Microsoft Word - 108-114_274 (Online) ISSN 2744-1741 Defense and Security Studies Original Research Vol. 5, No. 2, 2024, pp. 108-114 https://doi.org/10.37868/dss.v5.id274 This work is licensed under a Creative Commons Attribution License (https://creativecommons.org/licenses/by/4.0/) that allows others to share and adapt the material for any purpose (even commercially), in any medium with an acknowledgement of the work's authorship and initial publication in this journal. 108 Security considerations for smartphone devices Almina Musinbegovic1, Harun Alijagic1, Amer Hrnjic1, Ali Abd Almisreb1* 1 Computer Sciences, Faculty of Engineering and Natural Sciences, International University of Sarajevo, Bosnia and Herzegovina *Corresponding author E-mail: aalmisreb@ius.edu.ba Received: Nov. 6, 2024 Revised: Dec. 8, 2024 Accepted: Dec. 10, 2024 Online: Dec 15, 2024 Abstract In the paper, the ways in which smartphone devices are designed to be secure are investigated. Different approaches were examined for Windows, Android, and alike, as well as diving into the three security layers or areas of security. The first layer investigated was a “physical” device protection which involves the protection of the device and the data on it in case the device was stolen by not allowing anyone to gain access to the device, and locking its content. The second protection of the data examined was not allowing applications on the device access to corporate and personal data. The last layer of the protection investigated was in-app information being leaked and otherwise used. Security objectives and mechanisms were also visited in the paper. A literature review on the subject is provided. © The Author 2024. Published by ARDA. Keywords: Computer network reliability surveillance, Communication system security, smartphone protection 1. Introduction It is important to point out why smartphone security is so important. We take for granted the technology we have and rarely worry about its communication system security. The pictures we have stored on our devices as well as various passwords or bank card details are all vulnerable to all kinds of hacks. Not to mention the soft version of hacks which would be the constant attempts by our apps and companies to gather as much information about us as possible. Be that directly or indirectly our personal information is always under surveillance. Although we might not experience being hacked ourselves one can see the liability carried by companies if they are ever undermined by hackers or thieves, as this would reflect poorly on their computer network reliability. In essence, companies have a vested interest in protecting their users and invest a lot of resources to build their devices/software to be secure. In order for us to know what exact problems should be considered we must first look at how users use their mobile devices. Which tasks do they want to perform and how they perceive the security and privacy of these devices? Are they comfortable using them for sensitive tasks? How do mobile devices compare with laptop and desktop devices in terms of privacy and security? Knowing what users consider useful and necessary in mobile devices allows us to better understand and prevent mistakes from happening. A smartphone is a mobile phone that is created to offer new advanced features that are useful for its users. In a short time, it became the most useful phone in the world because of its advanced computing ability and DSS Vol. 5, No.2, 2024, pp. 108-114 109 connectivity. One of the best features of a smartphone is installing and running more advanced applications based on a specific platform by using a Wi-Fi internet connection [1][2]. The usage of smartphones requires some of information about the user that be stored to check the user’s identity [2]. It looks like secured, but how the security of smartphones is managed? Is the user’s information as safe as it looks? Today, malware and data leakage are the most worrying harms of smartphone users. Because of these kinds of problems, the users’ laxity appears and puts security organizations at risk.[3] The centralized application delivery architecture is a good and available way for attackers to attack the security and privacy of smartphones. The security sometimes is weak because application checking mechanisms are often not in place and users may choose which protected resources are accessible by third-party applications created by developers [4][5]. Most webpages like social networks (Facebook, Instagram, etc.) store user’s ID and password to verify the right user. 1.1. Security objectives To keep a system secured, the types of vulnerabilities, that may damage the security of a system, need to be considered. They may be considered by security objectives: confidentiality, integrity, and availability. Confidentiality determines who may access or not to what. Integrity orders who are allowed to manage or use certain resources. Availability describes the request from a legitimate owner to use some resource [1][6]. Many companies use antivirus software to prevent the appearance of viruses and other threats [7]. 