Mobile Security and Privacy :Advances, Challenges and Future Research Directions

Publication subTitle :Advances, Challenges and Future Research Directions

Author: Au   Man Ho;Choo   Raymond  

Publisher: Elsevier Science‎

Publication year: 2016

E-ISBN: 9780128047460

P-ISBN(Paperback): 9780128046296

Subject: TP3 Computers;TP301.6 algorithm theory;TP309 安全保密;TP31 computer software

Keyword: 安全保密,自动化技术、计算机技术

Language: ENG

Access to resources Favorite

Disclaimer: Any content in publications that violate the sovereignty, the constitution or regulations of the PRC is not accepted or approved by CNPIEC.

Description

Mobile Security and Privacy: Advances, Challenges and Future Research Directions provides the first truly holistic view of leading edge mobile security research from Dr. Man Ho Au and Dr. Raymond Choo—leading researchers in mobile security. Mobile devices and apps have become part of everyday life in both developed and developing countries. As with most evolving technologies, mobile devices and mobile apps can be used for criminal exploitation. Along with the increased use of mobile devices and apps to access and store sensitive, personally identifiable information (PII) has come an increasing need for the community to have a better understanding of the associated security and privacy risks.

Drawing upon the expertise of world-renowned researchers and experts, this volume comprehensively discusses a range of mobile security and privacy topics from research, applied, and international perspectives, while aligning technical security implementations with the most recent developments in government, legal, and international environments. The book does not focus on vendor-specific solutions, instead providing a complete presentation of forward-looking research in all areas of mobile security.

The book will enable practitioners to learn about upcoming trends, scientists to share new directions in research, and government and industry decision-makers to prepare for major strategic decisions regarding implementation of mobile technology security and privacy.

