DOCSLIB.ORG

Open Ongtang-Phd-Dissertation.Pdf

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
Open Ongtang-Phd-Dissertation.Pdf The Pennsylvania State University The Graduate School SECURING MOBILE PHONES IN THE EVOLVING MOBILE ECOSYSTEM A Dissertation in Computer Science and Engineering by Machigar Ongtang © 2010 Machigar Ongtang Submitted in Partial Fulfillment of the Requirements for the Degree of Doctor of Philosophy August 2010 The dissertation of Machigar Ongtang was reviewed and approved∗ by the following: Patrick D. McDaniel Associate Professor of Computer Science and Engineering Dissertation Advisor, Chair of Committee Thomas F. La Porta Distinguished Professor of Computer Science and Engineering Trent Jaeger Associate Professor of Computer Science and Engineering Ling Rothrock Associate Professor of Industrial and Manufacturing Engineering Raj Acharya Professor of Computer Science and Engineering Department Head ∗Signatures are on file in the Graduate School. Abstract The revolution of mobile phone industry has been altering our life and business practices over the past few decades. Driven by user demands and technological advancement, we now experience rich mobile phone applications and sophisticated cellular services ranging from mobile payment, stock trading, to social networking, vehicle tracking to in-car control. As more players joining the community, this mobile phone environment has transformed into a complex network of interacting companies, known as mobile ecosystem. Unfortunately, this opening and converging mobile ecosystem has brought in more opportunities for more attacks on mobile phones, a key element of the system. This dissertation aims to achieve mobile phone security. We reveal two main chal- lenges that we need to overcome, namely developing a clear definition of secure phones, and building security infrastructure that imposes such definition on the phones. We also identify three key elements that contribute to the fidelity of mobile phones, namely, mobile phone platforms, mobile phone applications, and mobile content. Throughout this dissertation, we explore the application of security requirements engineering disci- pline in developing security policies that frame security phones from the perspectives of the above three elements. Accordingly, we develop appropriate security infrastructure on the Android platform to enforce such security policies. Through security analysis and performance evaluation, we demonstrate the effectiveness and the efficiency of our approach, and suggest possible further improvement. iii Table of Contents List of Figures viii List of Tables x Acknowledgments xi Chapter 1 Introduction 1 1.1 Thesis Statement . 5 1.2 Contributions . 7 1.3 Dissertation Outline . 8 Chapter 2 Preliminaries and Related Work 10 2.1 Mobile Ecosystem and its Evolution . 11 2.1.1 Evolution of the Mobile Ecosystem . 11 2.1.2 An Outlook for Mobile Phone Security . 13 2.2 Android Operating System . 15 2.2.1 Android Architecture . 16 2.2.2 Android Application Model . 16 2.2.3 Android Security Model . 18 2.2.4 Limitations of Android . 20 2.3 Basic Mobile Phone Operations . 21 2.3.1 Short Messaging Service (SMS) . 22 2.3.2 Multimedia Messaging Service (MMS) . 22 2.3.3 Internet Connection . 24 2.4 Attacks on Mobile Phones . 24 2.4.1 Cellular Network Vulnerabilities . 25 2.4.2 Mobile Phone Vulnerabilities . 25 iv 2.5 Attack Mitigations . 27 2.6 Security Requirements Engineering (SRE) . 30 2.7 Policy Systems . 33 2.7.1 Classic Policy Models . 34 2.7.2 Decentralized Policy . 35 2.7.3 Policy Reconciliation . 38 2.7.4 Automated Policy Generation . 38 2.8 Summary . 39 Chapter 3 Securing Mobile Phone Platform Against Malware 40 3.1 Understanding Malware Situation . 42 3.1.1 Categories of Malware . 42 3.1.2 Malware Mitigations and Limitations . 44 3.2 Certifying Application at Install Time . 45 3.2.1 Application Installation in Android . 45 3.2.2 Application Certification with Kirin . 47 3.2.3 Implementation of Kirin . 49 3.3 Developing Platform Security Policy . 49 3.3.1 Security Requirements Engineering for Mobile Phones . 50 3.3.2 Platform Security Policy Development Methodology . 50 3.3.3 Sample Platform Security Policies . 53 3.3.4 Kirin Security Language . 58 3.4 Evaluating Platform Protection Against Malware . 60 3.4.1 Empirical Results . 