Hasselt University Transnationale Universiteit Limburg Assessing and improving security and privacy for smartphone users Dissertation submitted for the degree of Doctor of Philosophy in Computer Science, at Hasselt University to be defended by Bram Bonné on August 31, 2017 Promotor: Prof. Dr. Wim Lamotte Co-promotor: Prof. Dr. Peter Quax 2011 – 2017 Abstract Smartphone and other mobile device usage has increased greatly in the past years. This increased popularity has also led to a changed security and privacy landscape, with more personal devices being outfitted with a plethora of sensors that allow to track our every step, and a vastly larger attack surface than older, more static devices. This allows a variety of actors, including malicious hackers, state-sponsored entities and legitimate service providers, to have access to a large trove of mobile user data. In this dissertation, we assess the current state of privacy and security on smartphones, we create and gauge awareness of smartphone users around these issues, and we provide so- lutions to enhance security and privacy on mobile devices. To show the ease with which smartphone users’ data can be gathered surreptitiously, we describe a mechanism for invol- untarily tracking visitors at mass events making use of Wi-Fi technology, and show that this can be implemented at a low cost, allowing location tracking of 29% of visitors at a major music festival. We show how these techniques can be (ab)used in different scenarios (notably, by using the gathered data to compare different opportunistic routing algorithms that can be used for ad-hoc communication at mass events), and provide an open platform to researchers that can be used to quantify the impact and remediation rate of similar wireless protocol vulnerabilities. We create awareness about these issues, and we explain to smartphone users how they can secure themselves against them. For this, we provide a method to inform mobile device users when using wireless networks, showing privacy-sensitive (but anonymized) informa- tion about passers-by on a public display. We later use the same setup to inform audiences in talks on security awareness. Results from our user studies also show that specific, personal- ized scenarios may help to better inform users about security and privacy issues (increasing awareness of 76% of the participants in one study), and that the increased awareness leads to as much as 81% of device users willing to put an extra effort into securing their smartphones. Interestingly, we also show in a later study that an increased awareness does not automatically translate to better security practices. Additionally, we perform two studies to measure users’ privacy and security behaviors when using their smartphones. For the first study, we look at how aware users are about connections ii being made by apps on their device, while taking into account the security of both the Wi- Fi networks used and the connections made over these networks. For the second study, we extend the Paco ESM study tool to be able to examine the reasons why Android users install or remove an app at the time this happens, to look at the motivation behind granting or denying a permission right after users make their choice, and to assess how comfortable and aware users are about their decisions at a later point in time. We provide recommendations to different stakeholders (developers, manufacturers, network providers, researchers and mobile device users) on how to improve privacy and security on mobile devices without affecting usability, some of which have already been implemented by operating system manufacturers. Part of these recommendations are implemented as a tool that automatically mitigates Wi-Fi attacks for Android smartphones, which is distributed to the general public. In addition, we formulate a proposal to improve transparency in how user data is shared by service providers to third parties. Acknowledgments This dissertation is the result of work conducted during the period between September 2011 and June 2017 at Hasselt University. It would have never been possible without the help of some people, whom I would like to thank here. First, many thanks go out to my promotor and co-promotor Wim Lamotte and Peter Quax. They provided me with the necessary guidance throughout the past 6 years, not only with respect to the research that went into completing my PhD, but also through assistance when performing teaching duties. When performing experiments involving deploying and moni- toring large amounts of Wi-Fi scanners, they were also there to help with the hands-on work, soldering together the scanners and climbing structures to suspend them. Without their con- tinued support, this thesis would not