Wireless communication is inherently insecure. My consulting experience has confirmed that some organizations understand this fact when connecting to wireless networks with their laptops. However, their awareness falters when connecting their mobile devices to the same networks. According to a Echoworx study, 44% of the surveyed audience at London’s Infosecurity Europe 2011 conference transmitted sensitive information unencrypted to the Internet via their mobile devices.
OWASP cites spoofing attacks and surveillance as significant when using wireless communications with a mobile device. Wifi, 3G, GSM, CDMA & bluetooth; these are but a few transport protocols targeted to affect the confidentiality and integrity of the transmitted data. The controls discussed in this installment are designed to make successful exploits more difficult and to obfuscate the data to the point that successful exploits will result in no return for the attacker.
SSL vs. TLS
SSL and TLS provide an end-to-end secure communication channel, but they support different encryption algorithms. For example, SSL does not support 3DES or AES encryption; algorithms required by applications that handle sensitive data such as user credentials, as well as personal or business-critical information. Data classification and organizational requirements will influence which one is implemented on a device. All Federal information systems that transmit sensitive information, for example, require the use of TLS.
Encryption Algorithms
The selection of encryption algorithms to support a mobile device will be determined by data classification considerations and business requirements. Several vendors in the defense industry, for example, are developing FIPS 140-2 validated devices to support applications used by the DoD and NSA. Some private industry applications may require similar encryption levels, but most use cases can be accommodated with SSL or TLS.
OWASP recommends that strong encryption algorithms and key lengths be used to protect data in motion. It also recommends that only signed certificates be allowed and that they are associated with reputable certificate authorities. Signed certificates allow you to verify the source and validity of an encryption certificate, countering unsigned certificates often employed by attackers to gain access to information. Additionally, it is imperative that chain validation is implemented when chained SSL certificates are used. The encryption management system on the device should make it possible for the user to determine the validity of a certificate via the user interface.
Lastly, the device should employ mechanisms that mitigate the threat of man-in-middle attacks such as SSL strip. These attacks take advantage of SSL connections that do not verify the identity of the remote server. This allows an attacker to intercept communications, determine the encryption key and decrypt the data in transit. Countermeasures employ various techniques to verify the communicating devices and the integrity of the encryption information.
The next installment of this series will explore user authentication/authorization and session management. McAfee’s solutions to this problem space will be detailed and mapped to OWASP recommendations. Until then, be sure to follow us on @McAfeeBusiness for regular updates on McAfee happenings and news.
By: Steven Fox
Thursday, November 17, 2011
Wednesday, November 16, 2011
McAfee Releases Top Five Tips to Avoid Bad Apps
While most apps on the market are legitimate, mobile devices have become a targeted platform for malware. It’s becoming more and more common for cybercriminals to corrupt a legitimate app with hidden malicious functionality. These illegitimate and compromised mobile apps are designed to steal information from smartphones, or to send out expensive text messages without a user’s consent. Dangerous apps are usually offered for free and masquerade as fun applications such as games, calendar and comedy apps. Another nasty trick is to pull a legitimate app off of one marketplace, insert malware into it and then re-publish it on other marketplaces or sites with a similar name.
Today, McAfee released some common-sense practices that anyone can take to help protect their smartphones and tablets from the growing threat of malware and the persistent threat of unsecured devices.
For the moment, the amount of detected smartphone malware is relatively low compared to malware that targets desktop or laptop PCs; but being aware that it exists is the first step toward protecting yourself and your data.
Research apps and their publishers thoroughly and check the ratings – better to install apps that are broadly used in the market or are recommended by your circle of friends and colleagues.
It is wise to purchase from a well-known, reputable app marketplace, such as Google’s Android Market or Apple’s App Store. One way for Android users to avoid installation of non-market applications is to de-select the “Unknown sources” option in the Applications Settings menu on their device. If the option is not listed, it means your mobile service provider has already done this for you.
When you install an app, you’ll see a list of permissions for services that are granted access to the hardware and software components on your device, like contacts, camera and location. If something in the permissions screen doesn’t look right, don’t install that app! For example, a game or alarm clock app probably doesn’t need to access your contacts or have the ability to transmit that data from your device.
Install antivirus software on your phone. It is a good idea to install an antivirus program when you get a new mobile device before you add any other apps.
One way to find out if your device has been infected by a bad app is to keep an eye on your wireless bill. Some rogue apps do things like make expensive calls to foreign numbers to fatten the bank account of various intermediary sites at your expense. Often the calls happen in the background or at times when you don’t realize your phone is doing something. Even if you haven’t been infected, you may have unwittingly subscribed to one of those annoying services that automatically bill you every month for things like ring tones, so check the bill every month; it only takes a few minutes.
McAfee can help users protect their mobile device and the mobile apps that reside on the device with McAfee Mobile Security and McAfee App Alert (beta). To learn more about these solutions, visit http://www.mcafee.com/mobilesecurity/.
By: John Dasher
Today, McAfee released some common-sense practices that anyone can take to help protect their smartphones and tablets from the growing threat of malware and the persistent threat of unsecured devices.
For the moment, the amount of detected smartphone malware is relatively low compared to malware that targets desktop or laptop PCs; but being aware that it exists is the first step toward protecting yourself and your data.
Research apps and their publishers thoroughly and check the ratings – better to install apps that are broadly used in the market or are recommended by your circle of friends and colleagues.
It is wise to purchase from a well-known, reputable app marketplace, such as Google’s Android Market or Apple’s App Store. One way for Android users to avoid installation of non-market applications is to de-select the “Unknown sources” option in the Applications Settings menu on their device. If the option is not listed, it means your mobile service provider has already done this for you.
When you install an app, you’ll see a list of permissions for services that are granted access to the hardware and software components on your device, like contacts, camera and location. If something in the permissions screen doesn’t look right, don’t install that app! For example, a game or alarm clock app probably doesn’t need to access your contacts or have the ability to transmit that data from your device.
Install antivirus software on your phone. It is a good idea to install an antivirus program when you get a new mobile device before you add any other apps.
One way to find out if your device has been infected by a bad app is to keep an eye on your wireless bill. Some rogue apps do things like make expensive calls to foreign numbers to fatten the bank account of various intermediary sites at your expense. Often the calls happen in the background or at times when you don’t realize your phone is doing something. Even if you haven’t been infected, you may have unwittingly subscribed to one of those annoying services that automatically bill you every month for things like ring tones, so check the bill every month; it only takes a few minutes.
McAfee can help users protect their mobile device and the mobile apps that reside on the device with McAfee Mobile Security and McAfee App Alert (beta). To learn more about these solutions, visit http://www.mcafee.com/mobilesecurity/.
By: John Dasher
Subscribe to:
Posts (Atom)