Page 46 - Security Today, January/February 2019

OS enforcing security between apps and the system at the process level. For iOS, each app runs as the same non-privileged user identity but is assigned a unique home directory for its files.
Unfortunately, as hackers began to turn their attention to smart- phones as an entry point for attack, exploiting and fooling sand- boxes became the name of the game. Common techniques to bypass different sandboxes have included delaying the execution of malware in order to remain undetected during inspection, grabbing malicious code after initial installation and abusing the user’s acceptance of app permissions. Examples of mobile malware families using these and other techniques to bypass sandbox protections go back for years, from DroidDream (packaged inside legitimate applications) to, more recently, Skygofree and Pegasus. Once their work is com- plete, the attacker achieves root access, meaning total control over the device and its data.
Wave 2: Isolation via the Processor
In response to the in-the-wild proliferation of increasingly intrusive forms of mobile malware like rootkits and remote access Trojans (RATs), smartphone makers began implementing isolation even lower in the stack, at the hardware/firmware levels. One technique, the trusted execution environment (TEE), is now prevalent on virtu- ally all modern smartphones. A TEE is an isolated execution envi- ronment—typically containing security-critical code, data and pro- cesses—that runs independently of the main, user-facing OS.
Approaches for establishing a TEE vary between platforms, man- ufacturers and models. Most Android smartphones offer some ver- sion of ARM’s TrustZone technology, which consists of two virtual processors: a “secure” world for the security subsystem and a “non- secure” world for everything else. Apple, on the other hand, uses the Secure Enclave, a coprocessor that is isolated from the main proces- sor and runs its own microkernel. In both cases, the TEE is relegated to the same application processor or system on a chip (SoC) run- ning non-secure software, a necessity of the smartphone’s place as a consumer device valued more for its functionality and size than its security.
Unfortunately, the concept of TEE is based on a flawed assump- tion: that the application processor or coprocessor hosting the TEE cannot be bypassed by software—in other words, that any malware on a user’s smartphone cannot access or modify the code, data or processes that exist within the trusted portion of the TEE. An emerg- ing series of threats from the hardware and firmware underpinning smartphones are poised to shatter this assumption.
Firmware bugs. Flaws in the design and implementation of the firmware that is shipped with hardware – like the QuadRooter vulner- abilities affecting Android devices built using Qualcomm chipsets— can allow an attacker to trigger privilege escalation in order to gain root access.
Supply chain attacks. Stealth actors have taken to disrupting chips at the factory and in transit, usually by manipulating the firmware controlling the chips. Such was the case with the batch of Android devices that shipped with Loki malware, essentially giving an attacker the ability to take total control of the device.
Speculative execution flaws. Nearly every type of processor in ev- ery commercial device uses speculative execution—an optimization technique in which tasks are performed based on predicted (specula- tive) instructions—as a way of preventing delays. This technique’s flaws, including the well-publicized Meltdown and Spectre vulner- abilities, allows a rogue process to access what was thought to be the isolated and protected memory of apps and the OS, exposing a device’s most sensitive information, including passwords, digital keys and more.
At the end of the day, commercial phones are by design, open
systems, which makes protecting against vulnerabilities in their ar- chitecture and underlying hardware, especially as the basis for isolat- ing important data and processes, a futile proposition. Without the ability to separate security logic and software from malware on the same processor or SoC, an organization exposes itself to the risk of capture and control of its most valuable digital resources.
Wave 3: Isolation via External Hardware
Chip-based exploits are on the rise, yet smartphone makers cannot deliver isolation any lower in the stack. Consequently, external mo- bile processing is the logical next wave for organizations looking to truly isolate their most valuable information.
Imagine a tiny mobile computer packed in a familiar form factor, like a smartphone case or watch. Using this device, you can do things like authenticate to your organization’s online services, securely com- municate with approved peers and, for enterprise use cases such as Assured Identity, optionally transmit sensor data back to a central server for processing. Most importantly, because the device operates independently of your smartphone and does not run third party code (using code signing and other advanced techniques), malware does not have an entry point for attack. This is the future of smartphone security isolation.
While this product category of high-security, independent-pro- cessing devices is not yet mainstream, it will be defined by a few hall- marks going forward:
Convenient form factor. Users will be able to conveniently carry, charge and interact with the device. For familiarity, a smartphone case, watch or key fob make sense as form factors. Considerations must be made for housing the electronic components, maintain- ing battery life, gathering user input (via touchscreen or buttons) and adding LEDs or other elements for notifying users. Wired or wireless communication to the smartphone, which is treated as untrusted in the threat model, can enable unique and compelling functionality.
Trusted, secure, closed processing environment. The processor will be designed to only run specific firmware, and strict authentication practices will ensure that only validated and trusted firmware runs on the device. A hardware root of trust (HRoT), based on a unique hardware ID and private key, both generated and stored in silicon, that become associated with a digital certificate during a secure pro- visioning process, will serve as the basis for firmware authentication during all boot, runtime and update processes.
High-security architecture. A closed/controlled public key infra- structure (PKI) with a known trust issuer will be used to ensure that secure, end-to-end encrypted communication to and from the device only occurs with its integrated cloud infrastructure (for reporting, policy management and firmware updates) and other trusted entities.
Extensibility. In addition to core processing and communications, additional components, such as GPS modules, sensors, audio equip- ment, etc., should be available and easily added to the device, depend- ing on the required applications. For example, built-in behavioral and biometric sensors can be leveraged for continuous multi-factor au- thentication (CMFA) solutions.
The path of external hardware isolation will unlock the door to exciting opportunities for enterprises and government agencies look- ing to take back control over their most impor-
tant information. Now is the time to break free
from the mobile vulnerable ecosystem and give critical services the security they deserve.
Mike Fong is the founder and CEO of Privoro. 1 https://www.nytimes.com/2018/10/24/us/politics/
trump-phone-security.html
26
JANUARY/FEBRUARY 2019 | SECURITY TODAY
MOBILE APPS TECHNOLOGY