Shoulder check! Is your mobile data safe?

The recent findings of an Android VPN vulnerability (http://cyber.bgu.ac.il/blog/vpn-related-vulnerability-discovered-android-device-disclosure-report) have had Samsung and Google scrambling to provide commentary on the legitimacy and level of threat posed by the vulnerability. Samsung has blamed Android and Google has said this is a known man-in-the-middle (MITM) attack. There are few details on the attack, but let’s take a closer look at the issue in general.

If an app uses a VPN, then the apps communication is passed to the VPN, which in turn encrypts the data between the VPN and the corporate network where the VPN is terminated.  The attack is on this short piece of unencrypted traffic from the app to the VPN in the mobile device. Apparently using a regular downloaded app, presumably with some explicitly allowed permissions to access the network communication  – this part is not clear – the malicious app can sniff or siphon this unencrypted traffic before it reaches the VPN client. This is not exactly a man-in the-middle attack (more a man looking over your shoulder attack), but has the same effect. Google is correct in that this is a known attack against a VPN. VPNs generally assume that the device operating system is trusted.

So what are the possible solutions? First, the app could use SSL/TLS directly which is what most browsers can do. The malicious app can still grab the message, but it is already encrypted. HTTPS on a browser is not the same as a VPN, but it does prevent the attack.

Second, the app could implement newer technology called per-app VPN – which is what a number of companies offer to address precisely this issue, including as a feature of Samsung KNOX. This encrypts the data using SSL/TLS (usually) like in the browser example above, so the malicious app can only grab encrypted data. However, per-app VPNs require the app to be modified – with either a wrapper, or a “container” in the case of KNOX.

Third, you could make sure the app is not present to do the sniffing in the first place.

MDM and EMM products alone cannot solve this issue. Mobile Application Management (MAM) can make sure that only specific apps are present, but MDM products are not security products, they are device policy management solutions that may or may not implement some security policy elements. Most solutions can limit apps in a work space, but not on the whole device – so the malicious software is still present. If the apps or group of work apps are wrapped or containerized, then the apps must be modified and choice of available apps plummets. Look at the low number of apps in the MDM app stores. Plus, there are additional steps needed for the deployment and maintenance of corporate or custom developed apps.

Hypervisor or virtualization solutions do provide the necessary security isolation without the need to modify the apps. By using a virtual instance for personal apps and a separate instance for work, then apps in the workspace can be controlled and any malicious apps excluded. Even if the malicious app exists on the device, the virtualization prevents the app from grabbing the network traffic, as well as a wide range of other attacks.

Secure Spaces provides exactly the security provided by virtualization, but without the device integration and performance overhead of traditional type 1 and type 2 hypervisors.  Secure Spaces is a light-weight system level virtualization that enables many new business opportunities beyond enterprise security, such as disposable secure spaces.

Secure Spaces enables the IT administrator to control which apps are in their employees Work Space, including the VPN. No modification of apps is needed and choice is not limited. This is the simplest solution to these kinds of vulnerabilities.

Ask Google when they will support a simple MDM and device OEM agnostic domain isolation solution. In the meantime, try out one of our custom Android images that have been only modified to include Secure Spaces. For more information visit www.securespaces.com or contact us at info@graphitesoftware.com.

Reprinted from: http://insights.wired.com/profiles/blogs/shoulder-check-is-your-mobile-data-safe?xg_source=msg_appr_blogpost

A room with a view. The future of content on your mobile device.

This following post is re-printed from Alec's guest blog account at Wired Insights.

Read more: http://insights.wired.com/profiles/blogs/a-room-with-a-view-the-future-content-on-your-mobile-device#ixzz2rEDfPySL 

What if your mobile device provided you with exactly the information that you wanted, when you wanted and only for as long as you wanted it? What if it was possible to create a room on your phone or tablet that is dedicated to a purpose just as rooms in your house are dedicated. You have a kitchen for cooking, a bedroom for sleeping, a bathroom for ... well you get the idea. What if you could isolate rooms on your phone or tablet for very specific purposes? You could create a room that is dedicated to your personal activities like banking, shopping and music and another room for work.