1.2. Security mechanisms Three mechanisms are realized: • System Modification: requires changing the platform’s core source code including the kernel. • System add-on: requires managing of platform’s core configuration file. Add-on means to install appropriate applications for smartphones. • Add-on Applications: mostly applied by the user by installing and updating (add-on) applications. Other applicable mechanisms are an anti-virus solution, Firewall, Secure API, Access Control, Authentication, Spam Filter, Pre-Testing, Regular Update, and Remote Access Control [1][8]. 1.3. Keeping smartphone safety User may keep his/her smartphone safe by using the following steps: • Guard his/her phone, and set PINs and passwords, • Take safety in case his/her phone is lost or stolen, • The user should not override his/her smartphone’s security settings, • Backing up and securing his/her data, • Installing applications from trusted and safe sources, • Using of antivirus software, • Using software to find or erase his/her phone data if he/she loses a phone, • Clearing his/her phone before dispensing with it, • Accepting updates and patches [9], • The benefits of smartphones attract hackers to try to hack and take information from users. Because of that, smartphone security and privacy always need to be updated to provide better security for users [10]. 2. Literature review With the sudden advance in hardware and software capabilities of smartphones, came the seemingly same set of security issues as with desktop computers, especially considering that smartphones have access to the internet where viruses and various other forms of attack can be performed [11][12]. Smartphone security problems can, arbitrarily, be classified into several categories: Authentication, Data Protection and Privacy, Vulnerabilities, and Attacks. These will be discussed in separate sections in the following. DSS Vol. 5, No.2, 2024, pp. 108-114 110 2.1. Authentication problem The authentication method is one in which the owner is confirmed using one of several methods. Using a password that one inputs when accessing the device, a token password like a set of nodes pressed a specific way or biometrics such as a fingerprint or iris. Wei-Han in his research proposed a system where the authentication is implicit. The system learns the user’s behavior pattern in the background continuously updating itself without disturbing the user. This method has been shown to be very effective, being able to detect abnormal behavior within 20 seconds of use with 90- 95% accuracy [13]. Zahid et al. [14] proposed a user identification system to monitor mobile phone key users to distinguish authentic customers from quacks dynamically. The authors used a 25-user data set that only gave a fault of a rate of less than 2%. Chine-Cheng et al. suggested also a non-intrusive authentication method that collects user data in the background using the device's sensors. The method uses stepwise linear regression to select features of each user the data is then classified using the k-nearest neighbor algorithm. The results show an error rate of 6.85%. The authors concluded that this method can be combined with intrusive methods like PIN or password to maximize smartphone security [15]. Morris in his research worked on combining multiple authentication methods [16]. There could be implemented SIMs that allow the user access to the network, without which no traffic can pass to the mobile device which would stop most if not all web-based attacks. 2.1.1. Data protection and privacy Boshmaf et al. [17] in their studies addressed the problem of data protection. In his analysis, he found that indeed users want to protect their data but often find it inconvenient to do so practically using solutions available today. Muslokhlove analyzed the problems of data protection against physical threats and what can be done to combat them. He found that there exist several vulnerabilities in detecting malicious data and when the device falls into the wrong hands. He concluded these issues might for the most part be fixed by updating the lock screen and authentication methods [18]. 2.2. Vulnerabilities There exist several types of vulnerabilities that have been described in smartphone devices [19]. These vulnerabilities can be exploited by malicious attackers to gain access to or destroy smartphone devices. Smartphone vulnerabilities can be split into: System faults, bad application management, insecure networks, and user unawareness. 2.2.1. System fault When designing any device it is very likely that some hardware and software defects will be left unchecked as it can sometimes be very difficult to find them without extensive use, which is why they are often found only when something has already gone wrong. Software faults can, generally, be easily fixed when found but hardware ones often cost a lot more to fix. These defects when found by the wrong may obviously be exploited. 