($3.27 billion) in 2012– Global mobile advertising market value expected

to reach €1.77 billion ($2.23 billion) in 2012

• Also, handsets make mobile and location-based services possible, which we’ll discuss next

Page 50: Mobile Handsets: A Panoramic Overview. Outline Introduction Handset Architecture Handset Operating Systems Networking Applications Security Risks and

Mobile & Location-based Services

• Mobile social computing• Large-scale mobile collaboration• Mobile data

Page 51: Mobile Handsets: A Panoramic Overview. Outline Introduction Handset Architecture Handset Operating Systems Networking Applications Security Risks and

E-Shadow: An Example of Mobile Social Computing System

Page 52: Mobile Handsets: A Panoramic Overview. Outline Introduction Handset Architecture Handset Operating Systems Networking Applications Security Risks and

Key Handset Security Problems

• “At this point, mobile device capability is far ahead of security.” – Prof. Patrick Traynor, Georgia Tech (emphasis added) [62]

• Handset information can be stolen [63]– Transient information: Enhanced 911 can provide user location

information– Static information: “BlueSnarfing” attacks (connection without

owner’s knowledge), cracking Wired Equivalent Privacy (WEP) and Wi-Fi Protected Access (WPA) [64]

• Theft of service attacks, e.g., premium-rate calls/SMS messages [63]

• Denial-of-service attacks [63]– Flooding attacks overload the handset radio with garbage– Power-draining attacks attempt to drain the battery

• Botnets and DoS attacks against networks are likely in the future [62]

• Cybercriminals make 10× as much as security researchers! [69]

Page 53: Mobile Handsets: A Panoramic Overview. Outline Introduction Handset Architecture Handset Operating Systems Networking Applications Security Risks and

The Challenges Ahead• “[Because] the mobile communications field is evolving so

quickly, it presents a unique opportunity to design security properly—an opportunity we missed with the PC.” – Prof. Patrick Traynor [62]

• Since most people buy a new handset every 2 years, it’s vital to ensure the security of handset hardware, OSes, applications, and networks while maintaining usability [62]

• One suggested approach is to give handsets a “hard” power-off switch so they don’t have power when turned off [63]]

• Academic research will play a key role in this, as will user education to counter social engineering

• Given the sensitivity of information stored on handsets, cybercriminals may well find effective ways to use them to continue their nefarious acts, e.g., bot herding, data theft, etc., even with different operating systems, power constraints, and carriers

Page 54: Mobile Handsets: A Panoramic Overview. Outline Introduction Handset Architecture Handset Operating Systems Networking Applications Security Risks and

Questions?

Thank you!

Page 55: Mobile Handsets: A Panoramic Overview. Outline Introduction Handset Architecture Handset Operating Systems Networking Applications Security Risks and

Electromagnetic Frequency Spectrum

Adapted from http://kboo.fm/

Page 56: Mobile Handsets: A Panoramic Overview. Outline Introduction Handset Architecture Handset Operating Systems Networking Applications Security Risks and

References (1)1. T. T. Ahonen, “When there is a mobile phone for half the planet:

Understanding the biggest technology”, 16 Jan. 2008, http://communities-dominate.blogs.com/ brands/2008/01/when-there-is-a.html

2. A. Wolfe, “Is the Smartphone Your Next Computer?”, InformationWeek, 4 Oct. 2008, http://www.informationweek.com/news/personal_tech/smartphones/ showArticle.jhtml?articleID=210605369

3. J. L. Hennessy and D. A. Patterson, Computer Architecture: A Quantitative Approach, 4th ed., Elsevier, 2007

4. Research in Motion, “BlackBerry 8700c Technical Specifications”, http://www.blackberry.com/products/pdfs/blackberry8700c_ent.pdf

5. R. Block, “iPhone processor found: 620MHz ARM CPU”, Engadget, 1 Jul. 2007, http://www.engadget.com/2007/07/01/iphone-processor-found-620mhz-arm/