These are some of the more common ways people currently think about separate rooms on their device. But what if this concept was expanded and you could also create a room on your device that is dedicated to your favorite brand or activity. This room would not have access to any of your personal or work apps and data. It would be accessible by you when you want to see that information rather than cluttering up your device’s home screen. It would contain apps and content that is published by an administrator thus reducing your need to search and guess at which apps to use to see the content that you want. That administrator could not see anything else on your device and, unless you signed up for something, wouldn’t even know who you are. And when you don’t want the room on your device anymore you can simply delete it without affecting anything else on the device.

Rooms such as these have a place in our modern lives because we want information from our favorite brands, but we don’t necessarily want the data sharing that can sometimes be required. And there is no reason why such rooms have to be permanent. What if we created rooms on our mobile device that are temporary. The rooms would last only for the duration of an event or activity. Once you have finished the activity or event, that room is closed and on you go to the next. For example, you are attending a trade show; wouldn't it be great to have a room on your phone that is dedicated to the event? It would contain apps and data with the trade show agenda, venue information, city guides, transit schedules, hotel and restaurant guides, and more. And the content is updated regularly by the show organizer. At the end of the show the space disappears from your mobile device.

Sporting events like the Olympics would be an ideal use for a room on your device. The Olympics last for two weeks every other year (if you include the Summer and Winter Olympics). As the medal standings change you’d be immediately aware, as venues for events change you’d be immediately informed. At the end of the two weeks the Olympic room would disappear but all of your photos would remain in your personal room. Even shorter events like a football, basketball or hockey game could have a dedicated room that is loaded over the air to your device as you enter the stadium. During the game you can load apps to see the team rosters, view food outlets, purchase merchandise, and more. As you leave the stadium the temporary room disappears, all without ever having access to your personal or work apps and data.

You spend more time with your mobile device than any other device that you own, it is always with you and it is typically always on. Why limit the mobile experience to just email and web browsing? Why not allow your mobile device to provide a portal to any number of dedicated, curated experiences that appeal to your personal taste but also remain completely in your control while protecting your privacy. This is the future of how you will receive content on your mobile phone  -- a future that is closer than ever.

Google Play! At your own risk!

Our last three blog posts have been about Trust, or the lack of it. Well, it seems that the matter of Trust has taken another hit while we were all enjoying the holidays. Please read: http://techcrunch.com/2014/01/02/developer-spams-google-play-with-ripoffs-of-well-known-apps-again/ . A quick summary of the article is that a developer(s) has loaded fake apps onto the Google Play! App store and has made them appear to be legitimate apps by slightly modifying the app names. The issue is how these apps were able to make it through the review process to make it onto the app store at all. Was it the reduced staffing at Google to validate the claims of the developer and verify the operation of the app?

There are several victims in this case:

- The impact to the consumer, in this situation, is having paid for an app that does not work and clearly does not have a means to recuperate their payment from the developer … unless Google steps in to reimburse those impacted by this fraud.

- We suspect that the original, valid app developers were impacted by support calls for an app that looked like theirs on the app store but was, in fact, not theirs and now have to deal with a consumer who is likely upset and perhaps demanding reimbursement.

-  Other app developers are now victims as it is certain that Google will raise the bar for entry to their app store and will put legitimate developers through additional effort and expense to get their apps placed.

-  Google is also a victim of a weakness in their own process that was exploited by an individual(s) and has called into question their diligence process and unfortunately the validity of all other apps that have gone through the process.

Unfortunately, in this particular case, it is a “buyer beware” situation and Google will do their best to remove the fraudulent apps and to make things right. But imagine if those apps were malicious to your device and its data, rather than non-operational. Imagine if the apps were free and available over the Holidays to all of the new Android device users. How many people truly read the “app permissions” dialog that appears just before hitting OK to download? Just how much damage could there have been to devices and data. Not to mention the damage to the Trust that consumers and businesses place on their use of the Google Play Store!

There is an opportunity here for a simple solution to help Consumers and Business take further control over their own protection and privacy. A solution that does not rely on the inspection and understanding of the permission requirements of each and every app. A solution that can prevent even a malicious app from gaining access to the other apps and data that are important to you or your business. There is a solution and it is called Secure Spaces.