Chapter

Chapter 2: Mobile Security: A Practitioner’s Perspective

1 Mobile Security

1.1 Global Growth in Mobile Use

2 Principles

3 Application Stores

4 Approved Applications

4.1 App Containerization

4.2 Software Watermarking

4.2.1 Online-Based Services (Accessible Via Mobile)

5 Identity Management Issues

6 Privacy

6.1 The Need for Privacy

6.2 Privacy Implications

7 Vulnerabilities

8 Threats

8.1 Application-Based Threats

8.1.1 Malware

8.1.2 Electronic Tracking (Spyware or Adware)

8.1.3 Vulnerable Applications

8.1.4 Ransomware

8.2 Internet-Based Threats

8.2.1 Denial of Service (DoS)/Distributed Denial of Service (DDoS) Threats

8.2.2 Bots

8.2.3 Advanced Persistent Threats (APTs)

8.2.4 Phishing Scams

8.2.5 Social Engineering

8.2.6 Drive-By Downloads

8.2.7 Browser Exploits

8.3 Network Threats

8.3.1 Network Exploits

8.3.2 Electronic Eavesdropping Such as Wi-Fi Sniffing and Bluetooth/Bluejacking

8.3.3 Location Detection

8.3.4 Hotel or Conference Facility Networks

8.4 Physical Threats

8.4.1 Stolen Data Due to Loss, Theft, or Disposal of Devices

8.4.2 Unauthorized Access

8.4.3 Gifting

8.5 Travel Threats

8.6 Unintentional Disclosure of Data Threats

9 Risks

10 Mobile Security Strategy for Organizations that Develop Mobile Applications

10.1 Architecture

10.2 Basic Device Management

10.3 Secure Software Development Life Cycles (SDLC)

10.4 Data Validation

10.4.1 Developer Training

10.4.2 Session Management

10.4.3 Cryptography

10.4.4 Data Confidentiality

10.4.5 Environmental and Biometric Sensors

10.4.6 App Penetration Testing

10.4.7 Handle Identity Management

User Authentication

Device Authentication

Device Access Control

10.4.8 Bring Your Own Device (BYOD)

10.4.9 Mobile Device Management

10.4.10 Mobile Application Management

10.4.11 Decommissioning

10.4.12 Auditing

11 Mitigations

11.1 Exploit Mitigation

11.2 Travel Mitigation

12 Mobile Security Technical Controls

12.1 Passwords, Passphrases, and Biometrics

12.2 Encryption

12.2.1 Code Encryption

12.2.2 Data Encryption

Local

Cloud

Key Management Design

Chain of trust

Master key

User-supplied PIN/Passphrase

Key Stores

12.2.3 Key Management

12.3 VPN

12.4 User Training

12.5 Jailbreaking and Rooting

12.6 Patching

12.7 Asset Management

12.8 Mobile Device Management

12.8.1 Inventory

Device Inventory

Inventory Classification

Inventory Maintenance

Physical Tracking

Database Integration

12.8.2 Device Eligibility

12.8.3 Device Registration/User Enrolment

12.8.4 Lockout screen

12.8.5 Policy

12.8.6 BYOD vs. Choose Your Own Device (CYOD)

12.8.7 Remote Wiping BYOD Devices

12.9 Mobile Application Management

12.10 Remote Track and Wipe

12.11 Antivirus/Antimalware

12.12 Transmission Security

12.13 Mobile Usage Controls

12.13.1 Usage Controls

12.13.2 Content Filtering

12.13.3 Location and Monitoring Settings

12.14 Memory

12.15 Cross-Border Data Theft

12.16 Regulatory Retention

13 Forensics

14 Summary

15 Mobile Device Security Resources

Acknowledgments

References

Glossary

Chapter 3: Mobile Security: End Users are the Weakest Link in the System

1 Definition: Security “Internetwork”

2 Growth of Smartphone Breaches

3 Organization Internetwork Security

4 Individual Internet Security

5 Conclusion

Reference

Chapter 4: How Cyber-Savvy are Older Mobile Device Users?

1 Introduction

1.1 Contributions

1.2 Chapter Outline

2 Survey Design

3 Findings and Discussion

4 A Situational Crime Prevention Approach

5 Conclusion

Acknowledgments

References

Chapter 5: The Role of Mobile Devices in Enhancing the Policing System to Improve Efficiency and Effectiveness: A Practiti ...