6. Samsung Semiconductor, “Product Technical Brief: S3C6400, Jun. 2007”, http://www.samsung.com/global/system/business/semiconductor/product/2007/8/21/661267ptb_s3c6400_rev15.pdf

7. Wikipedia, “iPhone”, updated 15 Nov. 2008, http://en.wikipedia.org/wiki/Iphone

8. Wikipedia, “iPod Touch”, updated 14 Nov. 2008, http://en.wikipedia.org/wiki/ Ipod_touch

Page 57: Mobile Handsets: A Panoramic Overview. Outline Introduction Handset Architecture Handset Operating Systems Networking Applications Security Risks and

References (2)9. N. Cubrilovic, “Symbian Goes Open Source – Courtesy of Nokia”,

TechCrunchIT, 24 Jun. 2008, http://www.techcrunchit.com/2008/06/24/symbian-goes-open-source-courtesy-of-nokia/

10. “Android – An Open Handset Alliance Project”, http://code.google.com/android/

11. Canalys, “Global smart phone shipments rise 28%: Nokia retains lead, but Apple moves into number two position”, 6 Nov. 2008, Press Release, http://canalys.com/pr/2008/r2008112.htm

12. Nokia, “Nokia to acquire Symbian Limited to enable evolution of the leading open mobile platform”, 24 Jun. 2008, Press Release, http://www.nokia.com/A4136001?newsid=1230415

13. Wikipedia, “Symbian OS”, updated 13 Nov. 2008, http://en.wikipedia.org/wiki/ Symbian_os

14. Symbian Ltd., “Symbian OS”, http://www.symbian.com/symbianos/15. B. Morris, “Symbian OS Architecture Overview”, Wireless Developer

Forum UK ’06, Symbian Software Ltd., http://developer.symbian.com/wiki/download/attachments/1376/Ben_Morris.ppt?version=1

16. Wikipedia, “Palm OS”, updated 3 Nov. 2008, http://en.wikipedia.org/wiki/ Palm_os

Page 58: Mobile Handsets: A Panoramic Overview. Outline Introduction Handset Architecture Handset Operating Systems Networking Applications Security Risks and

References (3)17. Wikipedia, “Windows Mobile”, updated 13 Nov. 2008,

http://en.wikipedia.org/ wiki/Windows_mobile18. Wikipedia, “Windows CE”, updated 12 Nov. 2008,

http://en.wikipedia.org/wiki/ Windows_CE19. Microsoft Corp., “.NET Framework Conceptual Overview”, MSDN,

2008, http://msdn.microsoft.com/en-us/library/zw4w595w(printer).aspx20. Microsoft Corp., “Microsoft Gives Students Access to Technical

Software at No Charge to Inspire Success and Make a Difference”, 18 Feb. 2008, Press Release, http://www.microsoft.com/Presspass/press/2008/feb08/02-18GSDPR.mspx

21. K. Haslem, “Macworld Expo: Optimised OS X sits on ‘versatile’ Flash”, 12 Jan. 2007, Macworld, http://www.macworld.co.uk/ipod-itunes/news/ index.cfm?newsid=16927

22. Wikipedia, “iPhone OS”, updated 16 Nov. 2008, http://en.wikipedia.org/wiki/ IPhone_OS

23. Apple Inc., “iPhone Developer University Program”, 2008, http://developer.apple.com/iphone/program/university.html

24. Apple Inc., “Apple Developer Connection – Web Apps Dev Center”, 2008, http://developer.apple.com/webapps/

Page 59: Mobile Handsets: A Panoramic Overview. Outline Introduction Handset Architecture Handset Operating Systems Networking Applications Security Risks and