60 3.4.2 Mitigating Malware . 63 3.4.3 Discovered Vulnerabilities . 63 3.5 Summary . 65 Chapter 4 Securing Mobile Phone Applications in Open and Converging Model 66 4.1 Evolving Application Model . 67 4.2 Protecting Applications' Interactions . 69 4.2.1 Motivating Example . 69 4.2.2 Designing Saint Framework . 71 4.2.2.1 Install-time Application Policy Support . 71 4.2.2.2 Runtime Application Policy Support . 72 4.3 Developing Application Security Policy . 73 4.3.1 Application Security Policy Development Methodology . 74 4.3.2 Sample Application Security Policy . 77 4.3.3 Application Security Policy Taxonomy . 79 4.3.3.1 Install-time Permission Granting Policy . 80 4.3.3.2 Run-time Interaction Policy . 80 v 4.4 Auxiliary Policies . 83 4.4.1 Administrative Policy . 83 4.4.2 Operational Policy . 84 4.5 Implementing Saint Framework . 85 4.5.1 Saint Installer . 85 4.5.2 Saint Mediator . 86 4.5.3 AppPolicy Provider . 89 4.5.4 FrameworkPolicyManager . 90 4.5.5 Condition Extensibility . 90 4.6 Evaluating Applications Protection . 90 4.6.1 Policy Appropriateness . 91 4.6.2 Performance Evaluation . 95 4.6.2.1 Macrobenchmarks . 96 4.6.2.2 Microbenchmarks . 97 4.7 Summary . 97 Chapter 5 Secure Handling of Mobile Content 100 5.1 Recognizing Risks to Content and Need for DRM . 102 5.1.1 Understanding Content Usage Through Applications Survey . 104 5.1.2 DRM Policy Requirements . 106 5.2 Understanding Content Delivery . 106 5.2.1 Documents in Transit . 107 5.2.2 On-Platform Document Access . 108 5.3 Threat and Trust Model . 110 5.4 Securing Mobile Content with Porscha . 111 5.4.1 Supported Policy . 111 5.4.2 Document-in-Transit . 112 5.4.3 On-platform Document Security . 115 5.4.3.1 Policy Enforcement on Initial Recipients . 116 5.4.3.2 Policy Enforcement on Documents at Rest . 118 5.4.3.3 Enforcement on Indirect Receivers . 118 5.5 Developing Content Security Policy . 119 5.5.1 Content Policy Development Methodology . 119 5.5.2 Content Security Policy Rules . 122 5.5.3 Sample Content Security Policy . 122 5.6 Evaluating Porscha . 123 5.7 Discussion . 125 5.7.1 Protecting the Private Key . 125 5.7.2 Recipients Without Porscha . 126 5.7.3 Application and Platform Trust . 126 5.7.4 Alternative Application Enforcement Infrastructures . 127 vi 5.7.5 Digital Rights Management . 127 Chapter 6 Towards Secure Mobile Phone Environment 129 6.1 Security Policy Framework . 130 6.2 Retrofitting Security through Security Requirements Engineering . 131 6.3 Trust Model . 132 6.4 Future Work . 133 6.4.1 Confining Applications with AppJailing . 133 6.5 Cloud Computing Infrastructure for Securing Elastic Android Applications 136 6.6 On-Platform DRM for Application Usage Control . 138 6.7 Summary . 139 Bibliography 141 vii List of Figures 2.1 Mobile ecosystem consists of multiple interacting classes of participants 12 2.2 Android architecture consists of three layers: Linux kernel, Android mid- dleware, and applications. 17 2.3 Android's application manifest file contains the application's security con- figuration and the component structure. 17 2.4 Android middleware mediates access between components and enforces mandatory access control (MAC) policy. As application 1 possesses label l1, component A in application 1 can access component B protected by label l1. However, it cannot access component C assigned with label l2. 19 2.5 Simplified SMS network architecture . 22 2.6 MMS Client submits multimedia message to associated MMS Proxy Relay 24 2.7 MMS Client retrieves multimedia message after receiving the WAP Push notification . 24 3.1 Kirin based application installer performs application certification at in- stall time. 48 3.2 Steps for Developing Phone Platform Security Policy. 51 3.3 Problem diagram explains possible functions on user conversation . 54 3.4 Threat tree with the global goal to eavesdrop the user's microphone input during the conversation . 55 3.5 KSL syntax in BNF. 58 4.1 The PersonalShopper application finds desired items at the discretion of the user and interacts with vendors and payment applications to purchase them. 70 4.2 Saint enforcement - Saint enhances the application installation process (a- c) with additional permission granting policies and mediates component IPC (1-5) to enforce interaction policies specified by both the caller and callee applications. ..
