Mobile devices have evolved to become more efficient and perform computerized capabilities and thus achieve more adoption in the public by the consumers from individual persons, organizations and the governments and as such have become necessary companions for these consumers at work or at home to perform tasks, entertain and socialize. Major improvements have been made in the field relating to the hardware and software compatibilities. These improvements have also enabled accomplishment of more advanced tasks using the mobile devices. As an advantage, the improvements have also made the mobile devices more attractive to attackers, Becher (2011).
Mobile devices run on different operating system platforms. Examples include Windows, produced by Microsoft, Google’s Android and Iphone’s iOS. Android is the most used and widely accepted operating system with thousands of companies use the platform to produce and run their mobile devices such as smartphones, smart televisions, portable routers and other physical entities connected to the Internet of Things. Android is an open source project meaning that different users of the platform can edit and use it to suit their business or personal needs and objectives in performing different functions and delivery of services. The open source model has led to it being a prime target to attacks by malicious individuals using mobile applications or network access using command execution to access and harvest the user’s private data.
All the consumers of mobile devices are apprehensive about their data security, accuracy and integrity. This provides a need to the producers of the mobile devices to increase and improve the security features of the devices to meet the security needs of the users. These obligations include data security, reduce data loss and leaks and prevent unauthorized access by third party applications or individuals such as malware and spyware. Stricter levels of security and protection should therefore be implemented more than what the producers of the mobile devices are able to provide.
The ever increasing mobile technology to increase user productivity and efficiency puts a need on the producers of mobile devices to properly secure their products. As an example, user store private and confidential data on the hand held devices such as smartphones not limited to bank account details and passwords that in malicious hands can be devastating. The benefits of the mobile devices are numerous and worth however have been thwarted by security risks leading to fraud, loss of privacy and data losses.
The scope of the mobile device security investigation.
Digital investigation of the mobile system security vulnerabilities includes the scientific techniques and practices used in the determining the functionalities of the device and the security loopholes left behind. The world has shifted from the internet and world wide web to a mobile society where almost all tasks are accomplished using the mobile devices such as smartphones. These mobile devices are used to access information from the internet that was done by the computers in the older days. Most mobile devices consumers use the gadgets in their day to day activities and therefore the devices receive, generate and store more and more of the users’ private data. With the need to protect their data, mobile device security becomes a human need and primary enforcer and not a human want nor secondary enforcer, Ghosh & Swaminatha (2011). This paper reviews to determine the overview of mobile device security including the application layer, data link layers and storage services of the applications installed and running on the devices. The research further focuses on the attack made using third party applications such as web browsers and the mobile application user as an attack enabler. The paper intends to show the main aspects of the security of mobile devices that exposes the users to the risks involved.
The ebb and flow examine proposes, utilizing a benchmarking and exploitative tools technique to enable the planning of a measurable, presentable and applicable examination to cell phones with Android working framework; in view of the chain of care rules, consistence stages, and stages and to identify discoveries, dissentions, find vulnerabilities. In light of this procedure, we can decide the starting point of the main sources of various kinds of occasions or targets directed towards a cell phone as a mobile device. Also, utilizing a choice lattice, the best programming for playing out the scientific examination is picked and utilizing Balanced Scorecard, markers are assessed.
The research focused on the different mobile threats prevalently are categorized into three:
The threats originating from the installation and use of mobile applications which include adware, malware and spyware.
Threats arising from the connection of the mobile device to the internet on different networks such as data loss, unauthorized access, data leaks and “man-in-the-middle” eavesdrop.
Physical vulnerabilities of using small, portable handheld devices such as getting lost, water and dust destruction and theft.
This paper focuses on the mobile security that is specific to the mobile devices and not how the normal security of other computer systems can be implemented to the field and offer protection to the user data.
In the paper by Shon & Choi (2017, September). “Mobile Phone Usage Patterns, Security Concerns, and Security Practices of Digital Generation” by Sonya Zhang and Saree Costa, the authors determined the patterns of use of the mobile devices by the students. The randomly selected 262 students, were also interviewed about their mobile device practices and security concerns. The study concluded that mostly the students used their devices for entertainment and productivity purposes. The authors determined that most mobile device consumers are aware of the security threats involved with using the devices from the physical risks of theft to online and application threats. The participants ranked data privacy as the primary threat they were worried of. In so doing, the participants regularly updated the software component of their mobile devices and used passwords and pin codes to secure the devices. However, the paper does not fully explain the vulnerabilities in the mobile devices even with or without updates and thus formed the basis for this research.
La Polla et al (2013), in their article titled “Mobile device security: Understanding vulnerabilities and managing risks”, determine and compare the security configurations in blackberry OS and iPhone OS. The authors use the devices running on blackberry OS and iPhone OS with and without the security configuration, testing mobile applications installed on the devices and determining the security vulnerabilities against the features implemented in the security configuration. The article concludes that Blackberry offers a more secure operating system and mobile application platform than both iPhone and Android operating systems. The article however, does not provide the specific security vulnerabilities in the application, data link and storage layers of the mobile devices.