1 Introduction

2 Interactive Constable on Patrol System

3 Capabilities

3.1 Information Management and Knowledge Exchange

3.2 Intelligent Personal Assistant—Bobby

3.3 Communications

3.4 Custody Management

3.5 Situational Awareness

3.6 Biometrics

3.6.1 Facial Recognition

3.6.2 Iris Recognition

4 Conclusion

References

Chapter 6: Supervised Learning Based Detection of Malware on Android

1 Permission Background

1.1 Limitations of Permission Model

2 Malware Landscape

2.1 Malware Techniques

2.1.1 Repackaging

2.1.2 Update Attack

2.1.3 Drive-by Downloads

2.1.4 Remote Control

2.2 Tools for Malware Detection

2.2.1 Firewall

2.2.2 Intrusion Detection Systems

2.2.3 Antiviruses

3 Machine Learning

3.1 Concepts

3.1.1 Dataset

3.1.2 Attributes and Classes

3.1.3 The Classification Model

3.1.4 Performance of Classification Models

3.1.5 Performance Evaluation of a Classifier

3.2 Related Works: Machine Learning and Permissions

3.2.1 Permission Analysis

3.2.2 Individual Permissions

3.2.3 Combinations of Permissions

3.2.4 Machine Learning Techniques

3.2.5 Limitations

3.2.6 Enhancements

4 Characterization and Detection With the Consideration of User Security Specifications

4.1 Sampling

4.1.1 Applications for Learning Detection

4.1.2 Applications for System Validation

4.1.3 Reengineering

4.2 Layer 1

4.2.1 Definitions

4.2.2 Determination of Discriminating Metrics

4.2.3 Translation Into Vector Space

4.3 Layer 2

4.3.1 Risk and Category Definitions

4.3.2 Translation Into Vector Space

4.4 Layer 3

4.5 Preliminary Learning

4.6 Extracted Rules

4.7 Classifier

4.8 User Participation

5 Implementation

5.1 Interfaces

6 Evaluation and Discussion

6.1 Detection Performance

6.1.1 Model Validation

6.2 Comparison Between Layer Models

6.3 Detection of Malware Families

6.4 Antivirus Scanners

6.5 Related Works

6.6 Limitations

7 Conclusion and Perspectives

Appendix A Different Combinations of Permissions and Determination of Risks

Appendix B Normal Applications for Testing

Acknowledgments

References

Chapter 7: On Discovering Vulnerabilities in Android Applications

1 Introduction

2 Background

2.1 Security Mechanisms of Android

2.2 Taxonomy of Android App Vulnerability

2.3 VulHunter

3 Modeling Common Vulnerabilities

3.1 Insecure Data Storage

3.2 Insufficient Transport Layer Protection

3.3 Unintended Data Leakage

3.4 Poor Authorization and Authentication

3.5 Broken Cryptography

3.6 Webview Vulnerability

3.7 App Communication Vulnerability

3.8 Configuration Error Vulnerability

4 Discovering Vulnerabilities

4.1 Static Analysis-Based Approaches

4.2 Dynamic Analysis-Based Approaches

4.3 Hybrid Approaches

5 Discussion

5.1 Limitations in Static Analysis-Based Methods

5.2 Limitations in Dynamic Analysis-Based Methods

5.3 Future Directions

6 Summary

References

About The Authors

Chapter 8: A Study of the Effectiveness Abs Reliability of Android Free Anti-Mobile Malware Apps

1 Introduction

2 An Overview of Android

2.1 The Android OS

2.1.1 System Framework and Architecture

2.1.2 Security Architecture

2.1.3 Vulnerabilities

2.1.4 Rooted Android Devices

2.2 Android Application Security

2.2.1 App Permissions

2.2.2 Component Permissions

2.2.3 Signing Apps

2.2.4 Privacy

2.3 Android Malware Threats and Countermeasures

2.3.1 Antimalware

2.3.2 Firewall

2.3.3 Intrusion Detection System

2.3.4 App Certification

2.3.5 Selective Access Control

2.3.6 Context-Aware Security

2.3.7 Data Encryption

3 Experiment Setup

3.1 Experiment Process

3.2 Metrics

4 Findings

5 Conclusion and Future Work

Conflict of Interest Declaration

References

Chapter 9: Timeline Analysis for Digital Evidence on MTK-Based Shanzhai Mobile Phone

1 Introduction

2 Related Work

3 Digital Evidence in Shanzhai Phone

3.1 Physical Data Storage and Logical File System

3.2 Extracting Baseline Contents From Flash Dump of Shanzhai Phone

4 Timeline Analysis of the Digital Evidence

4.1 Deleted Contents and “Snapshots” in the Flash Dump

4.2 Timeline Analysis on Phonebook

5 Conclusion

Acknowledgments

References

Chapter 10: RESTful IoT Authentication Protocols

1 Introduction

2 REST Foundations

3 RESTful IoT Protocols

3.1 RESTful CoAP

3.2 RESTful RACS

4 Security for RESTful IoT Protocols

5 REST Message Authentication

5.1 REST Message Signature

5.2 REST Message Verification

6 RESTful IoT Message Authentication

6.1 RESTful CoAP Message Authentication (RECMA)

6.2 RESTful RACS Message Authentication (RERMA)

7 Conclusion and Outlook

References

Chapter 11: An Introduction to Various Privacy Models

1 Introduction

1.1 Organizations

2 Definition of k -Anonymity

3 Mechanisms That Support k -Anonymity

4 Differential Privacy

4.1 Overview

4.2 Definition of Differential Privacy

5 Laplace Mechanism to Achieve Differential Privacy

6 Conclusion

References

About The Authors

Chapter 12: Performance of Digital Signature Schemes on Mobile Devices

1 Introduction

1.1 Our Contribution

2 Related Work

3 The Experiment

3.1 Cryptographic Settings

3.2 Testing Environment

3.3 Experiment Results and Observations

4 Conclusion

Acknowledgments

References

About The Authors

Index

Back Cover

The users who browse this book also browse


No browse record.