Risk Analysis of Mobile Devices with Special Concern of Malware Contamination
Total Page：16
File Type：pdf, Size：1020Kb
University of Hamburg Fachbereich Informatik Arbeitsbereich AGN Risk Analysis of Mobile Devices with Special Concern of Malware Contamination Diploma Thesis Henrich C. Pöhls Alsterweg 13 22339 Hamburg Germany Phone: ++4940 611 64 378 E-mail: [email protected] Matrikel-Nr.: 4964746 First Supervisor: Prof. Dr. Klaus Brunnstein Second Supervisor: Prof. Dr. Norbert Ritter August 2003 Risk Analysis of Mobile Devices with Special Concern of Malware Contamination This page is intentionally left blank Henrich C. Pöhls Risk Analysis of Mobile Devices with Special Concern of Malware Contamination Erklärung Ich versichere, die vorliegende Diplomarbeit selbständig und ohne fremde Hilfe angefertigt zu haben. Für die Arbeit habe ich keine außer den angegebenen Quellen und Hilfsmitteln benutzt. Ich bin mit einer Einstellung in den Bestand der Bibliothek des Fachbereichs einverstanden. Hamburg, den 31.8.2003 _____________________ ( HENRICH C. PÖHLS ) Henrich C. Poehls Risk Analysis of Mobile Devices with Special Concern of Malware Contamination This page is intentionally left blank Henrich C. Pöhls Risk Analysis of Mobile Devices with Special Concern of Malware Contamination Index 1 Introduction .................................................................................................................................... 1 2 Terms and Definitions.................................................................................................................... 3 2.1 Towards a “Risk Analysis” of mobile devices ........................................................................... 3 2.2 The Term “Mobile Device” and Related Terms......................................................................... 3 2.2.1 The Term “Desktop”........................................................................................................... 4 2.2.2 The Term “MS Pocket PC 2002” ....................................................................................... 4 2.2.3 Why the Pocket PC 2002 Platform? .................................................................................. 5 2.3 The Connection State of a Mobile Device ................................................................................ 8 2.3.1 Connection State: Disconnected ....................................................................................... 8 2.3.2 Connection State: Connected............................................................................................ 8 2.3.3 Connection State: Wirelessly Connected .......................................................................... 8 2.3.4 Connection State: Cradled (Home System & Pairing Process)......................................... 8 2.4 The Term “Malware” and Related Terms.................................................................................. 9 2.4.1 The Term “Virus”................................................................................................................9 2.4.2 The Term “Worm” .............................................................................................................. 9 2.4.3 The Term “Trojan Horse” ................................................................................................... 9 2.4.4 The Term “Hostile Applet”................................................................................................ 10 2.4.5 The Term “Malware Distribution” ..................................................................................... 10 2.4.6 The Term “Malware Contamination”................................................................................ 11 2.4.7 The Terms “Testbeds”, “Test Sets” and “Samples”......................................................... 12 3 Pocket PC 2002 Hardware ........................................................................................................... 15 3.1 Pocket PC 2002 Hardware Specification................................................................................ 15 3.1.1 ARM Processor................................................................................................................ 15 3.1.2 ARM Architectures and Instruction Sets.......................................................................... 16 3.2 Available Pocket PC 2002 mobile devices ............................................................................. 16 3.2.1 Short list of mobile devices.............................................................................................. 16 3.2.2 Categorization by processor architecture ........................................................................ 17 3.2.3 Categorization by CPU clock and size of RAM ............................................................... 18 4 Pocket PC 2002 Operating System............................................................................................. 19 4.1 Windows CE Versions ............................................................................................................ 19 4.1.1 Windows CE Version 1.0 ................................................................................................. 19 4.1.2 Windows CE Version 2.0 ................................................................................................. 19 4.1.3 Windows CE Version 3.0 ................................................................................................. 19 4.1.4 Windows CE.net .............................................................................................................. 19 4.2 Versions build on Windows CE 3.0......................................................................................... 20 4.2.1 Pocket PC 2002: Professional, Premium & Phone Edition ............................................. 20 4.2.2 Smartphone 2002 ............................................................................................................ 20 4.3 Pocket PC 2002 core functions............................................................................................... 21 4.3.1 Process and Thread Management .................................................................................. 21 4.3.2 Synchronizing Processes and Threads ........................................................................... 23 4.3.3 Memory Types ................................................................................................................. 25 4.3.4 Virtual Memory................................................................................................................. 27 4.3.5 Files, Databases and Persistent Storage ........................................................................ 30 4.3.6 Interprocess Communications ......................................................................................... 33 4.3.7 User Interface Services ................................................................................................... 34 4.3.8 Multimedia........................................................................................................................ 36 4.4 Pocket PC 2002 network functions......................................................................................... 36 4.4.1 Overview of Network Components .................................................................................. 37 4.4.2 Serial Connections [client/server] .................................................................................... 38 4.4.3 Telephony API (TAPI) [client] .......................................................................................... 38 4.4.4 Remote Access Service (RAS) [client] ............................................................................ 38 4.4.5 Windows CE Sockets (WinSocks) [client/server] ............................................................ 38 4.4.6 Windows Networking (WNet) [client] ............................................................................... 39 4.4.7 Windows CE Internet API (WinInet) [client] ..................................................................... 40 4.4.8 TCP/IP stack in Windows CE 3.0 [client/server].............................................................. 41 4.4.9 Network Driver Interface Specification (NDIS) [client/server].......................................... 41 4.4.10 Point-to-Point Protocol (PPP) [client/server].................................................................... 42 4.4.11 Virtual Private Network (VPN) [client].............................................................................. 43 Henrich C. Pöhls I Risk Analysis of Mobile Devices with Special Concern of Malware Contamination 4.4.12 Terminal Services [client]................................................................................................. 43 4.4.13 ActiveSync ....................................................................................................................... 43 4.4.14 Connection Manager ....................................................................................................... 48 4.5 Pocket PC 2002 power management ..................................................................................... 50 4.6 Pocket PC 2002 security functions ......................................................................................... 51 4.6.1 Power-On Protection ....................................................................................................... 51 4.6.2 Security Support Provider Interface (SSPI) ..................................................................... 53 4.6.3 Cryptography