References (4)25. Apple Inc., “Apple – iPhone – Features – Safari”, 2008,

http://www.apple.com/iphone/features/safari.html26. Apple Inc., “Safari 3.1 Product Overview”, Jun. 2008,

http://images.apple.com/safari/docs/Safari_Product_Overview20080602.pdf

27. Research in Motion, “BlackBerry Mobile Voice System”, 2008, http://na.blackberry.com/eng/services/blackberry_mvs/

28. A. Succo, “RIM exec sees BlackBerry product as shaping telephony”, 22 May 2008, InfoWorld, http://www.infoworld.com/news/feeds/08/05/22/RIM-exec-sees-BlackBerry-product-as-shaping-telephony.html

29. Open Handset Alliance, “Members”, http://www.openhandsetalliance.com/ oha_members.html

30. Open Handset Alliance, “Overview”, http://www.openhandsetalliance.com/ oha_overview.html

31. Wikipedia, “Android (mobile device platform)”, updated 16 Nov. 2008, http://en.wikipedia.org/wiki/Android_(mobile_device_platform)

32. Google Inc., “What Is Android?”, 2008, http://code.google.com/android/what-is-android.html#runtime

Page 60: Mobile Handsets: A Panoramic Overview. Outline Introduction Handset Architecture Handset Operating Systems Networking Applications Security Risks and

References (5)33. Wikipedia, “Mobile radio telephone”, updated 6 Jul. 2008,

http://en.wikipedia.org/wiki/0G

34. Wikipedia, “1G”, updated 6 Aug. 2008, http://en.wikipedia.org/wiki/1G

35. Wikipedia, “2G”, updated 18 Nov. 2008, http://en.wikipedia.org/wiki/2G

36. Wikipedia, “3G”, updated 19 Nov. 2008, http://en.wikipedia.org/wiki/3G

37. Wikipedia, “4G”, updated 11 Nov. 2008, http://en.wikipedia.org/wiki/4G

38. Wikipedia, “Code division multiple access”, updated 30 Oct. 2008, http://en.wikipedia.org/wiki/Code_division_multiple_access

39. Wikipedia, “GSM”, updated 14 Nov. 2008, http://en.wikipedia.org/wiki/GSM

40. Wikipedia, “IS-95”, updated 10 Oct. 2008, http://en.wikipedia.org/wiki/IS-95

41. Wikipedia, “Short message service”, updated 19 Nov. 2008, http://en.wikipedia.org/wiki/Short_message_service

42. Wikipedia, “Multimedia messaging service”, updated 3 Nov. 2008, http://en.wikipedia.org/wiki/Multimedia_Messaging_Service

43. Wikipedia, “Enhanced Data Rates for GSM Evolution”, updated 19 Nov. 2008, http://en.wikipedia.org/ wiki/Enhanced_Data_Rates_for_GSM_Evolution

44. Wikipedia, “CDMA2000”, updated 17 Nov. 2008, http://en.wikipedia.org/wiki/ CDMA2000

Page 61: Mobile Handsets: A Panoramic Overview. Outline Introduction Handset Architecture Handset Operating Systems Networking Applications Security Risks and

References (6)45. Wikipedia, “Universal Mobile Telecommunications System”, updated 18 Nov.

2008, http://en.wikipedia.org/wiki/Universal_Mobile_Telecommunications_System

46. Wikipedia, “W-CDMA (UTMS)”, updated 19 Oct. 2008, http://en.wikipedia.org/ wiki/W-CDMA_(UMTS)

47. Wikipedia, “High Speed Packet Access”, updated 15 Oct. 2008, http://en.wikipedia.org/wiki/High_Speed_Packet_Access

48. Bluetooth SIG, “Basics”, 2008, http://www.bluetooth.com/Bluetooth/ Technology/Basics.htm

49. Bluetooth SIG, “Profiles Overview”, 2008, http://www.bluetooth.com/Bluetooth/ Technology/Works/Profiles_Overview.htm

50. Wikipedia, “Wi-Fi”, updated 18 Nov. 2008, http://en.wikipedia.org/wiki/Wi-fi51. Wikipedia, “Wi-Fi technical information”, updated 31 Oct. 2008,