In the text “Smart bombs: Mobile Vulnerability and Exploitation”, by John Sawyer, Tom Eston and Kevin Johnson, they conclude that even though mobile devices are more common, most consumers use the devices without knowledge of the security. From the tests and exploitation, the authors determine that the developers use the same codes to build applications and therefore repeat the same mistakes and vulnerabilities in the developed systems. The authors suggest a need to improve the security of the mobile devices to secure the user data.
A mobile device is defined as a physical entity, portable, that is controlled by a simcard connected to a registered operator. The definition covers entities that are not covered in the case study but are also affected by the same security vulnerability. Such devices include Point of Sale systems and smart watches. This paper focuses on smart phones, which are handheld devices running on a firmware that allows installation and running of custom applications to deliver the different needs of the consumer. These mobile devices, offer a lot of productive functionality to the users and consumers not restricted to messaging, web browsing, e-mailing and entertainment. In more recent times, smart phones are equipped with the ability to also perform online transactions such as purchase and payments, Al-Muhtadi et al (2012).
In this case study, analysis was focussed on mobile device running on Qualcomm and mediate processors. The identified devices were running on the latest version of android, Android Oreo and had received the latest security past in not more than a month.
The case study smart phones are handheld devices with a capacitive touch screen to allow user interaction. The device runs on an operating system, android 8. The case study smart phones have an integrated data card for wireless connection to Bluetooth, Wi-Fi and cellular networks.
The static analysis reveals that the devices are equipped with a 2 gigabyte capacity of dynamic random access memory. The devices are packed with 16 gigabytes of internal memory that can be expanded to 64 gigabytes of standard memory cards. Using command executions from a Linux computer, the android system is debugged and displays the information of the operating system that include the ability of the RAM to buffer to increase the performance of the device. These dump files in the buffer can be collected by third party application and hence are a potential for research in this paper. The program HelixPro was used to identify the vulnerabilities in the file system and manual execution and data acquisition was used to observe the data that would be considered private to the device user.
The functional aspect of a smart phone is very dynamic and cannot be defined by a single handset. With the increasing need for portable mini computers being the primary driving force in the development of the mobile devices, more of this entities are shipped prepacked with file systems with the same capabilities to computers. Live analysis of the storage system of the NAND memory with is a FAT file system was analysed using the hex editor to extract data from memory file. The analysis revealed that android operating system uses the SQLite database to store information in the memory that deleted files are only marked as deleted and allows overwriting. File system analysis was important in understanding the structure of the files, data on the files in form of temporary files and cache, browser history, application statistics and app data including user profiles and passwords.
The android platform, although more developed, was vulnerable to brute force data acquisition to access the data available on the device flash memory. The data included all the deleted files and temporary application data.
Mobile devices have become part and parcel of out today lives, thanks to technology. These devices run on operating systems such as android, windows or IOS with hardware compatibility giving them the ability to connect to each other and to the internet for functions and services such as data sharing, web browsing, email services, social media, entertainment and google maps. The scope of mobile phone security threats covers hardware and software related factors such as storage systems, network access and encryption. Several mobile devices were taken as case studies for this research. The devices were analysed and tested for both their security features and vulnerabilities for unauthorized access. We find that these mobile devices have a lot of security vulnerabilities relating to data privacy, data leaks, unauthorized access and malware.
Live analysis of the mobile device connection to the internet revealed the use of computer protocols to access through the wireless application protocol. This protocol includes the HTTPS and the TLS protocols. The connection process is through three steps, the client, which is the consumer’s mobile device seeks a connection to the server, the server authenticates the connection using the client’s IP address and the connection is confirmed when the authentication certificates are confirmed. Just like any other computer connection, this was vulnerable to exploitation from 3rd party applications and malicious unauthorized access.
In order to check the smart vulnerabilities, static analysis and live analysis were conducted on the devices using data exploitation tools in the market used by ethical hackers to evaluate the security levels of the mobile devices. Primarily in static analysis, the storage repositories of the smart phones were exploited to find and access the data on the image file of the operating system in the NAND memory.
In the live analysis, the Core Impact exploitation tool was used to perform a series of exploitation to identify the vulnerable aspects of the android operating system. The operating system, Android 8, was tested using the exploitation tools and the findings recorded.
The system specifications for the case study mobile devices was:
Processors: Qualcomm, 2.1 GHz quad core.
Mediatek 1.9 GHz quad core.
Random access memory. DRAM 2GB
DRAM 2 GB.
Android operating system. Android Oreo.
