Slashdot Mirror
What To Do About Mobile Devices That Lie
GMGruman writes "InfoWorld has caught two Android devices that falsely report security compliance that the Android OS does not actually support, and Apple quietly has dropped its jailbreak-detection API from iOS 4. So how can IT and businesses that allow iPhones, iPads, and Androids trust that the new generation of mobile devices won't become Trojan horses for malware? There's no easy answer, but Galen Gruman explains what current technologies can do to help — and how Apple, Google, and others might increase the trustworthiness of their platforms in the future."
Do nothing. Didn't we read yesterday that the NSA assumes they're compromised. Sounds like a healthy way to operate - for everyone. While it may sound slightly paranoid and a "hassle", this is only true initially IMHO.
So how can IT and businesses that allow iPhones, iPads, and Androids trust that the new generation of mobile devices won't become Trojan horses for malware?
You don't trust them. Just like you should be doing with desktops/laptops, don't setup services in a way that they allow a phone to ruin your data.
Treat them like any other computer.
"Have you ever thought about just turning off the TV, sitting down with your kids, and hitting them?"
And you've been doing this for at least the last 30 years...
And NOW you suddenly claim to give a shit about platform integrity?
And I suppose the complete absence of any mention of WinCE or Windows Mobile in the article is sheerest coincidence.
What selective, partisan crap.
Editor, A1-AAA AmeriCaptions
Because nothing ever becomes a trojan horses for malware. In order to do so, that sentence would actually have to make sense. WTF is a Trojan Horse for Malware? A Trojan Horse is, by definiton malware. So long as the general public, and even Slashdot readers, are clueless, then cluelessness will map the security landscape.
Guns don't kill people; Physics kills people! - John Lithgow as Dick Solomon on Third Rock From The Sun
Palm Pre? I love my Pre, but in the early days it "lied" about what it was so it could sync via USB with iTunes as an Apple iPod.
If your going to take the bold step of asking a device if it is safe to use you might as well just go all in and mandate full evil bit compliance for all malicious IP packets. To test evil compliance simply invoke the javascript function iamastupidfoolEvilSupported(EVIL_FA_IL); If it returns true or raises a javascript error the device is totally secure and you have NOTHING to worry about.
Hackers, please stop lying to our computers and telling them you have permission to do things when you know you don't. There. . . . now nobody will get anymore spam or viruses.
I love when people say something "cannot be hacked". I also like the idea of security by requiring the client to tell the truth about what it is and what it can do. If everything would just tell the truth. . . we'd have better security. Sounds like the EA boss saying "To take the market back from Call of Duty, you just have to make a better game"
How's this crap get published?
If someone is setting up policies to make devices incompatible, they lose. End of story. Devices should be open, hacker-friendly, and free to lie. It's lies that form the foundation of virtualisation. It's lies that let us run OSs in VMs without permission. People who have a strong sense of policy do more to hold the platform back than advance it. More often than not, this is because of someone having the mistaken idea that information can be owned.
For every problem, there is at least one solution that is simple, neat, and wrong.
There's no inherent reason Android devices could not use a verified boot (TPM+remote attestation). This would allow servers to know exactly what firmware image they're talking to, so whilst it wouldn't exactly stop devices lying about their capabilities, it'd allow you to catch devices that were lying once the general class of problem was detected.
The reason phones don't come with TPMs is simply cost and demand. If businesses really care about this, they'll make it clear that a TPM is as important to them as remote wipe and other things, manufacturers keen to find an edge will listen and the necessary changes can be made to Android as it's open source.
So .... let the free market operate and we'll see what happens. TPMs are cheap. It wouldn't take much pushing.
End user devices are not trustworthy, regardless of the type of device a user could modify it to report anything back to an upstream server...
http://spamdecoy.net - free throwaway anonymous email - avoid spam!
What To Do About Mobile Devices That Lie
"Have you ever tried simply turning off the TV, sitting down with your mobile devices, and hitting them?"
Better question, what to do about admins that don't test policies on devices they support before deployment?
Repeal the 17th Amendment TODAY! Also Please Read http://www.gnu.org/philosophy/right-to-read.html
Turn on phone for the first time,
"Which application auditor would you like to choose?"
"Which search engine would you like to use?"
"Which Browser would you like to use?"
A blog I run for the wealth
Microware's OS9 from the early 1980s had a table that it checked for each module it loaded into memory. Each library or executable had a CRC that it checked against and then that CRC was checked in a lookup table of stuff to accept or not load. You could load that table with a list of approved memory objects and then only those things would be loaded and run or you could list things to exclude like an old runtime library in which case it would try to find an approved one in the path. This stuff was being done 30 years ago on 8 bit CPUs. It should be an option on every OS today.
Unless there's a compelling business need there is no reason to allow Android or iOS devices to connect to a company's resources in any way.
Why stop there? Add Rim and Windows to the list as well. I challenge you to find a good business reason for any phone to be connected. When desire is great enough, a business justification will be made.
I need to get email on my phone! The fate of the free world is in the balance!
It's nonsense. Since we're caving in to give folks their wants rather than needs, might as well go all they way and let them use their iPhones & Droids.