2.2.2. Bad app managemanet Smartphone devices have very flexible APIs which allow for application development, however, this also means that they can be infected with malicious code from said applications. When installing third-party applications these apps might demand high privileges that might update or change system files. Attackers might exploit the control and privileges that they might gain. 2.2.3. Insecure network When using Wi-Fi, Bluetooth, or GPS to connect with any network, a hacker might attempt to retrieve data packets from our device if on the same network. These vulnerabilities can be overcome with various encryption/decryption methods. DSS Vol. 5, No.2, 2024, pp. 108-114 111 2.2.4. Lack of user awareness No matter how much security methods become well there will always be a looming threat of users being jinxed into doing something they shouldn’t. Although it’s not easy to think up ways to trick someone these days it still can be done. There are many emails we receive that say they do one thing but pressing a link they provide might in fact do something entirely different that might be malicious. Many unacquainted with malicious code have been tricked and will continuously be tricked until awareness is raised. 2.3. Attacks There are various ways in which a device could be attacked but they can be subdivided into groups according to their implementation and methodology, although most of them are similar if not the same as those used on desktop and laptop devices. • Physical attacks: Smartphone devices can be stolen in which case this is considered a physical attack and for the most part responsibility for this does not fall on the manufacturer and there is little they can do to prevent it, but there are ways to find lost or stolen devices. • Rebooting attack: When stolen a smartphone device may be accessed with a cold boot, if the information and passwords etc. of the previous user are lost the device can be made to act as if it were newly bought, there exist ways to prevent this but exploits still exist. The following attacks can be classified into malware, or software designed to do something malicious to the device: • Backdoor attack: This attack is when a hacker tries to establish a connection with the device whilst not being detected. Once the attacker gains access to the system he/she may for the most part do anything the regular user might do including extracting data. These attacks happen most often due to an unhandled exploit in the hardware/software with which the authentication process can be bypassed [20]. • Virus attacks: These are scripts designed to infect files, what they do exactly may vary but for the most part they simply make replicates of themselves thus bogging the system down to a crawl [21]. There are ways to detect viruses by continuously analyzing computer activity and network communications for abnormal behavior. • Worm attacks: Worms are software that tries to send copies of itself from one device to another and much like viruses may also have another purpose to execute when it gets to a device [21]. • Trojan: This is a program most famously associated with malware, it is on the surface some sort of useful program or has an otherwise uneventful function but hidden in its code are malicious abilities. For the same reason, they remain very hard to detect as other malware’s activity may immediately be spotted as unusual, a Trojan may remain dormant for some time thus evading detection. Houmansadr et al. [22] suggested that a cloud-based engine should be made that does a detailed detection on a smartphone device, finding and erasing any threat. • Spam attack: Spam is a very common form of attack that sends a massive amount of requests or emails that have attached some other malware program. In essence, it is a method of transporting viruses or worms and is often used in hand in hand with other attacks [23]. Whereas previous malware was somewhat passive, that being a program already made and then spread the following are active attacks where the attacker is presently attempting to gain access: • Brute force attack: The attacker tries to gain access to the device by literally finding out the authentication information. The brute force attack can be further split into an informed and uninformed where an informed attack might use various sets of words from a dictionary or personal information about the user, an uninformed attack tries random combinations until it succeeds. Naturally, this takes a very long time and lots of processing power. • Denial of service attack: This attack attempts to stop the user from using Wi-Fi by replacing the original connection with one that just occupies the bandwidth but does nothing essentially. It was proposed by Dondyk and Zou [24] and they have shown that most iPhone and Android devices DSS Vol. 5, No.2, 2024, pp. 108-114 112 were susceptible to this attack. A solution that was also proposed by them was to create an extra protocol where in