Industry Watch: A matter of trust - By David Rubinstein (Editor-in-Chief, SD Times), Dec. 27, 2013

Eight technology companies last month sent a letter to U.S. President Barack Obama to push for legislation to scale back the amount of data government agencies can gather, to help restore trust in the government as well as a measure of personal privacy.

But it’s not just the government that’s grabbing our personal information. More and more, regular old consumer applications are asking for more permission to drill through your information. This is even exacerbated by our personal relationship with our devices, which led virtualization startup Graphite Software CEO Alec Main to remark, “We spend more time with our devices than with our wives.”

This relationship has fueled the workplace BYOD phenomenon, in which workers tell their companies which devices they want to use. In the past, companies would assign walkie-talkies or other communicators to all workers so they could control what data was on them and how it was used. But with the proliferation of devices today, people want to use what they’re comfortable with everywhere they are.

Today’s workers want a convergence of work and personal applications on their devices, if for no other reason than to reduce the number of devices they have to carry around all day. And while companies are doing a commendable job of protecting their sensitive data on worker devices, these same solutions do not protect consumer data nearly as well.

“It’s not about malware,” Main explained. “It’s not about slowing it down or running bots. It’s about legitimate apps sitting in app stores that you can download that are trolling through your contacts.

“We’ve all had those experiences. It’s amazing with LinkedIn, right? You have LinkedIn and suddenly it’s saying, ‘Do you want to connect with this guy?’ And you’re like, ‘Who IS that guy?’ It’s like somebody you had one e-mail with 10 years ago and now it’s asking if you want to connect with the guy. Or when they connect the lines in the background. I’ve been on some of these things, you connect in, and then it asks, ‘Do you want to connect with your sister-in-law?’ Well, how do they know my sister-in-law? I’m not connected to any of my family, but now it’s asking me if I want to connect with my sister-in-law?”

One indicator of the importance device users place on privacy is the kerfuffle over Google’s removal of the AppOps privacy settings software, which it says it inadvertently included with Android 4.3 but removed in 4.4.2. Google said this is because the software wasn’t fully baked.

Even so, Main said that solution was too complicated to become mainstream. “If you’re going to click on the OK OK [popup permission boxes]—going back to your saying people are just resigned to it—well I want that app. I’m not going to read what the permission are, I’m just going to click OK. So we need something really simple.”

Graphite Software’s approach is to create buckets, to separate apps and data into places where control can be better maintained. “It’s not fine-grained control, more of a macro control,” Main said. “If I put stuff in a certain bucket, or sometimes we talk about it as a room...you have your kitchen, you have your media room, your bathroom at your house. When you’re in your bathroom, that’s fine, you don’t put your bathroom in your kitchen. You live your life in different spaces already. On the weekend, you kinda want to relax, you go into the media room, you don't want to be bothered by your home office.”

To create separate spaces, some companies take a virtualization solution. Those, Main asserted, are too heavy for mobile devices in terms of performance and memory usage. So Graphite Software has created what it calls service-level virtualization that is built directly into Android and lets users create different containers (or spaces, as Graphite calls them) on the device. Main said, “You can have as many spaces as you want because it’s very lightweight. You can delegate management of those spaces to a third party such as your enterprise IT, or you can create your own spaces on the phone.

“If you do that, you can now segregate apps into different groups. You can put all your gaming apps and accounts into one place, you can have an open space that’s for your kids so you can share your device. You can also have a personal space for yourself. And then you can also delegate a portion of it to enterprise IT, and they can enforce their own policies, but only on their space. Not on your space and not on your data. They can’t see your data either. It’s really isolated. One space can’t access another space in any way.”

In the end, for people to use these applications and devices, it’s a matter of trust. Most of us are resigned to giving up some privacy for things we want on the Web, because some personal data is required for that. But Main maintains—and I concur—that when apps on a phone device start requesting too much personal data, things are getting out of hand. This time, it’s personal.

David Rubinstein is editor-in-chief of SD Times.