"Give a woman two glasses of wine and some pad thai, and they'll agree to just about anything." the Sports Guy
you use windows in your desktop computers? Then the phone is the least of your actual risks.
"Trusted computing" my ass...
There's nothing to be trusted about anything you did not make yourself. And even if you made something yourself, trusting it is a bit overconfident. Do not trust anything you own to be "secure". It is not. It is as secure as the company that made it thinks is necessary.
Now, you know how security conscious the average person is, right?
Why do you think security would be high up on the priority scale of the company making it if it is no selling point AT ALL?
Do not trust anything you did not audit. If you cannot audit it yourself, have someone you trust audit it. Yes, at some point in that chain you will have to trust someone, especially if you do not have the knowledge and experience to do such an audit yourself.
But for $deity's sake, do NOT trust the maker of a device to be security conscious. They make a device with the bare minimum required to sell it. That means it will have all the features the customer will request. And as stated above, security is a feature that is rarely, if ever, requested!
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
So I may trust Blackberry if I trust the governments of the US, Canada, UK, Austria, Australia, Turkey, New Zealand and the NATO.
What if I do not?
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
If one of your end users jailbreaks their company supplied iPhone, fire them. If the company paid for the phone and pays for the phone service then it is the property of the company, not the end user.
If you officially allow employee iPhones to be used on the company exchange, ensure that it supports full device encryption before you enrol it on the network (iPhone 3GS or newer). Then periodically perform random audits of those phones to check to see if they are jailbroken. If they are, perform a remote wipe immediately to brick the device, remove the phone from exchange and discipline the user. Make sure that you include jailbreaking or any other circumvention of security policies in your policy documents as forbidden activities and have each employee sign it before allowing their device on the network.
The real question is how much do you trust your employee because they are always the potential weakest link.
A non-jailbroken iPhone 3GS or iPhone 4 is about as secure as a blackberry if you use exchange in your organization and perform a remote wipe when the phone is either lost or the employee leave the organization.
Jesus was a compassionate social conservative who called individuals to sin no more.
Frankly (feel free to flame) it appears to me that the virus/trojan/botnet programmers/scammers are far more intelligent than the majority of security professionals working the other side of the fence.
"If any question why we died, Tell them because our fathers lied."
If you RTFA you discover that the whole second half is boosterism for putting "Trusted Computing" modules inside cell phones. In that light the agnostic condensation of both "jailbroken iThingies" and "that unreliable open source Android thing" makes perfect sense.
This article has nothing to do with exchange boosterism etc, it is back-door partisanship for trying to revive the Trusted Computing Hardware Module that the technical industry managed to ignore into oblivion.
The article _is_ an attack on reason, but the goal isn't about Exchange etc, its about re-initializing the idea of corporate capture of your personal property and turning your device from a personal resource to a limited media consumption node. The media used this time isn't movies, its "corporate email" etc.
Disclaimer: I would _love_ TPM hardware if there were a law that required that _I_ get the _master_ _keys_ for my hardware when I buy it. This would, of course, allow me to lie to an exchange server if I so chose, and would do _nothing_ to prevent jailbreaks. Of course I would also have to demand that there was no "government key" etc. With those elements in place, a TPM would let my paranoia be soothed when I boot my gear.
So anyway, bitching about how bad exchange software is etc, falls into the hands of the author who is trying to false-flag some emergency to spur on "trusted computing" on the "new platform battlefield".
Innocent people shouldn't be forced to pay for inferior software development.
--"Code Complete" Microsoft Press
They've been found to meet the specifications of those places. If you don't know those specifications it tells you little.
The legal troubles blackberry has had mostly indicate the one you care about is Canada, as Canada's privacy laws were a problem with the UAE, India and a few other countries. The solution was always for those countries to get blackberry servers/datacenters that they could seize, since the ones in Canada were out of reach. If you truly don't trust Canada's privacy laws, that's your business. If you find a better country for laws dealing with that, please let us know, I'm sure a few people on Slashdot want to move there.
Just because I agree with some laws of a country does not mean that I trust its government.
For reference, see US constitution and US government.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
Actually you make a good point. If there ever really is a business need for a connected device though it should be something completely locked down. People are still free to have their own personal device that they pay for; there isn't a need to cave to user demand for features if they don't help give a competetive advantage.
I am fairly well versed on FIPS standards for both HIPAA, PHIPA and rusty on DoD work. I 'try' every day... Please return to your assertion that blackberry encryption is weak and comprimised. I will state my challenge to you again in simple plain terms so you might understand before replying this time. 1. Cite articles from sources displaying proof of your assertion. I can't find any. Perhaps you could inform NIST of these breaches so that they can remove the offender from the certified list. 2. Provide details on why cracking iphone encryption comes up a lot on youtube, and blackberry not at all. Here is my link for abundant proof of my claim.- http://tinyurl.com/28wesd6 I'm patient. Take your time.
Seems to me this is another case of MS not able to write secure software. If a device can access Exchange when it shouldn't be able to, the problem is not with the device but with the buggy MS software.....