have been possible. I also want to thank my PhD jury: Frank Van Reeth, Igor Bilogrevic, Karin Coninx, Lieven Desmet, Marc Gyssens and Tristan Henderson, for reviewing my text, and for their comments that helped make this dissertation. I want to thank the rest of the EDM, and by extension the entire computer science fac- ulty for the great working environment. Specifically, I want to mention Arno Barzan and Pieter Robyns, who have contributed greatly to this research, and helped in keeping me sane throughout this work. They were always there for support and laughs. I also want to thank Kris Luyten, Jo Vermeulen, and Fabian Di Fiore, for respectively encouraging me to go work at Google, for the genuine interest in my work, and for dark industrial techno. Similarly, I want to thank Sai Teja Peddinti, Nina Taft, and the rest of the wonderful people I had a chance to work with at Google for the awesome working environment. They immedi- ately made me feel like part of the team, and supported my work all the way through, even at the expense of other projects they had to manage at the same time. There are some other people who provided great support for individual experiments. First of all, a huge thanks goes out to the Pukkelpop organization, including Chokri Mahassine himself, for allowing us to perform our experiments at their festival, and to The Safe Group for helping out and for staying incredibly nice while we abused their infrastructure. Thank you also to Bob Hagemann and the rest of the WiGLE.net team, for allowing the nearly iv unlimited use of their wardriving database to inform people about the dangers of wireless networks. Lastly, I want to thank my parents and my brother (who is incidentally also my best friend), my girlfriend Tine, all my other amazing friends1 and possibly the best family in the world. They all contributed so much to this thesis without even realizing it, by encouraging me to pull through, and by just being the nicest and friendliest people around. Thank you all so much, Bram Bonné 1“Friends” sounds so offhanded. So here we go; at the very least (apart from family and (ex-)colleagues): Alicja, Andrea, Anneleen, Ben, Bert, Brecht, Carl, Cedric, Daniël, Dries, Eef, Hannah, Hanne, Hélène, Ian, Ine, Jasper, Jimmy, Joachim, Joke, Jolien, Julie, Kevin, Koen, Koenraad, Kristof, Lore, Lowie, Maarten, Marijke, Marleen, Michelle, Miet, Nathalie, Nel, Nico, Phung, Rachel, Roald, Ruben, Sam, Sarina, Sebastiaan, Sophie, Stephanie, Thierry, Thijs, Tiberd, Tinne, Tom, Wim, Xavier and Yifei. Contents Abstract i Acknowledgments iii Contents v 1 Introduction and research questions 1 I Security and privacy issues in smartphone connectivity 7 2 WiFiPi: Involuntary Tracking of Visitors at Mass Events 11 2.1 Introduction . 13 2.2 Related work . 13 2.3 Technical background . 15 2.3.1 Scanning for wireless networks . 15 2.3.2 Connecting to a network . 18 2.4 The WiFiPi detection mechanism . 18 2.4.1 Detecting a device . 19 2.4.2 Tracking the location of a device . 20 2.5 Implementation . 21 2.6 Experiments . 22 2.6.1 Pukkelpop 2012 . 24 2.6.2 University campus . 24 2.6.3 Pukkelpop 2013 and WiFiPi 2.0 . 25 2.7 Applications . 28 2.7.1 Real-time crowd management and marketing . 28 2.7.2 Mobility models for simulations . 29 2.7.3 Ubiquitous computing . 29 2.8 Privacy implications . 30 vi CONTENTS 2.9 Conclusion . 31 3 A Comparative Simulation of Opportunistic Routing Protocols Using Realistic Mobility Data Obtained From Mass Events 33 3.1 Introduction . 35 3.2 Background and Related Work . 35 3.3 Mobility . 36 3.3.1 Collecting Data . 37 3.3.2 Calculating movement paths . 37 3.4 Simulations . 38 3.4.1 Simulation Settings . 39 3.4.2 Routing Protocols . 41 3.5 Results and analysis . 42 3.5.1 Metrics . 42 3.5.2 Individual Protocol Examination . 44 3.5.3 Comparison . 45 3.5.4 Candidate Selection . 46 3.6 Conclusion . 48 4 Assessing the Impact of 802.11 Vulnerabilities using Wicability 49 4.1 Introduction . 51 4.2 Capability aggregation . 52 4.2.1 Acquisition . 52 4.2.2 Matching and processing . 53 4.2.3 Presentation . 54 4.3 Case study: prevalence of devices susceptible to active probing attacks . 54 4.4 Datasets . 56 4.5 Conclusion . 56 II Creating and assessing user awareness 61 5 Raising Awareness on Ubiquitous Privacy Issues with SASQUATCH 65 5.1 Introduction . 67 5.2 Mobile Phones that “Never Forget” . 68 5.3 The SASQUATCH System . 68 5.3.1 Inferring a smartphone’s whereabouts . 69 5.3.2 Determining a network’s authentication type . 70 5.4 Study . 71 5.5 Results . 74 5.6 System analysis and limitations . 77 CONTENTS vii 5.7 Conclusion . 79 6 Understanding Wi-Fi Privacy Assumptions of Mobile Device Users 81 6.1 Introduction . 83 6.2 Related work . 84 6.3 Methodology . 86 6.3.1 Connection monitoring .