2011 IEEE Symposium on Security and Privacy Mobile Security Catching Up? Revealing the Nuts and Bolts of the Security of Mobile Devices Michael Becher, Felix C. Freiling Johannes Hoffmann, Thorsten Holz, Sebastian Uellenbeck, Christopher Wolf University of Mannheim, Germany Horst Gortz¨ Institute (HGI) Ruhr-University Bochum, Germany Table I Abstract—We are currently moving from the Internet society GLOBAL SALES FIGURES AND MARKET SHARE OF MOBILE to a mobile society where more and more access to information OPERATING SYSTEMS FOR THIRD QUARTER OF 2009 AND 2010 [11] is done by previously dumb phones. For example, the number of mobile phones using a full blown OS has risen to nearly 200% from Q3/2009 to Q3/2010. As a result, mobile security 3Q’09 3Q’10 is no longer immanent, but imperative. This survey paper OS units/1k share [%] units/1k share [%] provides a concise overview of mobile network security, attack Symbian 18,314 44.6 29,480 " 36.6 # vectors using the back end system and the web browser, but Android 1,424 3.5 20,500 "" 25.5 "" also the hardware layer and the user as attack enabler. We iOS 7,404 17.1 13,484 " 16.7 # show differences and similarities between “normal” security RIM 8,522 20.7 11,908 " 14.8 # and mobile security, and draw conclusions for further research Windows 3,259 7.9 2,247 # 2.8 # opportunities in this area. Linux 1,918 4.7 1,697 # 2.1 # Others 612 1.5 1,214 " 1.5 = Keywords-mobile security; smartphones; survey Total 41,093 100.0 80,532 100.0 I. INTRODUCTION The beginning of the smartphone era can be seen as be- ginning with the new millennium. Since then, numerous new decreased. Besides the operating systems Windows Mobile “smart” devices like BlackBerries, iPhones and, recently, and Symbian OS, the mobile world has seen the advent of Android-based phones have been introduced that revolu- the iPhone’s iOS and the Linux-based Android operating tionized the market. At the same time, many articles about system during the last few years. Despite of their young age, smartphone security and the potential of malicious software both operating systems already gained their market share and on them were published [1]–[8]. Quite often, studies had they are predicted to even increase it in the future. Table I statements similar to the following quote by Gartner which provides an overview of global sales figures and market estimated “that by the end of 2007, enough factors will have share for mobile operating systems and the huge growth of come together that the risk of mobile attacks will be much Android is clearly visible. Second, it might simply be the greater. Those factors include less heterogeneity in operating case that mobile operating systems are sufficiently secure systems, more penetration of smartphones and a greater in- today as voiced by Bontchev [10]. Hence, this might be cidence of people actually accepting downloads and sending another reason why no major security incident has happened executables to one another on mobile devices” [9]. However, until now. Third, there may be additional factors such up to now the expected plethora of attacks has not been as the different network topologies: for the Internet, it is observed. nearly end-to-end, while strongly hierarchical for mobile Many researchers and practitioners are expecting a major networks. Last but not least, there is also the effect of security incident with mobile phones ever since these devices the “self-defeating prophecy” of mobile security: Having began to become more powerful: with increased processing the strong example of desktop insecurity, plus plausible power and memory, increased data transmission capabilities attack scenarios, the claims of mobile insecurity might have of the mobile phone networks, and with open and third-party triggered mobile security. Overall, the reasons for the non- extensible operating systems, phones become an interesting existence of major security incidents for mobile phones are target for attackers. However, no major incident has hap- still unclear up to now. pened as of the time of this writing. However, we recently saw the first real attacks against The reasons for this are unclear. However, certain inherent smartphones: In March 2010, Iozzo and Weinmann demon- aspects seem to have a positive effect on security, one of strated a drive-by download attack against an iPhone 3GS them being the heterogeneity of mobile operating systems. that enabled an attacker to steal the SMS database from Contrary to the prediction quoted above, heterogeneity of the phone [12]. In November 2010, one of the first public mobile operating systems has actually increased instead of exploits to perform an attack against the mobile browser 1081-6011/11 $26.00 © 2011 IEEE 96 DOI 10.1109/SP.2011.29 shipped with Android was released [13]. Recently, Wein- devices can be imagined that do not have a connection mann introduced the first over-the-air exploitation of mem- to a