FCC offers security advice to smartphone users

IDG News Service - The U.S. Federal Communications Commission is advising smartphone users on how to protect their mobile devices and data from mobile security threats.

The Commission released an online tool called the "Smartphone Security Checker" on Tuesday that outlines a 10-step action plan that mobile users can follow to prevent their personal data from being exposed in case their devices get infected with malware or are lost, stolen or resold.

The tool provides recommendations including: locking access to the phone with PINs or passwords; avoiding changing the phone's factory security settings or rooting/jailbreaking the phone; backing up the phone data regularly in the cloud, on a computer or on a removable memory card; installing apps only from trusted sources and after checking their user reviews; reviewing and understanding the permissions requested by applications before installing them; installing the firmware updates issued by the manufacturer; installing security apps that allow remote locking and wiping of the phone; avoiding connecting to the Internet from untrusted wireless hotspots; wiping data from the phones before reselling; donating or recycling devices; and reporting stolen devices to the authorities and the operator for inclusion in a national database of stolen smartphones.

The recommendations were drafted by the FCC in collaboration with the U.S. Department of Homeland Security; the Federal Trade Commission; the National Cyber Security Alliance; CTIA, a wireless industry trade association; and other public and private sector partners including antivirus vendors and cybersecurity organizations.

The tool allows smartphone owners to choose their device's OS. The available options are Android, Apple iOS, BlackBerry and Windows Phone. The steps are the same for all types of devices for the most part, but depending on the OS choice they might include links to OS-specific instructions for performing certain recommended actions.

The FCC checklist is one of the most comprehensive sets of rules for safeguarding smartphone devices and data published so far, said Bogdan Botezatu, a senior e-threat analyst at antivirus vendor Bitdefender.

"However, some provisions, although they make sense 'on paper,' are impossible to control by the user," he said. "For instance, most smartphones cannot be updated because vendors do not provide any security fixes past the maximum Android version supported by the respective hardware. Android versions from 2.3 to 2.3.3 are vulnerable to a number of known bugs -- some of them quite severe, such as USSD attacks -- but mobile phone vendors and carriers have stopped update delivery. In this context, the user is forced to either put up with an unsecured device that can be exploited at any time or to root their gadget and manually update its firmware."