The Next Wave

The Next Wave

External hardware is the next sidekick for smartphone security isolation

Originally designed as consumer devices, smartphones have become vital elements of both our personal and professional lives. Unfortunately, as sources and repositories of our most sensitive data, smartphones have quickly become a primary attack surface for hackers, cybercriminals and foreign spies. According to recent media stories of American intelligence reports, even the President of the United States is not safe from mobile espionage.1 As a result, smartphone makers have implemented security isolation within both the operating system (OS) and hardware, partitioning the device’s apps and core processes as a means of limiting the potential damage caused by malware. Despite attempts to insulate critical data and functions from malicious outsiders, vulnerabilities at the heart of these mobile devices continue to chip away at an organization’s ability to protect its most important digital assets. The solution to this intractable problem may come from an unlikely source: external mobile hardware.

Wave 1: Isolation via the Operating System

Since the release of the app stores for both iOS (App Store) and Android (Android Market, now Google Play) in 2008, smartphone makers have implemented sandboxing as a means of security isolation, both for backend analysis while screening apps as well as for app isolation while running. A sandbox is an app’s restricted space within the OS, acting as the environment for code execution and data storage while also limiting the app’s access to system files and resources. App permissions controlled by the user grant access to the device features outside of the sandbox, including the user’s contacts, the device’s location, its cameras and its microphones.

For Android, each app runs with a distinct user identity, with the OS enforcing security between apps and the system at the process level. For iOS, each app runs as the same non-privileged user identity but is assigned a unique home directory for its files.

Unfortunately, as hackers began to turn their attention to smartphones as an entry point for attack, exploiting and fooling sandboxes became the name of the game. Common techniques to bypass different sandboxes have included delaying the execution of malware in order to remain undetected during inspection, grabbing malicious code after initial installation and abusing the user’s acceptance of app permissions. Examples of mobile malware families using these and other techniques to bypass sandbox protections go back for years, from DroidDream (packaged inside legitimate applications) to, more recently, Skygofree and Pegasus. Once their work is complete, the attacker achieves root access, meaning total control over the device and its data.

Wave 2: Isolation via the Processor

In response to the in-the-wild proliferation of increasingly intrusive forms of mobile malware like rootkits and remote access Trojans (RATs), smartphone makers began implementing isolation even lower in the stack, at the hardware/firmware levels. One technique, the trusted execution environment (TEE), is now prevalent on virtually all modern smartphones. A TEE is an isolated execution environment— typically containing security-critical code, data and processes— that runs independently of the main, user-facing OS.

Approaches for establishing a TEE vary between platforms, manufacturers and models. Most Android smartphones offer some version of ARM’s TrustZone technology, which consists of two virtual processors: a “secure” world for the security subsystem and a “nonsecure” world for everything else. Apple, on the other hand, uses the Secure Enclave, a coprocessor that is isolated from the main processor and runs its own microkernel. In both cases, the TEE is relegated to the same application processor or system on a chip (SoC) running non-secure software, a necessity of the smartphone’s place as a consumer device valued more for its functionality and size than its security.

Unfortunately, the concept of TEE is based on a flawed assumption: that the application processor or coprocessor hosting the TEE cannot be bypassed by software—in other words, that any malware on a user’s smartphone cannot access or modify the code, data or processes that exist within the trusted portion of the TEE. An emerging series of threats from the hardware and firmware underpinning smartphones are poised to shatter this assumption.

Firmware bugs. Flaws in the design and implementation of the firmware that is shipped with hardware – like the QuadRooter vulnerabilities affecting Android devices built using Qualcomm chipsets— can allow an attacker to trigger privilege escalation in order to gain root access.

Supply chain attacks. Stealth actors have taken to disrupting chips at the factory and in transit, usually by manipulating the firmware controlling the chips. Such was the case with the batch of Android devices that shipped with Loki malware, essentially giving an attacker the ability to take total control of the device.

Speculative execution flaws. Nearly every type of processor in every commercial device uses speculative execution—an optimization technique in which tasks are performed based on predicted (speculative) instructions—as a way of preventing delays. This technique’s flaws, including the well-publicized Meltdown and Spectre vulnerabilities, allows a rogue process to access what was thought to be the isolated and protected memory of apps and the OS, exposing a device’s most sensitive information, including passwords, digital keys and more.

At the end of the day, commercial phones are by design, open systems, which makes protecting against vulnerabilities in their architecture and underlying hardware, especially as the basis for isolating important data and processes, a futile proposition. Without the ability to separate security logic and software from malware on the same processor or SoC, an organization exposes itself to the risk of capture and control of its most valuable digital resources.

Wave 3: Isolation via External Hardware

Chip-based exploits are on the rise, yet smartphone makers cannot deliver isolation any lower in the stack. Consequently, external mobile processing is the logical next wave for organizations looking to truly isolate their most valuable information.