The exploitation of the case study smart phones for mobile device vulnerabilities indicated both static and live potential to allow malicious, unauthorized access to the consumers’ data. The way the mobile devices have been set up and developed in terms of the physical hardware and software specifications offers a high level of security and intrusion detection. However, the security level is not up to par with the developed exploitation tools and techniques used by the attackers.
The problems arising from the research concerning the security vulnerabilities are categorized into static and live for ease of understanding and mitigation. The vulnerabilities are thus a subset of the possible attack points for data loss, data access and modification.
The volatility of data collected in the static analysis of the mobile devices used the memory dump and the NAND memory to check for the system files, temporary files, cache and application data.
Android devices use the SQLite database model to store data. The database selects the directory to where the temporary data of an application is to be saved. The database has a security vulnerability that allows the data be stored in the application parent folder and therefore expose the data to access by unauthorized individuals or 3rd party applications such as malware, spyware or remote commands from connected computers. Application temporary files in theory contain the data that should not be shared such as user profiles and passwords, pin codes and encryption keys.
Android devices uses the FAT file system to store data on the memory slots. The model and architecture for data storage is vulnerable to data recovery since the data, before being overwritten, is only marked as deleted when a delete command is used. This security vulnerability exposes the user data such as private images, videos, contacts, dex and xml files to unintentional or intentional unauthorized access by third party apps and individuals.
The android operating system is an open source project. Even though attempts have been made by the producers of the mobile devices to lock the bootloaders and protect the NAND memory and flash files, vulnerabilities in the code allows for 3rd party programs and commands to unlock the bootloaders and acquire super user access to the system image file. This process, known as rooting in android and jailbreaking in iPhone devices, allows unauthorized access and installation of third party firmware or applications that can collect user sensitive data.
According to Mulliner (2009, March), The android architecture is built on the ability to allow permission to the 3rd party applications and commands trying to execute commands to access resources. This permission-based architecture is vulnerable to security threats due to erratic permission control mechanisms.
The user as an attack and security vulnerability.
The average user of mobile devices is not able to compliment the permission-based architecture of the android operating system. Android developers have made every possible attempt to simplify for the user the security interface of the operating system, however, the simplified security solutions could not be utilized well by the average users. This exposed their data to 3rd party applications and unauthorized access due to permissions being granted to applications more than what was intended to due to the inability to understand the risks involved. Android applications request user permissions to access data such as those not limited to information contained in the internal and external memories, contacts, call logs and messages.
Typical examples of user authenticated bad file permissions include setting wrong 3rd party application permissions to allow the apps to read and write on the storage directories containing sensitive data. The standard user has little knowledge on data encryption techniques while saving important data on their device’s SD card either in the internal or the external memory. Additionally, the average user, who make the large percent of mobile device users, do not know the best practices in sensitive client data storage mechanisms. In such circumstances, the user stores their private data such as emails, addresses, account numbers, identification pin codes, registration numbers and passwords within data files that are not encrypted and are easy to retrieve such as app manifests, XML files, log files and SQLite databases.
Poor quality and inefficient data encryption tools.
Developers use the same codes to set up, design and develop android operating systems and 3rd party applications. These codes use the same old and outdated cryptographic tools to encrypt user data. This is an old trick to give the user a confidence level about their data privacy and protection mechanism. However, a bad data encryption method is equal to not encrypting at all. Running exploitation tools, security vulnerabilities in the data encryption methods applied in the android operating system and 3rd party application renders the encryption easy to crack by the attackers and are only meant to give the user a false sense of data encryption and society.
For years, mobile devices use the hardware identifies such as IMEI numbers and MAC addresses to authenticate the user during connections. On the hardware layer of the mobile device, these authentication values cannot be modified or edited. However, a vulnerability in the authentication process allow the values to be modified on the software level. The control of the mobile device identifiers on the software level exposes the user to threats such as unauthorized data access and eavesdropping by the man-in-the-middle in established communications. Android is the most used and widely accepted operating system with thousands of companies use the platform to produce and run their mobile devices such as smartphones, smart televisions, portable routers and other physical entities connected to the Internet of Things. Android is an open source project meaning that different users of the platform can edit and use it to suit their business or personal needs and objectives in performing different functions and delivery of services.
Vulnerability in the implicit intent in the Android’s Inter Process Communication.
Mobile devices running on android platform acquire stability and smooth functionality due to application of the internal communication mechanisms that operate on the ability of the applications to send intents to each other in form of explicit and implicit intents. Intents are used by the applications to execute commands in to other apps to provide services such as data. A vulnerability in the implicit intent allow any app to initiate a process or service in another app without specifying the apps allowed to send such intents. Intents can therefore be send by a malicious third party app and initiate a process such as data collection, device control and trigger commands such as denial of service and compromise user privacy.