order to authenticate the network the smartphone device sends a key password using cellular connection to the internet after which it tries to recover the same key using the Wi- Fi network. The protocol has already been tested on Android devices. • SMS attack: Much like spam attacks SMS messages can be used to send links that might contain malware many operators allow sending credit using SMS messages which present a vulnerability that might be exploited. • USB connection attack: USB connections can house various malware which might transfer itself onto a smartphone device there are ways already implemented to prevent USB root access and also to detect if the particular USB connection has risks [25]. • Camera vulnerabilities: Since almost all smartphone devices have cameras, they have opened a new sphere of possible attacks. There are many applications that demand access to the smartphone camera and some of these might execute malicious operations by running the camera or extracting photos. Much of the same issues are shared with sound applications that might take access to the device's microphone. • Control flow attacks: Attacks that attempt to control which code is executed and have become common. A framework was provided to counteract this attack by monitoring contradicting flow control attempts [8][26]. There are other important research regarding this topic, for example papers [30][31][32][33][34][35], with valuable insights. 3. Discussions The first question that appears in our work is:” What does smartphone security mean?”. Mobile security refers to the effort to secure data on mobile devices such as smartphones and tablets [27]. The next question is:” Do we have a need for smartphone security in our devices?”. The answer is very obvious. Yes, the security of our mobile devices has priority over all other needs nowadays. Nowadays most of our personal information and data (photos, videos, contacts, etc.) are stored on our smartphones, or through our smartphones we can access them. According to the FBI, more than 4,000 ransomware attack occurred on daily base in 2016. That was a 300 percent increase compared to 2015. If we consider technological improvement and expansion of the smartphone market, we can assume that today we have 15,000 to 20,000 attacks daily [28]. Also, according to Kaspersky Lab Android is the most frequently OS for malware attacks in the mobile world and the second most targeted platform, right after Windows [29]. This information is very worrying because now we see how easily we may be finished as the target of a potential attack. If you ask if is there any solution to this problem, yes there is. Actually, there are a lot of solutions for improving the security of your phone and your data, as we already mentioned before [1][8]. Some journalists conducted research about reasons why hackers make malware. According to Kayla Matthews, top five reasons are: • Eavesdrop on calls • Steal money • Blackmail people • Damage your phone • Threaten national security. 4. Conclusions We can conclude that mobile security is very important nowadays. We use mobiles on a daily base, hold our information and data, and communicate over them. Malware and ransomware may cause problems in usage or even worse, they may cause leaking of information and data. We may finish as victims of blackmail or theft. We need to be aware of the danger that smartphones bring with their advantages. People need to understand DSS Vol. 5, No.2, 2024, pp. 108-114 113 all potential threats and act at the right time. We need to educate ourselves and others about the mechanism for dealing with viruses, malware, etc. It is not enough just to install antiviruses on smartphones and think that we are safe. It is also important to take care about which sites we visit, which apps we install, and to whom we give our phones. Right-time action is best to prevent any unwanted attacks and data leaking. Declaration of competing interest The authors declare that they have no known financial or non-financial competing interests in any material discussed in this paper. Funding information No funding was received from any financial organization to conduct this research. References [1] W. Jeon, J. Kim, Y. Lee, D. Won, “A practical analysis of smartphone security,” in Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics), 2011. [2] S. Haug, R. P. Castro, M. Kwon, A. Filler, T. Kowatsch, M. P. Schaub, “Smartphone use and smartphone addiction among young people in Switzerland,” J. Behav. Addict., 2015. [3] A. Das and H. U. Khan, “Security behaviors of smartphone users,” Inf. Comput. Secur., 2016. [4] A. Mylonas, A. Kastania, D. Gritzalis, “Delegate the smartphone user? Security awareness in smartphone platforms,” Comput. Secur., 2013. [5] W. Enck, D. Octeau, P. McDaniel, S. Chaudhuri, “A Study of Android Application Security,” in SEC (USENIX Security Symposium), 2011. [6] “Ten Steps to Smartphone Security (Android)”, https://www.fcc.gov/sites/default/files/12.14%20Mobile%20Security%20Tips%20%28Android%20- %20Links%29_0.pdf [7] “Mobile device security Understanding vulnerabilities”, https://www.shadowdetect.com/mobile-device-vulnerabilities/. [8] S. Farhan, M. Ali, M. Kamran, Q. Javaid, S. Zhang, “A Survey on Security for Smartphone Device,” Int. J. Adv. Comput. Sci. Appl., vol. 7, No. 4, 2016. [9] “Safer smartphones - a guide to keeping your device secure”, https://ico.org.uk/media2/migrated/1446/smartphone-securityv5.pdf [10] M. Alsaleh, N. Alomar, A. Alarifi, “Smartphone users: Understanding how security mechanisms are perceived and new persuasive methods“, PLOS ONE, Vol. 12, No. 3. 