Storage of sensitive data in a Java enabled cell p

100 %
0 %
Information about Storage of sensitive data in a Java enabled cell p
Education

Published on January 31, 2008

Author: Carmela

Source: authorstream.com

Storage of sensitive data in a Java enabled cell phone:  Storage of sensitive data in a Java enabled cell phone MSc Thesis Tommy Egeberg June 2006 Agenda:  Agenda Introduction Problem Methods Results Conclusion Further Work Introduction :  Introduction Cell phones → small computers Stores a lot of sensitive information RMS, email, SMS, calendar … Able to run Java applications Mobile SSO solution Store passwords -Introduction Main problem :  Main problem Will a Java MIDlet on a cellular phone be a secure location to store sensitive information? -Problem Research Questions :  Research Questions What is already known about security in Java enabled cell phones? Will information stored on a cellular phone be easy to extract? How can we secure the stored sensitive information even if the cellular phone is lost or stolen? What kind of threats will the cell phone be vulnerable to? What kind of countermeasures can be used to reduce or eliminate the threats? -Problem Methods :  Methods Literature study J2ME specifications Communication link; cell phone ↔ server Prototype Try to break into the prototype Security analysis Identify threats and vulnerabilities -Methods Digital safe :  Digital safe Master password PIN Pass-faces Stored as a SHA1 hash digest The sensitive information AES encrypted with a 128 bit key Key derived from master password, username and a iteration count of 20, like described in PKCS5v2 [1] -Methods Remote deletion :  Remote deletion SMS sent to the phone with the digital safe installed Defined port number The AMS starts the digital safe SHA1 value of password Deletes the stored information -Methods Stealing MIDlet :  Stealing MIDlet Upgrade a previously installed MIDlet The RMS will not be erased Read the stored information Identical values in the JAD file Can be used to inject Trojan code -Methods Results :  Results Encryption and decryption Bouncy Castle Crypto API [2] AES, SHA1, … Remote deletion is a poor functionality Can easily be deactivated Data stored in the RMS can easily be extracted -Results Data extraction:  Data extraction Forensic methods [3] Desoldering techniques, boundary-scan (JTAG) Native applications Windows Mobile, Symbian OS Stealing MIDlet Phone Managers Backup of MIDlet’s RMS -Results Stealing MIDlet:  Stealing MIDlet Overwrite the installed MIDlet MIDlet-Name and MIDlet-Vendor Source code Add Trojan code A signed MIDlet can not be upgraded with an unsigned MIDlet! -Results Phone Managers:  Phone Managers Oxygen Phone Manager II [4] Backup Java MIDlets Backup MIDlet's RMS MOBILedit! [5] Forensic edition available -Results RMS backup :  RMS backup -Results Slide15:  -Results Threats & Vulnerabilities :  Threats & Vulnerabilities Information extracted Trojan code Keyboard sniffer, send information to hacker, … Phone is stolen Brute-force attacks Remote deletion disabled MIDlet installation request -Results Countermeasures :  Countermeasures Reflash cell phone OS Check MIDlet size and functionality Sign the MIDlet Prevent Stealing MIDlets Strong master password and encryption Frequently update the login credentials -Results Conclusion :  Conclusion A strong master password must be chosen The key in the encryption process, access to the application Data easily extracted Encryption extremely important The MIDlet should be signed Prevent installation of Stealing MIDlets, trusted source -Conclusion Further Work:  Further Work SATSA (The Security and Trust Service API) Biometric authentication Speech recognition (Java Speech API) Proactive password checking Synchronization service Update the stored login credentials if the phone is lost -Further work References :  References [1] RSA-Laboratories. March 1999. Pkcs5v2.0: Password-based cryptography standard. [2] Bouncy Castle. Bouncy Castle Crypto Package. Light-weight API, release 1.33. [3] Willassen, S. Y. Spring 2003. Forensics and the GSM mobile telephone system. International Journal of Digital Evidence, 2, 10–11. [4] Oxygen-Software. Oxygen phone manager for Nokia phones (forensic edition) http://www.opm-2.com [5] Compelson laboratories. MOBILedit! Forensic http://www.mobiledit.com

Add a comment

Related presentations

Related pages

Storage of sensitive data in a Java enabled cell phone

Storage of sensitive data in a Java enabled cell phone Sammendrag (Abstract in Norwegian) Dagens personer må ofte gå rundt å huske mange forskjellige ...
Read more

Storage of sensitive data in a Java enabled cell phone

Storage of sensitive data in a Java enabled cell phone ... Storage of sensitive data in a Java enabled cell phone ... p. 155]. You will therefore ...
Read more

Storage of sensitive data in a Java enabled cell phone

Storage of sensitive data in a Java enabled cell ... Storage of sensitive data in a Java enabled cell ... a Java enabled network file storage ...
Read more

Storage of sensitive data in a Java enabled cell phone ...

New Trends in Mobile Computing: Medical Applications and... Cooper, 1973; first cell phone (Take is too costly and very sensitive, Manual data Handset ...
Read more

Storage of sensitive data in a Java enabled cell phone (0)

... Storage of sensitive data in a Java enabled cell phone. Documents; Authors; Tables; ... encrypted data storage and recovery mechanisms on mobile devices.
Read more

Storage of sensitive data in a Java enabled cell phone ...

MSc Thesis Tommy Egeberg June 2006 Agenda • Introduction • Problem • Methods • Results • Conclusion • Further Work Introduction ...
Read more

Storage of sensitive data in a Java enabled cell phone

Storage of sensitive data in a Java enabled cell phone ... Storage of sensitive data in a Java enabled cell phone MSc Thesis Tommy Egeberg June 2006 ...
Read more

Storage of sensitive data in a Java enabled cell phone(1 ...

Storage of sensitive data in a Java enabled cell phoneTommy EgebergMaster’s ThesisMaster of Science in Information Security30 ECTSDepartment of Computer ...
Read more

Storage of sensitive data in a Java enabled cell phone ...

Storage of sensitive data in a Java enabled cell ... Storage of sensitive data in a Java enabled ... p? en mobiltelefon med st?tte for Java ...
Read more