Securing Apps for Mobile Devices

The proportion of mobile devices providing open platform functionality is

expected to increase in future. The openness of these platforms offers

significant opportunities to all parts of the mobile ecosystem, enabling

flexible program and service delivery options that may be installed, removed or

refreshed multiple times in line with user needs. However, with openness comes

the responsibility to stop unrestricted access of mobile resources and APIs to

applications of unknown and untrusted origin. This can lead to a major security

breach which may result in damage to a user's device, the network or all of

these, if not managed by suitable security architecture and network precautions.

Interestingly, with the marketshare of mobile user equipment with open

operating systems steadily shooting up, expectations are high. The openness here

offers clear benefits to customers, device manufacturers, software developers

and operators as it acts as a catalyst for the development of rich and

compelling applications. However, these also pose challenges and risks which

ultimately leads to the birth of more malicious applications which are  likely

to increase in number and complexity. Therefore, mobile application security is

a key issue for the mobile industry.

It is provided in some form on most open  mobile device OSes. Industry groups

have also created recommendations including the GSM Association and Open Mobile

Terminal Platform (OMTP) for this. There are over 4 billion devices in use

worldwide. Moreover, mobile phones have become a proximity devices for the user,

something which is always there on hand and convenient in use. This convenience

has resulted in an explosion of mobile applications such as mobile banking,

gaming, etc. All these applications require security, and as a result, mobile

application security is gaining in importance.

Best practices in mobile security



The processes to be followed while designing security applications for

mobiles, depend on organization concerned. Some use symmetric encryption like

AES and 3DES, which are basically the same standards for mobile application

security as for hardware based authentication devices. Some best practices which

can be followed while designing mobile security applications are leveraging SSL,

following secure programming practices, validating inputs, leveraging the

Permissions Model used by the operating systems, using the Least Privilege Model

for System Access, signing the application's code using encryptions, using

Secure Mobile URLs and encouraging a safe browsing environment.

Key challenges to security



A key challenge faced by the mobile application architects is to proactively

protect mobile users from fraud and malicious applications. Another huge task is

to ensure quality and accountability of mobile applications. Maintaining trust

in mobile platforms (and avoiding similar problems in the Internet world), and

securing the existing and future businesses of various enterprises is another

huge job. Even operators must be protected from various costs originating from

malicious applications. Other than all these facilitating certification

processes to reduce barriers for developers and ensure consistency across

different OS platforms and operators will perhaps be one of the major challenges

always.

It has been noted that security threats are platform dependent. As some

platforms are more vulnerable than the other, it is advisable that all

applications on mobile devices are certified or signed to avoid decompilation.

Hence it is extremely important to understand the robust architecture of mobiles

and their security platforms.

Some of the major threats faced include:

1. Communication Services: Malicious users may misuse/manipulate/redirect
   
   communication services like prepaid/postpaid charging which will directly
   
   cause financial loss.
2. Eavesdropping: They may use eavesdropping techniques to intercept mobile
   
   communication services with electronic devices.
3. Data Privacy Loss: They may use weak encrypted data of mobile applications
   
   and communication services for data stealing.
4. Authentication: They may gain unauthorized access to mobile
   
   phone/applications/services due to weak authentication implementation.

Mobile security pillars



A single application can be hacked without compromising other applications

or the system itself. For this, symmetric encryption is extremely useful,

considering it does not use a single point of entry. It should also be kept in

mind that federation is practical but it has its limitations when it comes to

security. The pillars for mobile application security are:

1. App Store Security Assessment

2. Mobile Device Application Security Assessment

3. Server component Security Assessment

4. SIM Card Application Security Assessment.

These points should always be kept in mind while

architecting applications as these are places where data compromise happens

because of security breaches.

Mobile applications generally communicate with servers

through SMSes, GPRS signals, etc. Hence to perform mobile application security

testing the essential elements are MIDP and Money Manager Application.

It has been observed that SIM cards which have DSTK and

USSD, play a major role in communication services because it generally allows

the integrator to have a secure communications channel.

Creating the test environment



Mobile application security testing can be broadly categorized under two

sections: mobile application security testing; and mobile SIM card application

security testing. Mobile applications generally communicate with the servers

through SMSs, GPRSs. Hence to perform mobile application security testing the

essential elements are Mobile Information Device Profile (MIDP) and Money

Manager Application. MIDP is a set of Java APIs and a generic J2ME emulator and

while the later is a money manager sample application written in J2ME and can be

installed on MIDP emulator. But the limitation of MIDP is that it does not

support SMS communication to server, hence SMS traffic interception is just not

possible.

Possible security tests which can be conducted are

authentication tests, tests of input validation, session management, encryption

ones and finally SQL injection tests. It is also essential to create an

environment to conduct tests. For mobile SIM card application tests, essentials

are SIM card reader/writer, and SIM card communications software.