The Next Wave
External hardware is the next sidekick for smartphone security isolation
Originally designed as consumer devices, smartphones have become vital elements of both our personal and professional lives. Unfortunately, as sources and repositories of our most sensitive data, smartphones have quickly become a primary attack surface for hackers, cybercriminals and foreign spies. According to recent media stories of American intelligence reports, even the president of the United States is not safe from mobile espionage.
As a result, smartphone makers have implemented security isolation within both the operating system (OS) and hardware, partitioning the device’s apps and core processes as a means of limiting the potential damage caused by malware. Despite attempts to insulate critical data and functions from malicious outsiders, vulnerabilities at the heart of these mobile devices continue to chip away at an organization’s ability to protect its most important digital assets. The solution to this intractable problem may come from an unlikely source: external mobile hardware.
Wave 1: Isolation via the Operating System
Since the release of the app stores for both iOS (App Store) and Android (Android Market, now Google Play) in 2008, smartphone makers have implemented sandboxing as a means of security isolation, both for backend analysis while screening apps as well as for app isolation while running. A sandbox is an app’s restricted space within the OS, acting as the environment for code execution and data storage while also limiting the app’s access to system files and resources. App permissions controlled by the user grant access to the device features outside of the sandbox, including the user’s contacts, the device’s location, its cameras and its microphones.
For Android, each app runs with a distinct user identity, with the OS enforcing security between apps and the system at the process level. For iOS, each app runs as the same non-privileged user identity but is assigned a unique home directory for its files.
Unfortunately, as hackers began to turn their attention to smartphones as an entry point for attack, exploiting and fooling sandboxes became the name of the game. Common techniques to bypass different sandboxes have included delaying the execution of malware in order to remain undetected during inspection, grabbing malicious code after initial installation and abusing the user’s acceptance of app permissions. Examples of mobile malware families using these and other techniques to bypass sandbox protections go back for years, from DroidDream (packaged inside legitimate applications) to, more recently, Skygofree and Pegasus. Once their work is complete, the attacker achieves root access, meaning total control over the device and its data.
Wave 2: Isolation via the Processor
In response to the in-the-wild proliferation of increasingly intrusive forms of mobile malware like rootkits and remote access Trojans (RATs), smartphone makers began implementing isolation even lower in the stack, at the hardware/firmware levels. One technique, the trusted execution environment (TEE), is now prevalent on virtually all modern smartphones. A TEE is an isolated execution environment—typically containing security-critical code, data and processes—that runs independently of the main, user-facing OS.
Approaches for establishing a TEE vary between platforms, manufacturers and models. Most Android smartphones offer some version of ARM’s TrustZone technology, which consists of two virtual processors: a “secure” world for the security subsystem and a “non-secure” world for everything else. Apple, on the other hand, utilizes the Secure Enclave, a coprocessor that is isolated from the main processor and runs its own microkernel. In both cases, the TEE is relegated to the same application processor or system on a chip (SoC) running non-secure software, a necessity of the smartphone’s place as a consumer device valued more for its functionality and size than its security.
Unfortunately, the concept of TEE is based on a flawed assumption: that the application processor or coprocessor hosting the TEE cannot be bypassed by software—in other words, that any malware on a user’s smartphone cannot access or modify the code, data or processes that exist within the trusted portion of the TEE. An emerging series of threats from the hardware and firmware underpinning smartphones are poised to shatter this assumption.
Firmware bugs. Flaws in the design and implementation of the firmware that is shipped with hardware – like the QuadRooter vulnerabilities affecting Android devices built using Qualcomm chipsets – can allow an attacker to trigger privilege escalation in order to gain root access.
Supply chain attacks. Stealth actors have taken to disrupting chips at the factory and in transit, usually by manipulating the firmware controlling the chips. Such was the case with the batch of Android devices that shipped with Loki malware, essentially giving an attacker the ability to take total control of the device.
Speculative execution flaws. Nearly every type of processor in every commercial device uses speculative execution – an optimization technique in which tasks are performed based on predicted (speculative) instructions – as a way of preventing delays. But this technique’s flaws, including the well-publicized Meltdown and Spectre vulnerabilities, allows a rogue process to access what was thought to be the isolated and protected memory of apps and the OS, exposing a device’s most sensitive information, including passwords, digital keys and more.
At the end of the day, commercial phones are by design, open systems, which makes protecting against vulnerabilities in their architecture and underlying hardware, especially as the basis for isolating important data and processes, a futile proposition. Without the ability to separate security logic and software from malware on the same processor or SoC, an organization exposes itself to the risk of capture and control of its most valuable digital resources.
Wave 3: Isolation via External Hardware
Chip-based exploits are on the rise, yet smartphone makers cannot deliver isolation any lower in the stack. Consequently, external mobile processing is the logical next wave for organizations looking to truly isolate their most valuable information.
Imagine a tiny mobile computer packed in a familiar form factor, like a smartphone case or watch. Using this device, you can do things like authenticate to your organization’s online services, securely communicate with approved peers and, for enterprise use cases such as Assured Identity, optionally transmit sensor data back to a central server for processing. Most importantly, because the device operates independently of your smartphone and does not run third party code (using code signing and other advanced techniques), malware does not have an entry point for attack. This is the future of smartphone security isolation.
While this product category of high-security, independent-processing devices is not yet mainstream, it will be defined by a few hallmarks going forward:
Convenient form factor. Users will be able to conveniently carry, charge and interact with the device. For familiarity, a smartphone case, watch or key fob make sense as form factors. Considerations must be made for housing the electronic components, maintaining battery life, gathering user input (via touchscreen or buttons) and adding LEDs or other elements for notifying users. Wired or wireless communication to the smartphone, which is treated as untrusted in the threat model, can enable unique and compelling functionality.
Trusted, secure, closed processing environment. The processor will be designed to only run specific firmware, and strict authentication practices will ensure that only validated and trusted firmware runs on the device. A hardware root of trust (HRoT)— based on a unique hardware ID and private key, both generated and stored in silicon, that become associated with a digital certificate during a secure provisioning process—will serve as the basis for firmware authentication during all boot, runtime and update processes.
High-security architecture. A closed/controlled public key infrastructure (PKI) with a known trust issuer will be used to ensure that secure, end-to-end encrypted communication to and from the device only occurs with its integrated cloud infrastructure (for reporting, policy management and firmware updates) and other trusted entities.
Extensibility. In addition to core processing and communications, additional components—such as GPS modules, sensors, audio equipment, etc.— should be available and easily added to the device, depending on the required applications. For example, built-in behavioral and biometric sensors can be leveraged for continuous multi-factor authentication (CMFA) solutions.
The path of external hardware isolation will unlock the door to exciting opportunities for enterprises and government agencies looking to take back control over their most important information. Now is the time to break free from the mobile vulnerable ecosystem and give critical services the security they deserve.