Dave Waterson on Security

The chatter around the halls of Mobile World Congress in Barcelona last week indicates growing enthusiasm for the Fifth Generation (5G) mobile network. Every ten years or so sees a new generation mobile network. The first generation, 1G, used an analogue signal and was launched in 1981. 2G commenced in 1991 and utilised GSM with data speeds up to 64kbps. 2G introduced SMS and MMS. 3G was launched 10 years later in 2001 and introduced smartphones and 2 Mbps data speeds. 3G was the start of web-based applications and video files. Today we have 4G, launched in 2012 with up to 1 Gbps data speeds and mobile broadband everywhere.
Continue reading →

Even though mobile malware is growing rapidly, malware still remains a small proportion of the threats on mobile devices. By far the greatest mobile threat is from “legitimate” applications downloaded from the official Apple Store or from Google Play – apps that undertake “risky” behaviours, such as location tracking, identifying the user’s ID (UDID), accessing the user’s contact list, and sharing sensitive user data.
Continue reading →

Last week, Google announced the launch of Android Wear – a new operating system for wearable computing. Wearable devices currently are in the form of glasses, braces and watches. With the advent of Android Wear, many more devices will come to market – smartwatches, fitness monitors, health devices, spectacles, and other wearable computers including those built into clothing. It is now a much simpler task for example, for a watch manufacturer with no experience in software, to produce a smartwatch running Android Wear and apps written by independent developers.
Continue reading →

Your smartphone runs a second operating system which controls all radio communication with the base station. By exploiting this second OS, an attacker can remotely control the smartphone’s functionality, such as activate the microphone and camera, conduct SMS or phone fraud, install rootkits, or permanently destroy the device.
Continue reading →

Android users typically install many different types of applications on their device – some apps are from trusted sources such as the bank, others are less trusted such as free games. Some apps require user permissions at installation in order to access potentially sensitive functionality. However, an app that requires no user permissions is able to harvest sensitive data from trusted apps and from the device, and send this data anywhere, without the knowledge of the user. Sensitive data that can be harvested by a malicious app includes SMS messages, emails, GPS location, call history, browser history, bank account information, etc.
Continue reading →

A new security vulnerability has been identified on iPhone smartphones and iPad tablets, involving malicious iOS provisioning profiles. No live examples of an attack of this nature have been found, however a proof of concept has been developed.
Continue reading →