http://en.wikipedia.org/wiki/Wi-Fi_Technical_Information52. WiMax Forum, “Frequently Asked Questions”, http://www.wimaxforum.org/

documents/faq/53. Wikipedia, “IEEE 802.11”, updated 16 Nov. 2008,

http://en.wikipedia.org/wiki/ 802.1154. Infrared Data Association, “Welcome to IrDA”, http://www.irda.org/

displaycommon.cfm?an=1&subarticlenbr=14

Page 62: Mobile Handsets: A Panoramic Overview. Outline Introduction Handset Architecture Handset Operating Systems Networking Applications Security Risks and

References (7)55. Wikipedia, “Universal Serial Bus”, updated 19 Nov. 2008,

http://en.wikipedia.org/wiki/Usb56. Screen Digest, “iPhone breathes new life into mobile gaming market”, 31 Jul.

2008, Press Release, http://www.screendigest.com/press/releases/ pr_31_07_2008/view.html

57. Screen Digest, “Mobile media advertising opportunities: The market for advertising”, 2 May 2008, http://www.screendigest.com/reports/ 08mobilemediaadvert/pdf/08chinacabletv-pdf/view.html

58. B. Krebs, “Teen Pleads Guilty to Hacking Paris Hilton’s Phone”, Washington Post, 13 Sep. 2005, http://www.washingtonpost.com/wp-dyn/content/article/2005/ 09/13/AR2005091301423_pf.html

59. D. Emm, “Mobile malware – new avenues”, Network Security, 2006:11, Nov. 2006, pp. 4–6

60. M. Hypponen, “Malware Goes Mobile”, Scientific American, Nov. 2006, pp. 70–77, http://www.cs.virginia.edu/~robins/Malware_Goes_Mobile.pdf

61. PandaLabs, “PandaLabs Quarterly Report: January–March 2008”, http://pandalabs.pandasecurity.com/blogs/images/PandaLabs/2008/04/01/Quarterly_Report_PandaLabs_Q1_2008.pdf

62. Georgia Tech Information Security Center, “Emerging Cyber Threats Report for 2009”, http://www.gtiscsecuritysummit.com/pdf/CyberThreatsReport2009.pdf

Page 63: Mobile Handsets: A Panoramic Overview. Outline Introduction Handset Architecture Handset Operating Systems Networking Applications Security Risks and

References (8)63. D. Dagon et al., “Mobile Phones as Computing Devices: The Viruses are

Coming!”, IEEE Pervasive Computing, Oct. – Dec. 2004, pp. 11–1564. G. Fleishman, “Battered, but not broken: understanding the WPA crack”, Ars

Technica, 6 Nov. 2008, http://arstechnica.com/articles/paedia/wpa-cracked.ars

65. “CSL Unveils Mobile Security Service”, China Tech News, 31 Mar. 2008, http://www.chinatechnews.com/2008/03/31/6562-csl-unveils-mobile-security-service/

66. C. Fleizach et al., “Can You Infect Me Now? Malware Propagation in Mobile Phone Networks”, Proc. of ACM Workshop on Recurring Malcode (WORM ’07), Alexandria, VA, USA, 2 Nov. 2007, pp. 61–68.

67. H. Kim et al., “Detecting Energy-Greedy Anomalies and Mobile Malware Variants”, Proc. of the 6th Int’l Conf. on Mobile Systems, Applications, and Services (MobiSys ’08), Breckenridge, CO, USA, 17–20 Jun. 2008, pp. 239–252.

68. E. Sadun, “Programming with Safety Scissors and Glitter Glue”, Inside iPhone, 10 Oct. 2008, http://blogs.oreilly.com/iphone/2008/10/programming-with-safety-scisso.html

69. T. Claburn, “The Cybercrime Economy”, InformationWeek, 9 Apr. 2008, http://www.informationweek.com/blog/main/archives/2008/04/the_cyber_crime.html