The Next Wave
External hardware is the next sidekick for smartphone security isolation
Originally designed as consumer devices, smartphones
have become vital elements of both our personal and
professional lives. Unfortunately, as sources and repositories
of our most sensitive data, smartphones
have quickly become a primary attack surface for
hackers, cybercriminals and foreign spies. According to recent media
stories of American intelligence reports, even the President of the
United States is not safe from mobile espionage.1
As a result, smartphone makers have implemented security isolation
within both the operating system (OS) and hardware, partitioning
the device’s apps and core processes as a means of limiting the
potential damage caused by malware. Despite attempts to insulate
critical data and functions from malicious outsiders, vulnerabilities at
the heart of these mobile devices continue to chip away at an organization’s
ability to protect its most important digital assets. The solution
to this intractable problem may come from an unlikely source:
external mobile hardware.
Wave 1: Isolation via the Operating System
Since the release of the app stores for both iOS (App Store) and
Android (Android Market, now Google Play) in 2008, smartphone
makers have implemented sandboxing as a means of security isolation,
both for backend analysis while screening apps as well as for app
isolation while running. A sandbox is an app’s restricted space within
the OS, acting as the environment for code execution and data storage
while also limiting the app’s access to system files and resources.
App permissions controlled by the user grant access to the device
features outside of the sandbox, including the user’s contacts, the device’s
location, its cameras and its microphones.
For Android, each app runs with a distinct user identity, with the OS enforcing security between apps and the system at the process
level. For iOS, each app runs as the same non-privileged user identity
but is assigned a unique home directory for its files.
Unfortunately, as hackers began to turn their attention to smartphones
as an entry point for attack, exploiting and fooling sandboxes
became the name of the game. Common techniques to bypass
different sandboxes have included delaying the execution of malware
in order to remain undetected during inspection, grabbing malicious
code after initial installation and abusing the user’s acceptance of
app permissions. Examples of mobile malware families using these
and other techniques to bypass sandbox protections go back for
years, from DroidDream (packaged inside legitimate applications)
to, more recently, Skygofree and Pegasus. Once their work is complete,
the attacker achieves root access, meaning total control over
the device and its data.
Wave 2: Isolation via the Processor
In response to the in-the-wild proliferation of increasingly intrusive
forms of mobile malware like rootkits and remote access Trojans
(RATs), smartphone makers began implementing isolation even
lower in the stack, at the hardware/firmware levels. One technique,
the trusted execution environment (TEE), is now prevalent on virtually
all modern smartphones. A TEE is an isolated execution environment—
typically containing security-critical code, data and processes—
that runs independently of the main, user-facing OS.
Approaches for establishing a TEE vary between platforms, manufacturers
and models. Most Android smartphones offer some version
of ARM’s TrustZone technology, which consists of two virtual
processors: a “secure” world for the security subsystem and a “nonsecure”
world for everything else. Apple, on the other hand, uses the
Secure Enclave, a coprocessor that is isolated from the main processor
and runs its own microkernel. In both cases, the TEE is relegated
to the same application processor or system on a chip (SoC) running
non-secure software, a necessity of the smartphone’s place as a
consumer device valued more for its functionality and size than its
security.
Unfortunately, the concept of TEE is based on a flawed assumption:
that the application processor or coprocessor hosting the TEE
cannot be bypassed by software—in other words, that any malware
on a user’s smartphone cannot access or modify the code, data or
processes that exist within the trusted portion of the TEE. An emerging
series of threats from the hardware and firmware underpinning
smartphones are poised to shatter this assumption.
Firmware bugs. Flaws in the design and implementation of the
firmware that is shipped with hardware – like the QuadRooter vulnerabilities
affecting Android devices built using Qualcomm chipsets—
can allow an attacker to trigger privilege escalation in order to gain
root access.
Supply chain attacks. Stealth actors have taken to disrupting chips
at the factory and in transit, usually by manipulating the firmware
controlling the chips. Such was the case with the batch of Android
devices that shipped with Loki malware, essentially giving an attacker
the ability to take total control of the device.
Speculative execution flaws. Nearly every type of processor in every
commercial device uses speculative execution—an optimization
technique in which tasks are performed based on predicted (speculative)
instructions—as a way of preventing delays. This technique’s
flaws, including the well-publicized Meltdown and Spectre vulnerabilities,
allows a rogue process to access what was thought to be
the isolated and protected memory of apps and the OS, exposing a
device’s most sensitive information, including passwords, digital keys
and more.
At the end of the day, commercial phones are by design, open
systems, which makes protecting against vulnerabilities in their architecture
and underlying hardware, especially as the basis for isolating
important data and processes, a futile proposition. Without the
ability to separate security logic and software from malware on the
same processor or SoC, an organization exposes itself to the risk of
capture and control of its most valuable digital resources.
Wave 3: Isolation via External Hardware
Chip-based exploits are on the rise, yet smartphone makers cannot
deliver isolation any lower in the stack. Consequently, external mobile
processing is the logical next wave for organizations looking to
truly isolate their most valuable information.
Imagine a tiny mobile computer packed in a familiar form factor,
like a smartphone case or watch. Using this device, you can do things
like authenticate to your organization’s online services, securely communicate
with approved peers and, for enterprise use cases such as
Assured Identity, optionally transmit sensor data back to a central
server for processing. Most importantly, because the device operates
independently of your smartphone and does not run third party code
(using code signing and other advanced techniques), malware does
not have an entry point for attack. This is the future of smartphone
security isolation.
While this product category of high-security, independent-processing
devices is not yet mainstream, it will be defined by a few hallmarks
going forward:
Convenient form factor. Users will be able to conveniently carry,
charge and interact with the device. For familiarity, a smartphone
case, watch or key fob make sense as form factors. Considerations
must be made for housing the electronic components, maintaining
battery life, gathering user input (via touchscreen or buttons)
and adding LEDs or other elements for notifying users. Wired or
wireless communication to the smartphone, which is treated as
untrusted in the threat model, can enable unique and compelling
functionality.
Trusted, secure, closed processing environment. The processor will
be designed to only run specific firmware, and strict authentication
practices will ensure that only validated and trusted firmware runs
on the device. A hardware root of trust (HRoT), based on a unique
hardware ID and private key, both generated and stored in silicon,
that become associated with a digital certificate during a secure provisioning
process, will serve as the basis for firmware authentication
during all boot, runtime and update processes.
High-security architecture. A closed/controlled public key infrastructure
(PKI) with a known trust issuer will be used to ensure that
secure, end-to-end encrypted communication to and from the device
only occurs with its integrated cloud infrastructure (for reporting,
policy management and firmware updates) and other trusted entities.
Extensibility. In addition to core processing and communications,
additional components, such as GPS modules, sensors, audio equipment,
etc., should be available and easily added to the device, depending
on the required applications. For example, built-in behavioral and
biometric sensors can be leveraged for continuous multi-factor authentication
(CMFA) solutions.
The path of external hardware isolation will unlock the door to
exciting opportunities for enterprises and government agencies looking
to take back control over their most important
information. Now is the time to break free
from the mobile vulnerable ecosystem and give
critical services the security they deserve.
This article originally appeared in the January/February 2019 issue of Security Today.