The Next Wave

The Next Wave

External hardware is the next sidekick for smartphone security isolation

Originally designed as consumer devices, smartphones have become vital elements of both our personal and professional lives. Unfortunately, as sources and repositories of our most sensitive data, smartphones have quickly become a primary attack surface for hackers, cybercriminals and foreign spies. According to recent media stories of American intelligence reports, even the President of the United States is not safe from mobile espionage.1 As a result, smartphone makers have implemented security isolation within both the operating system (OS) and hardware, partitioning the device’s apps and core processes as a means of limiting the potential damage caused by malware. Despite attempts to insulate critical data and functions from malicious outsiders, vulnerabilities at the heart of these mobile devices continue to chip away at an organization’s ability to protect its most important digital assets. The solution to this intractable problem may come from an unlikely source: external mobile hardware.

Wave 1: Isolation via the Operating System

Since the release of the app stores for both iOS (App Store) and Android (Android Market, now Google Play) in 2008, smartphone makers have implemented sandboxing as a means of security isolation, both for backend analysis while screening apps as well as for app isolation while running. A sandbox is an app’s restricted space within the OS, acting as the environment for code execution and data storage while also limiting the app’s access to system files and resources. App permissions controlled by the user grant access to the device features outside of the sandbox, including the user’s contacts, the device’s location, its cameras and its microphones.

For Android, each app runs with a distinct user identity, with the OS enforcing security between apps and the system at the process level. For iOS, each app runs as the same non-privileged user identity but is assigned a unique home directory for its files.

Unfortunately, as hackers began to turn their attention to smartphones as an entry point for attack, exploiting and fooling sandboxes became the name of the game. Common techniques to bypass different sandboxes have included delaying the execution of malware in order to remain undetected during inspection, grabbing malicious code after initial installation and abusing the user’s acceptance of app permissions. Examples of mobile malware families using these and other techniques to bypass sandbox protections go back for years, from DroidDream (packaged inside legitimate applications) to, more recently, Skygofree and Pegasus. Once their work is complete, the attacker achieves root access, meaning total control over the device and its data.

Wave 2: Isolation via the Processor

In response to the in-the-wild proliferation of increasingly intrusive forms of mobile malware like rootkits and remote access Trojans (RATs), smartphone makers began implementing isolation even lower in the stack, at the hardware/firmware levels. One technique, the trusted execution environment (TEE), is now prevalent on virtually all modern smartphones. A TEE is an isolated execution environment— typically containing security-critical code, data and processes— that runs independently of the main, user-facing OS.

Approaches for establishing a TEE vary between platforms, manufacturers and models. Most Android smartphones offer some version of ARM’s TrustZone technology, which consists of two virtual processors: a “secure” world for the security subsystem and a “nonsecure” world for everything else. Apple, on the other hand, uses the Secure Enclave, a coprocessor that is isolated from the main processor and runs its own microkernel. In both cases, the TEE is relegated to the same application processor or system on a chip (SoC) running non-secure software, a necessity of the smartphone’s place as a consumer device valued more for its functionality and size than its security.

Unfortunately, the concept of TEE is based on a flawed assumption: that the application processor or coprocessor hosting the TEE cannot be bypassed by software—in other words, that any malware on a user’s smartphone cannot access or modify the code, data or processes that exist within the trusted portion of the TEE. An emerging series of threats from the hardware and firmware underpinning smartphones are poised to shatter this assumption.

Firmware bugs. Flaws in the design and implementation of the firmware that is shipped with hardware – like the QuadRooter vulnerabilities affecting Android devices built using Qualcomm chipsets— can allow an attacker to trigger privilege escalation in order to gain root access.

Supply chain attacks. Stealth actors have taken to disrupting chips at the factory and in transit, usually by manipulating the firmware controlling the chips. Such was the case with the batch of Android devices that shipped with Loki malware, essentially giving an attacker the ability to take total control of the device.

Speculative execution flaws. Nearly every type of processor in every commercial device uses speculative execution—an optimization technique in which tasks are performed based on predicted (speculative) instructions—as a way of preventing delays. This technique’s flaws, including the well-publicized Meltdown and Spectre vulnerabilities, allows a rogue process to access what was thought to be the isolated and protected memory of apps and the OS, exposing a device’s most sensitive information, including passwords, digital keys and more.

At the end of the day, commercial phones are by design, open systems, which makes protecting against vulnerabilities in their architecture and underlying hardware, especially as the basis for isolating important data and processes, a futile proposition. Without the ability to separate security logic and software from malware on the same processor or SoC, an organization exposes itself to the risk of capture and control of its most valuable digital resources.

Wave 3: Isolation via External Hardware

Chip-based exploits are on the rise, yet smartphone makers cannot deliver isolation any lower in the stack. Consequently, external mobile processing is the logical next wave for organizations looking to truly isolate their most valuable information.

Imagine a tiny mobile computer packed in a familiar form factor, like a smartphone case or watch. Using this device, you can do things like authenticate to your organization’s online services, securely communicate with approved peers and, for enterprise use cases such as Assured Identity, optionally transmit sensor data back to a central server for processing. Most importantly, because the device operates independently of your smartphone and does not run third party code (using code signing and other advanced techniques), malware does not have an entry point for attack. This is the future of smartphone security isolation.

