Slashdot Mirror
What To Do About Mobile Devices That Lie
GMGruman writes "InfoWorld has caught two Android devices that falsely report security compliance that the Android OS does not actually support, and Apple quietly has dropped its jailbreak-detection API from iOS 4. So how can IT and businesses that allow iPhones, iPads, and Androids trust that the new generation of mobile devices won't become Trojan horses for malware? There's no easy answer, but Galen Gruman explains what current technologies can do to help — and how Apple, Google, and others might increase the trustworthiness of their platforms in the future."
Do nothing. Didn't we read yesterday that the NSA assumes they're compromised. Sounds like a healthy way to operate - for everyone. While it may sound slightly paranoid and a "hassle", this is only true initially IMHO.
So how can IT and businesses that allow iPhones, iPads, and Androids trust that the new generation of mobile devices won't become Trojan horses for malware?
You don't trust them. Just like you should be doing with desktops/laptops, don't setup services in a way that they allow a phone to ruin your data.
Treat them like any other computer.
"Have you ever thought about just turning off the TV, sitting down with your kids, and hitting them?"
And you've been doing this for at least the last 30 years...
And NOW you suddenly claim to give a shit about platform integrity?
And I suppose the complete absence of any mention of WinCE or Windows Mobile in the article is sheerest coincidence.
What selective, partisan crap.
Editor, A1-AAA AmeriCaptions
This is a good thing. Hack everything, open it all up. Trust is illusory, it's all about control.
Because nothing ever becomes a trojan horses for malware. In order to do so, that sentence would actually have to make sense. WTF is a Trojan Horse for Malware? A Trojan Horse is, by definiton malware. So long as the general public, and even Slashdot readers, are clueless, then cluelessness will map the security landscape.
Guns don't kill people; Physics kills people! - John Lithgow as Dick Solomon on Third Rock From The Sun
Palm Pre? I love my Pre, but in the early days it "lied" about what it was so it could sync via USB with iTunes as an Apple iPod.
If your going to take the bold step of asking a device if it is safe to use you might as well just go all in and mandate full evil bit compliance for all malicious IP packets. To test evil compliance simply invoke the javascript function iamastupidfoolEvilSupported(EVIL_FA_IL); If it returns true or raises a javascript error the device is totally secure and you have NOTHING to worry about.
Hackers, please stop lying to our computers and telling them you have permission to do things when you know you don't. There. . . . now nobody will get anymore spam or viruses.
I love when people say something "cannot be hacked". I also like the idea of security by requiring the client to tell the truth about what it is and what it can do. If everything would just tell the truth. . . we'd have better security. Sounds like the EA boss saying "To take the market back from Call of Duty, you just have to make a better game"
How's this crap get published?
If someone is setting up policies to make devices incompatible, they lose. End of story. Devices should be open, hacker-friendly, and free to lie. It's lies that form the foundation of virtualisation. It's lies that let us run OSs in VMs without permission. People who have a strong sense of policy do more to hold the platform back than advance it. More often than not, this is because of someone having the mistaken idea that information can be owned.
For every problem, there is at least one solution that is simple, neat, and wrong.
It's just sitting there.
watch us live as we syncronize broomstick licking on broomstick lickers, inc.!
There's no inherent reason Android devices could not use a verified boot (TPM+remote attestation). This would allow servers to know exactly what firmware image they're talking to, so whilst it wouldn't exactly stop devices lying about their capabilities, it'd allow you to catch devices that were lying once the general class of problem was detected.
The reason phones don't come with TPMs is simply cost and demand. If businesses really care about this, they'll make it clear that a TPM is as important to them as remote wipe and other things, manufacturers keen to find an edge will listen and the necessary changes can be made to Android as it's open source.
So .... let the free market operate and we'll see what happens. TPMs are cheap. It wouldn't take much pushing.
End user devices are not trustworthy, regardless of the type of device a user could modify it to report anything back to an upstream server...
http://spamdecoy.net - free throwaway anonymous email - avoid spam!
What To Do About Mobile Devices That Lie
"Have you ever tried simply turning off the TV, sitting down with your mobile devices, and hitting them?"
Unless there's a compelling business need there is no reason to allow Android or iOS devices to connect to a company's resources in any way. Personally if I were starting a new company I wouldn't allow anything other than a Blackberry to be used as a smartphone. One of the reasons RIM has been and continues to be successful in the business space is the security of their devices.
If people want their shiny toys they are free to get one on their own dime and use it with their own resources.
Better question, what to do about admins that don't test policies on devices they support before deployment?
Repeal the 17th Amendment TODAY! Also Please Read http://www.gnu.org/philosophy/right-to-read.html
Turn on phone for the first time,
"Which application auditor would you like to choose?"
"Which search engine would you like to use?"
"Which Browser would you like to use?"