Load more

Recommended publications
  • Automatic Sandboxing of Unsafe Software Components in High Level Languages
    Master Thesis Automatic Sandboxing of Unsafe Software Components in High Level Languages Benjamin Lamowski Technische Universität Dresden Fakultät Informatik Institut für Systemarchitektur Professur Betriebssysteme Betreuender Hochschullehrer: Prof. Dr. rer. nat. Hermann Härtig Betreuender Mitarbeiter: Dr. Carsten Weinhold 3. Mai 2017 Aufgabenstellung Neue “sichere“ Programmiersprachen wie Go, Swift oder Rust wurden nicht nur für die normale Anwendungsentwicklung entworfen, sondern sie zielen auch auf eine hochper- formante Ausführung und Programmierung vergleichsweise systemnaher Funktionalität ab. Eine attraktive Eigenschaft beispielsweise von Rust ist das gegenüber C und C++ deutlich strengere Speicherverwaltungsmodell, bei dem bereits zur Kompilierzeit der Lebenszyklus und die Erreichbarkeit von Objekten sowie die Zuständigkeit für deren Allokation und Deallokation wohldefiniert sind. Ganze Klassen von Programmfehlern wie etwa Buffer Overflows oder Dereferenzierung ungültige Zeiger werden dadurch eliminiert und die Programme mithin sicherer und robuster. Aus diversen Gründen müssen Programme, die in sicheren Sprachen geschriebenen wurden, aber oftmals auf “unsicheren“ Legacy-Code zurückgreifen. So bietet etwa Rust über das “unsafe“-Sprachelement die Möglichkeit, Funktionen innerhalb von Bibliotheken aufzurufen, die in fehleranfälligem C geschrieben sind. Leider werden die vom Com- piler durchgesetzten Garantien der sicheren Sprache hinfällig, sobald im Code einer C-Bibliothek ein Speicherfehler auftritt. Ein Schreibzugriff etwa durch
    [Show full text]
  • Google Android
    Google Android 2008/3/10 NemusTech, Inc. Lee Seung Min 네무스텍㈜ Agenda Introduction Mobile Platform Overview Background : Current Linux Mobile Platform What is Android? Features Architecture Technical Detail Android SDK Porting Android to Real Target Future of Android A conceptual model for mobile software Software Stack Kernel the core of the SW (HW drivers, memory, filesystem, and process management) Middleware The set of peripheral software libraries (messaging and communication engines, WAP renders, codecs, etc) Application Execution Environment An application manager and set APIs UI framework A set of graphic components and an interaction framework Application Suite The set of core handset application ( IDLE screen, dialer, menu screen, contacts, calendar, etc) Mobile Platforms Feature Phone Vendor Platform : Mocha, PDK, WAVE, WISE, KX, etc...... Carrier Platform : SKTelecom TPAK, NTT i-Mode (WAP), Java, WIPI, BREW, etc…… 3rd Party Solution : TAT Cascade, Qualcomm uiOne Smart Phone MicroSoft Windows Mobile Nokia : Symbian, Series 60 Apple, iPhone – OSX 10.5 Leopard Linux Customers & Licensees Not all customers or licensees are shown Source:vendor data Smartphone OS Market Share by Region Smartphone OS market share by region, 2006 Source : Canalys Current Linux Mobile Platforms LiMo Foundation https://www.limofoundation.org/sf/sfmain/do/home TrollTech Qtopia GreenPhone Acquired by Nokia OpenMoko : GNU/Linux based software development platform http://www.openmoko.org , http://www.openmoko.com Linux
    [Show full text]
  • A Microkernel API for Fine-Grained Decomposition
    A Microkernel API for Fine-Grained Decomposition Sebastian Reichelt Jan Stoess Frank Bellosa System Architecture Group, University of Karlsruhe, Germany freichelt,stoess,[email protected] ABSTRACT from the microkernel APIs in existence. The need, for in- Microkernel-based operating systems typically require spe- stance, to explicitly pass messages between servers, or the cial attention to issues that otherwise arise only in dis- need to set up threads and address spaces in every server for tributed systems. The resulting extra code degrades per- parallelism or protection require OS developers to adopt the formance and increases development effort, severely limiting mindset of a distributed-system programmer rather than to decomposition granularity. take advantage of their knowledge on traditional OS design. We present a new microkernel design that enables OS devel- Distributed-system paradigms, though well-understood and opers to decompose systems into very fine-grained servers. suited for physically (and, thus, coarsely) partitioned sys- We avoid the typical obstacles by defining servers as light- tems, present obstacles to the fine-grained decomposition weight, passive objects. We replace complex IPC mecha- required to exploit the benefits of microkernels: First, a nisms by a simple function-call approach, and our passive, lot of development effort must be spent into matching the module-like server model obviates the need to create threads OS structure to the architecture of the selected microkernel, in every server. Server code is compiled into small self- which also hinders porting existing code from monolithic sys- contained files, which can be loaded into the same address tems. Second, the more servers exist | a desired property space (for speed) or different address spaces (for safety).