Imagine a tiny mobile computer packed in a familiar form factor, like a smartphone case or watch. Using this device, you can do things like authenticate to your organization’s online services, securely communicate with approved peers and, for enterprise use cases such as Assured Identity, optionally transmit sensor data back to a central server for processing. Most importantly, because the device operates independently of your smartphone and does not run third party code (using code signing and other advanced techniques), malware does not have an entry point for attack. This is the future of smartphone security isolation.

While this product category of high-security, independent-processing devices is not yet mainstream, it will be defined by a few hallmarks going forward:

Convenient form factor. Users will be able to conveniently carry, charge and interact with the device. For familiarity, a smartphone case, watch or key fob make sense as form factors. Considerations must be made for housing the electronic components, maintaining battery life, gathering user input (via touchscreen or buttons) and adding LEDs or other elements for notifying users. Wired or wireless communication to the smartphone, which is treated as untrusted in the threat model, can enable unique and compelling functionality.

Trusted, secure, closed processing environment. The processor will be designed to only run specific firmware, and strict authentication practices will ensure that only validated and trusted firmware runs on the device. A hardware root of trust (HRoT), based on a unique hardware ID and private key, both generated and stored in silicon, that become associated with a digital certificate during a secure provisioning process, will serve as the basis for firmware authentication during all boot, runtime and update processes.

High-security architecture. A closed/controlled public key infrastructure (PKI) with a known trust issuer will be used to ensure that secure, end-to-end encrypted communication to and from the device only occurs with its integrated cloud infrastructure (for reporting, policy management and firmware updates) and other trusted entities.

Extensibility. In addition to core processing and communications, additional components, such as GPS modules, sensors, audio equipment, etc., should be available and easily added to the device, depending on the required applications. For example, built-in behavioral and biometric sensors can be leveraged for continuous multi-factor authentication (CMFA) solutions.

The path of external hardware isolation will unlock the door to exciting opportunities for enterprises and government agencies looking to take back control over their most important information. Now is the time to break free from the mobile vulnerable ecosystem and give critical services the security they deserve.

This article originally appeared in the January/February 2019 issue of Security Today.

Featured

  • Security Today Announces The Govies Government Security Award Winners for 2025

    Security Today is pleased to announce the 2025 winners in The Govies Government Security Awards. The awards honor outstanding government security products in a variety of categories. Read Now

  • Survey: 60 Percent of Organizations Using AI in IT Infrastructure

    Netwrix, a cybersecurity provider focused on data and identity threats, today announced the release of its annual global 2025 Cybersecurity Trends Report based on a global survey of 2,150 IT and security professionals from 121 countries. It reveals that 60% of organizations are already using artificial intelligence (AI) in their IT infrastructure and 30% are considering implementing AI. Read Now

  • New Research Reveals Global Video Surveillance Industry Perspectives on AI

    Axis Communications, the global industry leader in video surveillance, has released its latest research report, ‘The State of AI in Video Surveillance,’ which explores global industry perspectives on the use of AI in the security industry and beyond. The report reveals current attitudes on AI technologies thanks to in-depth interviews with AI experts from Axis’ global network and a comprehensive survey of more than 5,800 respondents, including distributors, channel partners, and end customers across 68 countries. The resulting insights cover AI integration and the opportunities and challenges that exist with regard to security, safety, business intelligence, and operational efficiency. Read Now

  • SIA Urges Tariff Relief for Security Industry Products

    Today, the Security Industry Association has sent a letter to U.S. Trade Representative Jamieson Greer and U.S. Secretary of Commerce Howard Lutnick requesting relief from tariffs for security industry products and asking that the Trump administration formulate a process that allows companies to apply for product-specific exemptions. The security industry is an important segment of the U.S. economy, contributing over $430 billion in total economic impact and supporting over 2.1 million jobs. Read Now

  • Report Shows Cybercriminals Continue Pivot to Stealthier Tactics

    IBM recently released the 2025 X-Force Threat Intelligence Index highlighting that cybercriminals continued to pivot to stealthier tactics, with lower-profile credential theft spiking, while ransomware attacks on enterprises declined. IBM X-Force observed an 84% increase in emails delivering infostealers in 2024 compared to the prior year, a method threat actors relied heavily on to scale identity attacks. Read Now

New Products

  • Compact IP Video Intercom

    Viking’s X-205 Series of intercoms provide HD IP video and two-way voice communication - all wrapped up in an attractive compact chassis.

  • Automatic Systems V07

    Automatic Systems V07

    Automatic Systems, an industry-leading manufacturer of pedestrian and vehicle secure entrance control access systems, is pleased to announce the release of its groundbreaking V07 software. The V07 software update is designed specifically to address cybersecurity concerns and will ensure the integrity and confidentiality of Automatic Systems applications. With the new V07 software, updates will be delivered by means of an encrypted file.

  • Camden CV-7600 High Security Card Readers

    Camden CV-7600 High Security Card Readers

    Camden Door Controls has relaunched its CV-7600 card readers in response to growing market demand for a more secure alternative to standard proximity credentials that can be easily cloned. CV-7600 readers support MIFARE DESFire EV1 & EV2 encryption technology credentials, making them virtually clone-proof and highly secure.