mobile network, i.e., do not contain an operator- ory corruptions in GSM software stacks [14] and Oberheide controlled smartcard, but are attackable by mobile malware. and Lanier identified several attack vectors against the Fortunately, all relevant mobile device operating systems iTunes App Store [15]. So it is not far fetched to ask whether provide the interface to the mobile network together with we are now at the beginning of an era of attacks against the local communication interfaces. That is why the intuitive smartphones? definition from the beginning still holds. In this paper, we survey the area of smartphone secu- rity. This topic covers all mechanisms that are intended to B. Definition & Discussion increase the security of sophisticated mobile devices. The A more rigid definition follows now as well as a dis- contributions of this paper are two-fold. First, we survey tinction concerning the possible security mechanisms. We and structure the state of the art in the area of smartphone define an MNO smartcard as follows: an MNO smartcard is security. We systematize the research that has been done a smartcard inside the mobile device that is controlled by a in this area in the last years and provide a categorization. mobile network operator. Whenever this term is used in this Second, we present directions of future research on these paper, it can be used for all smartcards in mobile devices subjects and outline challenges that we expect to emerge. In that are controlled by an MNO regardless of the actually summary, this paper provides a detailed overview of different used technology. A second important term is smartphone, aspects of the topic smartphone security and it serves as a which we define as follows: a smartphone contains an MNO guide for past, present, and future work in this area. smartcard with a connection to a mobile network. Moreover, it has an operating system that can be extended with third- II. FROM MOBILE TO SECURITY party software. In this section, we first introduce some terms we use The term “smartphone” as one word is chosen inten- throughout the paper and then clarify why mobile security tionally. It is supposed to denote that not only “smart is a topic of its own. This extends some preliminary work phones” are under attack, but that the smartphone with its by Oberheide and Jahanian, who recently performed a brief two main properties defines a class of attack targets and survey of this area [8]. protection needs, which takes place in a setting with mobile devices connected to the network over a wireless link and A. Initial Definition a more centralized environment of the network operators. As a first approach, the investigation subject of this paper Additional properties of these smartphones can be found is defined as: any mobile device that contains a smartcard in the literature [16]. We sometimes use the term mobile that is controlled by a mobile network operator (MNO). device as a synonym for smartphone within this paper. Intuitively, this is the definition of a mobile phone. Smartphones offer various services to its users. Popular is This definition is too broad for us because it also covers messaging as Short Message Service (SMS) and Multimedia mobile phones that are not in the focus of this paper. These Messaging Service (MMS). They use certain protocols that are mainly the kind of phones that can only be used for are explained in the literature [17] and we discuss the the phone functionality (plus text messaging and some basic security aspects of them later. other functionality), often aligned with a limited display size. In contrast to mobile devices, traditional computers are Such phones are called feature phones. They sometimes have called hereafter ordinary computers. When their fixed loca- proprietary operating systems and are not extensible with tion is emphasized, they are called desktop computers. additional software. Even though the applications on these phones can be attacked, e.g., Denial of Service (DoS) attacks C. Specifics of Mobile Devices with malformed short messages, they are not the typical A central question for the topic smartphone security is: attack target of mobile malicious software. In what sense is research on the security of mobile devices Other exceptions are some restricted environments that are different from common security research? Is it possible to not in the focus of this paper either: USB sticks that enable transfer known security solutions from ordinary desktop laptops to use the mobile network are also not covered. computers to mobile devices? Could it possibly be the same, Moreover, there are some other devices with operator- only with the additional word “mobile” in the title? controlled smartcards that are a restricted environment of We argue that there are specifics of mobile device security their own (e.g., machine-to-machine types of communica- that justify independent research on this topic.