While this product category of high-security, independent-processing devices is not yet mainstream, it will be defined by a few hallmarks going forward:

Convenient form factor. Users will be able to conveniently carry, charge and interact with the device. For familiarity, a smartphone case, watch or key fob make sense as form factors. Considerations must be made for housing the electronic components, maintaining battery life, gathering user input (via touchscreen or buttons) and adding LEDs or other elements for notifying users. Wired or wireless communication to the smartphone, which is treated as untrusted in the threat model, can enable unique and compelling functionality.

Trusted, secure, closed processing environment. The processor will be designed to only run specific firmware, and strict authentication practices will ensure that only validated and trusted firmware runs on the device. A hardware root of trust (HRoT), based on a unique hardware ID and private key, both generated and stored in silicon, that become associated with a digital certificate during a secure provisioning process, will serve as the basis for firmware authentication during all boot, runtime and update processes.

High-security architecture. A closed/controlled public key infrastructure (PKI) with a known trust issuer will be used to ensure that secure, end-to-end encrypted communication to and from the device only occurs with its integrated cloud infrastructure (for reporting, policy management and firmware updates) and other trusted entities.

Extensibility. In addition to core processing and communications, additional components, such as GPS modules, sensors, audio equipment, etc., should be available and easily added to the device, depending on the required applications. For example, built-in behavioral and biometric sensors can be leveraged for continuous multi-factor authentication (CMFA) solutions.

The path of external hardware isolation will unlock the door to exciting opportunities for enterprises and government agencies looking to take back control over their most important information. Now is the time to break free from the mobile vulnerable ecosystem and give critical services the security they deserve.

This article originally appeared in the January/February 2019 issue of Security Today.

Featured

  • Cloud Adoption Gives Way to Hybrid Deployments

    Cloud adoption is growing at an astonishing rate, with Gartner forecasting that worldwide public cloud end-user spending will approach $600 billion by the end of this year—an increase of more than 21% over 2022. McKinsey believes that number could eclipse $1 trillion by the end of the decade, further underscoring the industry’s exponential growth. Read Now

  • AI on the Edge

    Discussions about the merits (or misgivings) around AI (artificial intelligence) are everywhere. In fact, you’d be hard-pressed to find an article or product literature without mention of it in our industry. If you’re not using AI by now in some capacity, congratulations may be in order since most people are using it in some form daily even without realizing it. Read Now

  • Securing the Future

    In an increasingly turbulent world, chief security officers (CSOs) are facing a multitude of challenges that threaten the stability of businesses worldwide. Read Now

    • Guard Services
  • Security Entrances Move to Center Stage

    Most organizations want to show a friendly face to the public. In today’s world, however, the need to keep people safe and secure has become a prime directive when designing and building facilities of all kinds. Fortunately, there is no need to construct a fortress-like entry that provides that high level of security. Today’s secured entry solutions make it possible to create a welcoming, attractive look and feel at the entry without compromising security. It is for this reason that security entrances have moved to the mainstream. Read Now

Featured Cybersecurity

Webinars

New Products

  • Connect ONE’s powerful cloud-hosted management platform provides the means to tailor lockdowns and emergency mass notifications throughout a facility – while simultaneously alerting occupants to hazards or next steps, like evacuation.

    Connect ONE®

    Connect ONE’s powerful cloud-hosted management platform provides the means to tailor lockdowns and emergency mass notifications throughout a facility – while simultaneously alerting occupants to hazards or next steps, like evacuation. 3

  • Mobile Safe Shield

    Mobile Safe Shield

    SafeWood Designs, Inc., a manufacturer of patented bullet resistant products, is excited to announce the launch of the Mobile Safe Shield. The Mobile Safe Shield is a moveable bullet resistant shield that provides protection in the event of an assailant and supplies cover in the event of an active shooter. With a heavy-duty steel frame, quality castor wheels, and bullet resistant core, the Mobile Safe Shield is a perfect addition to any guard station, security desks, courthouses, police stations, schools, office spaces and more. The Mobile Safe Shield is incredibly customizable. Bullet resistant materials are available in UL 752 Levels 1 through 8 and include glass, white board, tack board, veneer, and plastic laminate. Flexibility in bullet resistant materials allows for the Mobile Safe Shield to blend more with current interior décor for a seamless design aesthetic. Optional custom paint colors are also available for the steel frame. 3

  • PE80 Series

    PE80 Series by SARGENT / ED4000/PED5000 Series by Corbin Russwin

    ASSA ABLOY, a global leader in access solutions, has announced the launch of two next generation exit devices from long-standing leaders in the premium exit device market: the PE80 Series by SARGENT and the PED4000/PED5000 Series by Corbin Russwin. These new exit devices boast industry-first features that are specifically designed to provide enhanced safety, security and convenience, setting new standards for exit solutions. The SARGENT PE80 and Corbin Russwin PED4000/PED5000 Series exit devices are engineered to meet the ever-evolving needs of modern buildings. Featuring the high strength, security and durability that ASSA ABLOY is known for, the new exit devices deliver several innovative, industry-first features in addition to elegant design finishes for every opening. 3