2017. [11] K. Bala, S. Sharma, G. Kaur, “A Study on Smartphone based Operating System,” Int. J. Comput. Appl., 2015. [12] J. H. Choi, H. J. Lee, “Facets of simplicity for the smartphone interface: A structural model,” Int. J. Hum. Comput. Stud., 2012. [13] C. Shen, Y. Li, Y. Chen, X. Guan, R. A. Maxion, “Performance Analysis of Multi-Motion Sensor Behavior for Active Smartphone Authentication,” IEEE Trans. Inf. Forensics Secur., 2018. [14] S. Zahid, M. Shahzad, S. A. Khayam, M. Farooq, “Keystroke-based user identification on smart phones,” in Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics), 2009. [15] C. C. Lin, C. C. Chang, D. Liang, C. H. Yang, “A new non-intrusive authentication method based on the orientation sensor for smartphone users,” in Proceedings of the 2012 IEEE 6th International Conference on Software Security and Reliability - SERE, 2012. [16] Venkatesh, Morris, Davis, Davis, “User Acceptance of Information Technology: Toward a Unified View,” MIS Q., 2003. DSS Vol. 5, No.2, 2024, pp. 108-114 114 [17] I. Muslukhov, Y. Boshmaf, C. Kuo, J. Lester, K. Beznosov, “Understanding users’ requirements for data protection in smartphones,” in Proceedings - 2012 IEEE 28th International Conference on Data Engineering Workshops - ICDEW, 2012. [18] I. Muslukhov, “Survey: Data Protection in Smartphones Against Physical Threats,” Term Project Papers on Mobile Security, University of British Columbia, 2012. [19] Y. Zou, J. Zhu, X. Wang, L. Hanzo, “A Survey on Wireless Security: Technical Challenges, Recent Advances, and Future Trends,” Proceedings of the IEEE, 2016. [20] O. Ugus, D. Westhoff, H. Rajasekaran, “A leaky bucket called smartphone,” in 2012 IEEE International Conference on Pervasive Computing and Communications Workshops, PERCOM Workshops, 2012. [21] M. La Polla, F. Martinelli, D. Sgandurra, “A survey on security for mobile devices,” IEEE Commun. Surv. Tutorials, 2013. [22] A. Houmansadr, S. A. Zonouz, R. Berthier, “A cloud-based intrusion detection and response system for mobile phones,” in Proceedings of the International Conference on Dependable Systems and Networks, 2011. [23] C. Guo,H. J. Wang, “Smart-Phone Attacks and Defenses,” Microsoft Res., 2007. [24] E. Dondyk, C. C. Zou, “Denial of convenience attack to smartphones using a fake Wi-Fi access point,” in 2013 IEEE 10th Consumer Communications and Networking Conference, 2013. [25] A. Pereira, M. Correia, P. Brandão, “USB connection vulnerabilities on android smartphones: Default and vendors’ customizations,” in Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics), 2014. [26] J. Khan, H. Abbas, J. Al-Muhtadi, “Survey on mobile user’s data privacy threats and defense mechanisms,” in Procedia Computer Science, 2015. [27] M. Becher, F. C. Freiling, J. Hoffmann, T. Holz, S. Uellenbeck, C. Wolf, “Mobile security catching up? Revealing the nuts and bolts of the security of mobile devices,” in Proceedings - IEEE Symposium on Security and Privacy, 2011. [28] A. Apvrille, “The evolution of mobile malware,” Computer Fraud and Security, 2014. [29] Kaspersky Lab, “Kaspersky Lab discovers ZooPark, an Android-based malware campaign, Kaspersky Lab US,” KAspersky Lab, 2018. [30] M. Ibrahim, G. Supayah, J. Bin Ibrahim, “Mobile Security And Privacy In Smartphone Technology”, International Journal of Computer Science and Information Technology Research, Vol. 3, No. 4, 2015. [31] M. A. Bari, S. Ahamad, M. R. Ali , “Smartphone Security and Protection Practices”, International Journal of Engineering and Applied Computer Science (IJEACS), Vol. 3, No. 1, December 2021. [32] Z. Muhammad, Z. Anwar, A.R. Javed, B. Saleem, S. Abbas, T.R. Gadekallu, “Smartphone Security and Privacy: A Survey on APTs, Sensor-Based Attacks, Side-Channel Attacks, Google Play Attacks, and Defenses”, Technologies, Vol. 11, No. 3, 2023. [33] N. J. Siddiqui, “The Study of Smartphones Security and Privacy”, International Journal of Advanced Research in Science, Communication and Technology (IJARSCT), Vol. 2, No. 6, 2022. [34] “Privacy and data protection in mobile applications: A study on the app development ecosystem and the technical implementation of GDPR”, European Union Agency For Network and Information Security, 2017. [35] R. Mueller, S. Schrittwieser, P. Fruehwirt, P. Kieseberg, E. Weippl, “Security and privacy of smartphone messaging applications”, International Journal of Pervasive Computing and Communications, Vol. 11, No. 2, 2015.