    [Show full text]
  • A Practical UNIX Capability System
    A Practical UNIX Capability System Adam Langley <[email protected]> 22nd June 2005 ii Abstract This report seeks to document the development of a capability security system based on a Linux kernel and to follow through the implications of such a system. After defining terms, several other capability systems are discussed and found to be excellent, but to have too high a barrier to entry. This motivates the development of the above system. The capability system decomposes traditionally monolithic applications into a number of communicating actors, each of which is a separate process. Actors may only communicate using the capabilities given to them and so the impact of a vulnerability in a given actor can be reasoned about. This design pattern is demonstrated to be advantageous in terms of security, comprehensibility and mod- ularity and with an acceptable performance penality. From this, following through a few of the further avenues which present themselves is the two hours traffic of our stage. Acknowledgments I would like to thank my supervisor, Dr Kelly, for all the time he has put into cajoling and persuading me that the rest of the world might have a trick or two worth learning. Also, I’d like to thank Bryce Wilcox-O’Hearn for introducing me to capabilities many years ago. Contents 1 Introduction 1 2 Terms 3 2.1 POSIX ‘Capabilities’ . 3 2.2 Password Capabilities . 4 3 Motivations 7 3.1 Ambient Authority . 7 3.2 Confused Deputy . 8 3.3 Pervasive Testing . 8 3.4 Clear Auditing of Vulnerabilities . 9 3.5 Easy Configurability .
    [Show full text]
  • On the Construction of Reliable Device Drivers Leonid Ryzhyk
    On the Construction of Reliable Device Drivers Leonid Ryzhyk Ph.D. 2009 ii iii ‘I hereby declare that this submission is my own work and to the best of my knowledge it contains no materials previously pub- lished or written by another person, or substantial proportions of material which have been accepted for the award of any other degree or diploma at UNSW or any other educational institution, except where due acknowledgement is made in the thesis. Any contribution made to the research by others, with whom I have worked at UNSW or elsewhere, is explicitly acknowledged in the thesis. I also declare that the intellectual content of this the- sis is the product of my own work, except to the extent that as- sistance from others in the project’s design and conception or in style, presentation, and linguistic expression is acknowledged.’ Signed .................................. Date .................................. iv Abstract This dissertation is dedicated to the problem of device driver reliability. Software defects in device drivers constitute the biggest source of failure in operating systems, causing sig- nificant damage through downtime and data loss. Previous research on driver reliability has concentrated on detecting and mitigating defects in existing drivers using static analysis or runtime isolation. In contrast, this dissertation presents an approach to reducing the number of defects through an improved device driver architecture and development process. In analysing factors that contribute to driver complexity and induce errors, I show that a large proportion of errors are due to two key shortcomings in the device-driver architecture enforced by current operating systems: poorly-defined communication protocols between drivers and the operating system, which confuse developers and lead to protocol violations, and a multithreaded model of computation, which leads to numerous race conditions and deadlocks.
