From mobile phones to responsible devices

Abstract

Mobile phones have evolved from simple voice terminals into highly-capable, general-purpose computing platforms. While people are becoming increasingly more dependent on such devices to perform sensitive operations, protect secret data, and be available for emergency use, it is clear that phone operating systems are not ready to become mission-critical systems. Through a pair of vulnerabilities and a simulated attack on a cellular network, we demonstrate that there are a myriad of unmanaged mechanisms on mobile phones, and that control of these mechanisms is vital to achieving reliable use. Through such vectors, mobile phones introduce a variety of new threats to their own applications and the telecommunications infrastructure itself. In this paper, we examine the requirements for providing effective mediation and access control for mobile phones. We then discuss the convergence of cellular networks with the Internet and its impact on effective resource management and quality of service. Based on these results, we argue for user devices that enable predictable behavior in a network-where their trusted computing bases can protect key applications and create predictable network impact.

Is Granting Permissions to Applications an Informed Decision?

“…Thereupon, by granting these permissions, users deliberately circumvent some of the access control mechanisms of their smartphones and become dependent on the good will or on the malicious intentions of developers, which may prove harmful. Similar concerns over the malicious potential of mobile phones were raised by [13].…”

Taming Mr Hayes: Mitigating signaling based attacks on smartphones

“…Traynor et al summarize in [28] the lack of security features on mobile and smartphones and discuss possible solutions. Part of their work presents SELinux [18] as means of access control of system resources.…”

Software security aspects of Java-based mobile phones

“…There exist works concerning vulnerabilities of mobile phones [19,25,30,31]. Some vulnerabilities are caused by the interaction between mobile devices, the Internet, and telecommunications networks [31].…”

“…Up to now, however, end users do not seem to be prepared for attacks on mobile phones, although some reports on hacking mobile phones already exist, e.g., [19,25,30]. In the future, it can be expected that the rate of security incidents will rise because of the increasing attractiveness of the attack target "mobile phone" [10].…”