Network World - The meteoric rise in the smartphone market is creating a dangerous vulnerability in smartphone security - one that may not be patched until the problem expands into what has been dubbed an "apocalypse."
Dan Auerbach, a staff technologist at the Electronics Frontier Foundation, points to outdated encryption standards and the inherent vulnerabilities of the baseband processor found on modern smartphones as the makings for a security hole through which users can be exploited at large.
The situation is similar to the PC boom of the late 1990s, Auerbach says. Just as PCs were designed to communicate freely with any and all network elements at the time, the baseband processors found on many of today's smartphones interact with any base station with which they come into contact.
At the same time, "the cost of having portable base stations has decreased quite a bit," Auerbach says. This has already enabled some police-state government agencies to create false base stations to monitor cellphone communications, he added.
"So you have just kind of a fake base station, and then you get a user's cellphone to interact with that instead of the real base station," Auerbach says.
This idea is known as the "baseband apocalypse," and it is nothing new. At last year's Black Hat DC Conference, security researcher Ralf-Philipp Weinmann presented the vulnerability and warned that new open source tools for establishing mobile base stations will make smartphones easier to exploit than in the past, when the code for base stations was retained by the service providers that managed them.
What's scarier, though, is that smartphone developers since have focused on features like user interface and screen resolution, as opposed to fixing a fundamental vulnerability that has been public knowledge for at least the past 16 months, Auerbach says. The Global System for Mobile Communications (GSM) standard for 3G cellphones still employs the A5/1 encryption algorithm, which Auerbach says is "incredibly broken" and "basically worthless." Indeed, the industry has been aware of an attack against A5/1 that can intercept voice and text communications since 2009.
"So, in light of that, controlling the base station and the network elements really does give you access to users' communications," Auerbach says.
Another similarity between the mobile industry of today and the PC security outlook at the turn of the century is that OEMs and mobile carriers have no incentive to secure this vulnerability during the product development life cycle, Auerbach says. The faster smartphones are developed and pushed out to market, the more money companies like Qualcomm and Apple stand to make. With the way the smartphone market has grown lately, they likely won't be slowing down any time soon - a recent IDC report showed 42.5% year-over-year growth in worldwide smartphone shipments in the first quarter of 2012.
- Assessing ROI for Mobile Acceleration Clients This EMA® paper examines the business case for deploying mobile WAN optimization client software and builds a ROI model based on the experiences...
- The Apple-ization of the Enterprise: Understanding IT's New World Read this paper for how to tackle Apple-ization (and the related consumerization of IT and Bring Your Own Device/BYOD).
- A Practical Introduction to Enterprise Mobility Management Read the white paper to better understand the basic concepts within mobility management and to learn how you can apply EMM technology to...
- Enterprise Mobility: A Checklist for Secure Containerization The advantages and disadvantages of the multiple approaches to containerization. Learn More>>
- On-demand webinar: "Mobility Mayhem: Balancing BYOD with Enterprise Security" Check out this on-demand webinar to hear Sophos senior security expert John Shier deep dive into how BYOD impacts your enterprise security strategy...
- Mobile Security: Containerizing Enterprise Data In this on-demand webinar, Fixmo's Lee Cocking, VP of corporate strategy, explains why Apple-ization trends like mobility and "bring-your-own-device" (BYOD) are driving the... All Mobile/Wireless White Papers | Webcasts
Our new weekly Consumerization of IT newsletter covers a wide range of trends including BYOD, smartphones, tablets, MDM, cloud, social and what it all means for IT. Subscribe now and stay up to date!