The transport layer security protocol and the HTTPS protocols are used in the mobile device web browsing and application that require wireless or wired connection to the server. These security protocols provide encryption to the transport layer during communication to prevent man-in-the-middle attacks. In the development of the transport layer protocols, compression was allowed during encryption to reduce bandwidth, reduce data loss and improve security. This new development enabled attacker exploit a vulnerability in the compression protocol in Compression Ratio Info-leak Made Easy attacks in TSL protocols and Browser Reconnaissance and Exfiltration via Adaptive Compression of Hypertext attacks on HTTP connections. CRIME and BREACH attacks on the transport layer utilize on the security vulnerability in the security protocol to inject characters derived from the cookies generated by the server and thus perform man-in-the-middle attacks.
The graphical representation of the android architecture in 2D is as follows. This is totally same to all architectures.
Due to the continuous innovation in the mobile technology, organizations and individuals using such technologies need to continue evaluate the security features and implications of such technological innovations. Multi-perspective security vulnerability assessment ned to be carried out to identify the threat exposures in the systems. Researchers should focus on development of exploitation tools specifically meant to detect mobile device security vulnerabilities. Jakobsson & Pointcheval (2015, February)..
All the consumers of mobile devices are apprehensive about their data security, accuracy and integrity. This provides a need to the producers of the mobile devices to increase and improve the security features of the devices to meet the security needs of the users. These obligations include data security, reduce data loss and leaks and prevent unauthorized access by third party applications or individuals such as malware and spyware. Stricter levels of security and protection should therefore be implemented more than what the producers of the mobile devices are able to provide.
Conclusion.
This report determined 9 latest Android Oreo related vulnerabilities. The vulnerabilities are analysed and categorized into static analysis threats that arise from the android source code and the live analysis that are threats exposed due to the functionality of the android software components including 3rd party applications such as web browsers, mobile banking applications and e-mailing services.
The results and findings reveal that most of the vulnerabilities relate to the functionality of the android operating system. The vulnerabilities include bad cryptographic techniques, not 100% secure transport layer protocol, user defined attack exposure and android’s open source operating system. The results determined that 3rd party applications and custom firmware are the most affected by software and source code vulnerability issues.
Finally, the report concludes that mobile device security vulnerabilities are contained in the core source code. The categories of the vulnerabilities showed in this paper can be used as a reference for future design and software developments.
References.
Becher, M., Freiling, F. C., Hoffmann, J., Holz, T., Uellenbeck, S., & Wolf, C. (2011, May). Mobile security catching up? revealing the nuts and bolts of the security of mobile devices. In Security and Privacy (SP), 2011 IEEE Symposium on (pp. 96-111). IEEE.
Shon, T., & Choi, W. (2017, September). An analysis of mobile WiMAX security: vulnerabilities and solutions. In International Conference on Network-Based Information Systems (pp. 88-97). Springer, Berlin, Heidelberg.
La Polla, M., Martinelli, F., & Sgandurra, D. (2013). A survey on security for mobile devices. IEEE communications surveys & tutorials, 15(1), 446-471.
Ghosh, A. K., & Swaminatha, T. M. (2011). Software security and privacy risks in mobile e-commerce. Communications of the ACM, 44(2), 51-57.
Al-Muhtadi, J., Mickunas, D., & Campbell, R. (2012). A lightweight reconfigurable security mechanism for 3G/4G mobile devices. IEEE Wireless Communications, 9(2), 60-65.
Mulliner, C. (2009, March). Vulnerability analysis and attacks on NFC-enabled mobile phones. In Availability, Reliability and Security, 2009. ARES’09. International Conference on (pp. 695-700). IEEE.
Jakobsson, M., & Pointcheval, D. (2015, February). Mutual authentication for low-power mobile devices. In International Conference on Financial Cryptography (pp. 178-195). Springer, Berlin, Heidelberg.
Essay Writing Service Features
Our Experience
No matter how complex your assignment is, we can find the right professional for your specific task. Contact Essay is an essay writing company that hires only the smartest minds to help you with your projects. Our expertise allows us to provide students with high-quality academic writing, editing & proofreading services.
Free Features
Free revision policy
$10Free bibliography & reference
$8Free title page
$8Free formatting
$8How Our Essay Writing Service Works
First, you will need to complete an order form. It's not difficult but, in case there is anything you find not to be clear, you may always call us so that we can guide you through it. On the order form, you will need to include some basic information concerning your order: subject, topic, number of pages, etc. We also encourage our clients to upload any relevant information or sources that will help.
Complete the order form
Once we have all the information and instructions that we need, we select the most suitable writer for your assignment. While everything seems to be clear, the writer, who has complete knowledge of the subject, may need clarification from you. It is at that point that you would receive a call or email from us.
Writer’s assignment
As soon as the writer has finished, it will be delivered both to the website and to your email address so that you will not miss it. If your deadline is close at hand, we will place a call to you to make sure that you receive the paper on time.
Completing the order and download