    [Show full text]
  • Table of Contents
    Journal of Mobile, Embedded and Distributed Systems, vol. I, no. 1, 2009 ISSN 2067 – 4074 Survey of Mobile Digital Rights Management Platforms Cristian TOMA, Catalin BOJA Faculty of Cybernetics, Statistics and Economic Informatics Department of IT&C Technologies Academy of Economic Studies Bucharest, Romania [email protected], [email protected] Abstract: Based on the development of new communication and data transfer technologies, the mobile solutions for the e-activities have been able to provide new ways to provide multimedia content. This environment describes methods and tools available here, which will bring information, speed and efficiency to any stage and component of the mobile business process. The paper takes into discussion the Digital Rights Management technology in mobile world. The paper presents the main aspects regarding the business and technological models used in mobile digital rights management technology. Key-Words: M-applications, digital rights management, mobile DRM models. 1. Mobile Projects Taking into consideration the advantages that the communication technologies bring into the mobile business process, the subscribers will have more information at their disposal. This will conduct to a reliable and secure communication, better results and in the end to high quality output. Despite the necessary high costs required to implement and to maintain a communication system at this level, in the end, the benefits and the lower levels of costs penalties due to a non efficient information and data transfer will highlight the importance of this resource. For instance, file sharing and file control software systems allow a much better data maintenance and permanent access to information than the printed or paper format.
    [Show full text]
  • DRM Specification Approved Version 2.1 – 06 Nov 2008
    DRM Specification Approved Version 2.1 – 06 Nov 2008 Open Mobile Alliance OMA-TS-DRM-DRM-V2_1-20081106-A 2008 Open Mobile Alliance Ltd. All Rights Reserved. Used with the permission of the Open Mobile Alliance Ltd. under the terms as stated in this document. [OMA-Template-DRM-20080101-I] OMA-TS-DRM-DRM-V2_1-20081106-A Page 2 (214) Use of this document is subject to all of the terms and conditions of the Use Agreement located at http://www.openmobilealliance.org/UseAgreement.html. Unless this document is clearly designated as an approved specification, this document is a work in process, is not an approved Open Mobile Alliance™ specification, and is subject to revision or removal without notice. You may use this document or any part of the document for internal or educational purposes only, provided you do not modify, edit or take out of context the information in this document in any manner. Information contained in this document may be used, at your sole risk, for any purposes. You may not use this document in any other manner without the prior written permission of the Open Mobile Alliance. The Open Mobile Alliance authorizes you to copy this document, provided that you retain all copyright and other proprietary notices contained in the original materials on any copies of the materials and that you comply strictly with these terms. This copyright permission does not constitute an endorsement of the products or services. The Open Mobile Alliance assumes no responsibility for errors or omissions in this document. Each Open Mobile Alliance member has agreed to use reasonable endeavors to inform the Open Mobile Alliance in a timely manner of Essential IPR as it becomes aware that the Essential IPR is related to the prepared or published specification.
    [Show full text]
  • Executive Summary
    Mobile Commerce Security: Legal & Technological Perspectives Michael Triguboff Table of Contents EXECUTIVE SUMMARY 4 INTRODUCTION 7 The Need for Security 11 PART I TECHNOLOGY 12 Client-Side Vulnerabilities 12 Browser Software 13 Java Applets 14 ActiveX controls 16 JavaScript 18 Plug-Ins and Graphic Files 18 Push technology 18 Web Server Security 19 Front-end 20 Firewalls 22 Back-end Database vulnerabilities 23 Server- Side Middleware 24 Operating System Problems 25 Hardened versions of Operating Systems 36 Distributed systems 37 Software Testing 38 Mobile Commerce Issues 43 Device Properties 43 Wireless Communication 45 Wireless Communication Protocols 47 Ad Hoc Networks 49 Ad Hoc Networks and Key Management 51 Network Protection in Ad Hoc Networks 54 Location Dependent Information and Mobile Computing 55 Mobile Agents 56 Protecting the Host from the Mobile Agent 59 Safe Code Interpretation 61 Digital Signatures 63 Proof Carrying Code 63 Path Histories 64 Software-Based Fault Isolation [“Sandboxing”] 64 Protecting the Agent From the Host and Other Agents 64 Secure Control of Remote Agents 65 Read-Only/Append-Only 65 Partial Results Encapsulation 66 Code Obfuscation 67 Computing with Encrypted Functions 67 Environmental Key Generation 68 Execution Tracing 68 Itinerary Recording 69 Security Through Shared Secrets and Interlocking 69 Other Approaches 69 Attacks Based on Device Limitations 71 2 Prevention, Detection and Reaction 71 Intrusion Detection 72 Intrusion Detection and Mobile Agents 75 Part I Conclusion 76 PART 11 THE LEGAL PERSPECTIVE 80 The Debate: A Confluence of Two Streams 81 Uniform Electronic Transactions Act 85 Article 2B of the Uniform Commercial Code 85 The Electronic Signatures in Global and National Commerce Act [“E-Sign Act”] 88 Jurisdiction Selection 90 Reaction- Criminal Law 96 Convention on Cyber-Crime 97 Evidentiary or Procedural Law 99 Practical Considerations 100 Part II Conclusion 101 APPENDIX 103 Digital Millennium Copyright Act 103 BIBLIOGRAPHY 107 3 EXECUTIVE SUMMARY The objectives of this project are twofold.
