19-07-2012, 12:53 PM
HOW SMART IS YOUR ANDROID SMARTPHONE
[attachment=28055]
Introduction
Mobile phones are no longer devices restricted to making voice callsthey can run most
of the processes that one expects from a desktop computer. Mobile phones are equipped with
applications such as e-mail clients, chat clients, short messaging service (SMS), and multimedia
messaging service (MMS). Most smartphones are equipped with cameras so that one can have
personal pictures and videos on the phone. Communication between two mobile devices is no
longer limited to the services of a GSM provider. One can have two mobile phones communicate
with the help of Bluetooth, external media cards, or the Internet. Thanks to the efforts of the
World Wide Web Consortium (W3C) and Open Mobile Alliance (OMA), being away from one’s
laptop does not mean being disconnected from the rest of the Internet world.
Objective of the Project
The objective of this project is to identify security holes and any missing security features
in Android’s architecture. Using this as a starting point, the goal is to develop a prototype
application that serves as a justification for our findings.
Order of the Project
Section 2 begins with a discussion of the Android security architecture and some of its
limitations. Section 3 briefly covers the security architecture of iPhone and Symbian, comparing
them with Android’s architecture. Section 4 lists some mobile phone risks, and Section 5 briefly
covers some of the best practices that users of smartphones should follow for their personal
security.
Introduction
Android is the mobile phone platform led by Google’s Open Handset Allowance (OHA).
Android has a unique security model in which the user is in complete control of the device. It is
an open source platform based on Linux. All applications are written in Java and compiled into a
custom byte-code (DEX) [6]. Each application executes in its own process with its own instance
of the Dalvik virtual machine interpreter [2].
Application behavior
Every application in Android runs as a separate process with a unique UID, unlike a
desktop computer where all the applications run with the same UID. The UID of an application
in Android protects its data. Programs cannot typically read or write each other’s data, and
sharing between applications must be done explicitly [3]. Due to this feature, a compromise such
as a buffer overflow attack [3,17] is restricted to the application and its data. However, it is
important to note that an application can launch another program that will run with the launching
application’s UID.
[attachment=28055]
Introduction
Mobile phones are no longer devices restricted to making voice callsthey can run most
of the processes that one expects from a desktop computer. Mobile phones are equipped with
applications such as e-mail clients, chat clients, short messaging service (SMS), and multimedia
messaging service (MMS). Most smartphones are equipped with cameras so that one can have
personal pictures and videos on the phone. Communication between two mobile devices is no
longer limited to the services of a GSM provider. One can have two mobile phones communicate
with the help of Bluetooth, external media cards, or the Internet. Thanks to the efforts of the
World Wide Web Consortium (W3C) and Open Mobile Alliance (OMA), being away from one’s
laptop does not mean being disconnected from the rest of the Internet world.
Objective of the Project
The objective of this project is to identify security holes and any missing security features
in Android’s architecture. Using this as a starting point, the goal is to develop a prototype
application that serves as a justification for our findings.
Order of the Project
Section 2 begins with a discussion of the Android security architecture and some of its
limitations. Section 3 briefly covers the security architecture of iPhone and Symbian, comparing
them with Android’s architecture. Section 4 lists some mobile phone risks, and Section 5 briefly
covers some of the best practices that users of smartphones should follow for their personal
security.
Introduction
Android is the mobile phone platform led by Google’s Open Handset Allowance (OHA).
Android has a unique security model in which the user is in complete control of the device. It is
an open source platform based on Linux. All applications are written in Java and compiled into a
custom byte-code (DEX) [6]. Each application executes in its own process with its own instance
of the Dalvik virtual machine interpreter [2].
Application behavior
Every application in Android runs as a separate process with a unique UID, unlike a
desktop computer where all the applications run with the same UID. The UID of an application
in Android protects its data. Programs cannot typically read or write each other’s data, and
sharing between applications must be done explicitly [3]. Due to this feature, a compromise such
as a buffer overflow attack [3,17] is restricted to the application and its data. However, it is
important to note that an application can launch another program that will run with the launching
application’s UID.