A blog I run for the wealth
Microware's OS9 from the early 1980s had a table that it checked for each module it loaded into memory. Each library or executable had a CRC that it checked against and then that CRC was checked in a lookup table of stuff to accept or not load. You could load that table with a list of approved memory objects and then only those things would be loaded and run or you could list things to exclude like an old runtime library in which case it would try to find an approved one in the path. This stuff was being done 30 years ago on 8 bit CPUs. It should be an option on every OS today.
Start using BlackBerries if device security is an issue. When you need a hammer, don't use a screwdriver simply because everyone else is telling you that all the cool kids use screwdrivers.
If you want real security, get yourself a real smartphone: blackberry.
http://us.blackberry.com/ataglance/security/certifications.jsp
The blackberry platform has been tested, audited & certified from end to end by the governments of United States, Canada, the United Kingdom, Austria, Australia, Turkey, New Zealand, and NATO.
Android & iphone have been certified by... nobody.
And the way to deal with fraudulent advertising is the American way: sue the bastards.
you use windows in your desktop computers? Then the phone is the least of your actual risks.
"Trusted computing" my ass...
There's nothing to be trusted about anything you did not make yourself. And even if you made something yourself, trusting it is a bit overconfident. Do not trust anything you own to be "secure". It is not. It is as secure as the company that made it thinks is necessary.
Now, you know how security conscious the average person is, right?
Why do you think security would be high up on the priority scale of the company making it if it is no selling point AT ALL?
Do not trust anything you did not audit. If you cannot audit it yourself, have someone you trust audit it. Yes, at some point in that chain you will have to trust someone, especially if you do not have the knowledge and experience to do such an audit yourself.
But for $deity's sake, do NOT trust the maker of a device to be security conscious. They make a device with the bare minimum required to sell it. That means it will have all the features the customer will request. And as stated above, security is a feature that is rarely, if ever, requested!
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
If one of your end users jailbreaks their company supplied iPhone, fire them. If the company paid for the phone and pays for the phone service then it is the property of the company, not the end user.
If you officially allow employee iPhones to be used on the company exchange, ensure that it supports full device encryption before you enrol it on the network (iPhone 3GS or newer). Then periodically perform random audits of those phones to check to see if they are jailbroken. If they are, perform a remote wipe immediately to brick the device, remove the phone from exchange and discipline the user. Make sure that you include jailbreaking or any other circumvention of security policies in your policy documents as forbidden activities and have each employee sign it before allowing their device on the network.
The real question is how much do you trust your employee because they are always the potential weakest link.
A non-jailbroken iPhone 3GS or iPhone 4 is about as secure as a blackberry if you use exchange in your organization and perform a remote wipe when the phone is either lost or the employee leave the organization.
Jesus was a compassionate social conservative who called individuals to sin no more.
Frankly (feel free to flame) it appears to me that the virus/trojan/botnet programmers/scammers are far more intelligent than the majority of security professionals working the other side of the fence.
"If any question why we died, Tell them because our fathers lied."
If you RTFA you discover that the whole second half is boosterism for putting "Trusted Computing" modules inside cell phones. In that light the agnostic condensation of both "jailbroken iThingies" and "that unreliable open source Android thing" makes perfect sense.
This article has nothing to do with exchange boosterism etc, it is back-door partisanship for trying to revive the Trusted Computing Hardware Module that the technical industry managed to ignore into oblivion.
The article _is_ an attack on reason, but the goal isn't about Exchange etc, its about re-initializing the idea of corporate capture of your personal property and turning your device from a personal resource to a limited media consumption node. The media used this time isn't movies, its "corporate email" etc.
Disclaimer: I would _love_ TPM hardware if there were a law that required that _I_ get the _master_ _keys_ for my hardware when I buy it. This would, of course, allow me to lie to an exchange server if I so chose, and would do _nothing_ to prevent jailbreaks. Of course I would also have to demand that there was no "government key" etc. With those elements in place, a TPM would let my paranoia be soothed when I boot my gear.
So anyway, bitching about how bad exchange software is etc, falls into the hands of the author who is trying to false-flag some emergency to spur on "trusted computing" on the "new platform battlefield".
Innocent people shouldn't be forced to pay for inferior software development.
--"Code Complete" Microsoft Press
I am fairly well versed on FIPS standards for both HIPAA, PHIPA and rusty on DoD work. I 'try' every day... Please return to your assertion that blackberry encryption is weak and comprimised. I will state my challenge to you again in simple plain terms so you might understand before replying this time. 1. Cite articles from sources displaying proof of your assertion. I can't find any. Perhaps you could inform NIST of these breaches so that they can remove the offender from the certified list. 2. Provide details on why cracking iphone encryption comes up a lot on youtube, and blackberry not at all. Here is my link for abundant proof of my claim.- http://tinyurl.com/28wesd6 I'm patient. Take your time.
Seems to me this is another case of MS not able to write secure software. If a device can access Exchange when it shouldn't be able to, the problem is not with the device but with the buggy MS software.....