    [Show full text]
  • Cours Système Embarqué Et Système D'exploitation Mobile
    COURS SYSTÈME EMBARQUÉ ET SYSTÈME D’EXPLOITATION MOBILE Ikbel Daly Briki 2018/2019 SYSTÈME EMBARQUÉ Un système embarqué: c’est une combinaison de matériels et logiciels permettant de remplir une ou plusieurs fonctions spécifiques avec des contraintes plus ou moins sévères tel que la consommation, la température, la taille, les performances…[Patrice Kadionik, 2004] Un système embarqué est susceptible d’être utilisé dans un environnement matériel de faibles performances (si l’on compare au PC de bureau d’aujourd’hui). Si l’ajout de quelques Mo de mémoire sur un PC de bureau n’a pas une grosse influence sur le budget d’un utilisateur, le gain de quelques Mo sur un produit de grande consommation (téléphone, équipement auto mobile, organiseur personnel) a une énorme influence sur le coût final. [Pierre Ficheux, 2003] 2 SYSTÈME EMBARQUÉ Ébauche d’une définition: c’est un système électronique et informatique autonome qui est dédié à une tâche particulière et contenue dans un système englobant. Il n’est « généralement » pas programmable. Pas d’E/S standards Matériel et application intimement liés Logiciel enfoui … noyé dans le matériel … pas facilement discernable comme dans un PC. Il sont partout ; Radio/réveil Machine à café Télévision / télécommande Moyen de transport 3 Téléphone portable …. CARACTÉRISTIQUES D’UN SYSTÈME EMBARQUÉ Un système embarqué: des ressources limitées Système principalement numérique Le moins cher possible Une puissance de calcul limitée Pas de consommation d’énergie inutile Exécution de logiciel dédié
    [Show full text]
  • Boisvert-Storey-Sony Case Brief
    Storey C204 Summer 2014 Case Study BE MOVED SITUATION Sony Corporation is a 68-year old multinational based in Tokyo. In 2012, the tech giant employed 173,000 people, with corporate headquarters in Japan, Europe, and America. In May 2014, the company was down to 146,300, cutting 26,700 as part of CEO Kaz Hirai’s “One Sony” plan. Recently, the firm eVen sold former office buildings in Tokyo for $156 million (Inagaki). This followed a similar $1.2 billion sale in 2013. After seVeral years of losses, Sony’s situation appears critical. In the last fiscal year, the company lost $1.25 billion. EVen the gaming diVision, where the Playstation console family (PS2, PS3, PS4) is projected to sell 17 million units this year, lost $78 million (Quarterly Results). There are many causes: Sony’s jettisoning of its PC brand Vaio, the poor performance and planned spinoff of Sony’s teleVision diVision, PS4 launch and marketing costs, the struggling PSVita, R&D costs for Sony’s Project Morpheus, and the fluctuation of exchange rate markets. For the current year, Sony is projecting a $489 million loss. How sustainable is Sony’s current business model? Will the success of the PS4 lead to renewed profitability for the games diVision and the company as a whole? Perhaps opportunities in new markets can spark a turn-around. The company’s core businesses are electronic entertainment (Sony Computer Entertainment, Sony Music Entertainment, and Sony Pictures Entertainment) and hardware (Sony Mobile Communications and Sony Electronics). Though it also dabbles in financial serVices, publishing, and medical imaging, electronics represents roughly two-thirds of the corporation’s reVenue (Sony Annual Report 2011, 2013).
    [Show full text]
  • Symbian Phone Security
    Symbian phone Security Job de Haas ITSX Symbian phone Job de Haas BlackHat Security ITSX BV Amsterdam 2005 Overview • Symbian OS. • Security Risks and Features. • Taking it apart. • Conclusions. Symbian phone Job de Haas BlackHat Security ITSX BV Amsterdam 2005 Symbian History • Psion owner of EPOC OS, originally from 1989, released EPOC32 in 1996 • EPOC32 was designed with OO in C++ • 1998: Symbian Ltd. formed by Ericsson, Nokia, Motorola and Psion. • EPOC renamed to Symbian OS • Currently ~30 phones with Symbian and 15 licensees. Symbian phone Job de Haas BlackHat Security ITSX BV Amsterdam 2005 Symbian Organization • Symbian licenses the main OS • Two GUI’s on top of Symbian: – Series 60, led by Nokia – UIQ, subsidiary of Symbian • Ownership: – Nokia 47.5% Panasonic 10.5% – Ericsson 15.6% Siemens 8.4% – SonyEricsson 13.1% Samsung 4.5% Symbian phone Job de Haas BlackHat Security ITSX BV Amsterdam 2005 Symbian Versions • EPOC32 • EPOC R5 • Symbian v6.0 • Symbian v7.0 • Symbian v8.0 • Symbian v9.0 announced for Q3 ‘05 Symbian phone Job de Haas BlackHat Security ITSX BV Amsterdam 2005 Series60 versions • 1st edition • 2nd edition • 3rd edition, announced feb. 2005 Symbian phone Job de Haas BlackHat Security ITSX BV Amsterdam 2005 UIQ versions • UIQ 1.0 • UIQ 2.1 • UIQ 3.0 released feb 2005 Symbian phone Job de Haas BlackHat Security ITSX BV Amsterdam 2005 Symbian OS Symbian phone Job de Haas BlackHat Security ITSX BV Amsterdam 2005 Symbian OS • Multitasking, preemptive kernel. • MMU protection of kernel and process spaces. • Strong Client – Server architecture • Plug-in patterns • Filesystem in ROM, Flash, RAM and on SD-card Symbian phone Job de Haas BlackHat Security ITSX BV Amsterdam 2005 Symbian development • Symbian v6 and v7 are compiled with a modified GCC.
    [Show full text]
  • On the Feasibility and Impact of Digital Fingerprinting for System Recognition
    Fakultät für Elektrotechnik und Informationstechnik On the Feasibility and Impact of Digital Fingerprinting for System Recognition Dissertation Thomas Hupperich 01. Februar 2017 Fakultät für Elektrotechnik und Informationstechnik On the Feasibility and Impact of Digital Fingerprinting for System Recognition Dissertation zur Erlangung des Grades eines Doktor-Ingenieurs der Fakult¨atf¨urElektrotechnik und Informationstechnik an der Ruhr-Universit¨atBochum vorgelegt von Thomas Hupperich aus Wermelskirchen Bochum, 01. Februar 2017 Gutachter: Prof. Dr. Thorsten Holz Ruhr-Universit¨atBochum Zweitgutachter: Prof. Dr. Felix Freiling Friedrich-Alexander-Universit¨atErlangen-N¨urnberg Tag der m¨undlichen Pr¨ufung:30. Juni 2017 \The most merciful thing in the world, I think, is the inability of the human mind to correlate all its contents. We live on a placid island of ignorance in the midst of black seas of infinity, and it was not meant that we should voyage far. The sciences, each straining in its own direction, have hitherto harmed us little; but some day the piecing together of dissociated knowledge will open such terrifying vistas of reality, and of our frightful position therein, that we shall either go mad from the revelation or flee from the deadly light into the peace and safety of a new dark age." | H.P. Lovecraft - The Call of Cthulhu Acknowledgement First and foremost, I thank my supervisor Prof. Dr. Thorsten Holz for guiding my explorations through the infinite black seas of research and for all the enlightening scientific insights. I am grateful for the freedom to research topics of my interest and for the lively discussions about them. Leaving the island of ignorance and broadening the horizon requires exploration.
    [Show full text]