Gartner: Lost Phone Leading Cause Data Loss

The physical loss of phones and tablets as well as the installation of 'leaking' apps are still the largest mobile threat and main cause of data loss on mobile devices. This enables market researcher Gartner.While the threat has remained the same, the consequences are changed.

Mobile devices now storing more sensitive data and can also access more confidential data. So doctors are increasingly using tablets to handle sensitive patient data. In the financial world, for example traders use their smartphone to exchange sensitive information. If the device gets into the wrong hands and it is not properly secured, this can be the cause of a large data breach.

Regarding the threat of apps, Gartner states that most apps are very intrusive and ask for permission to access contact lists, personal information, and location. Another possibility is that employees use personal file sharing apps for business documents. Most of these apps are not malicious, but offer no protection at company level. According to Gartner, it often leaks apps credentials or have to deal with other security incidents, which could eventually lead to data leakage in the company.

Malware

Despite the risks of physical loss and leaky apps, too many companies focus on protecting against malware, according to Gartner. The mobile malware is mainly focused on consumers, and although there are cell attacks that can be used against businesses, these attacks have not yet provided specific incidents. Gartner advises companies also to take various measures to prevent mobile data breaches. So there must first be a company security policy.

This involves rules passcodes, such as length and complexity and the number of login attempts. Also demands are made ​​on current versions of platforms and operating systems. Companies will have models that are no longer supported or prohibit update. It should also jailbreaking and rooting of devices are prohibited, as well as the use of unapproved marketplaces. The emphasis should be on companies to prevent data leakage through physical loss or leaking apps, says research director Dionisio Zumerle.

Researchers Hack Corvette Via SMS

A vulnerability ( pdf ) in a dongle which is used by insurance companies and fleet managers to monitor cars remote makes it possible for attackers to operate all kinds of parts via SMS. That the researchers today at the Usenix Security Conference show in Washington.

The C4 OBD2 dongle of the French Mobile Devices makes it possible to monitor the location, speed and efficiency of vehicles. The devices are plugged into the diagnostic port (OBD-II) of the car, that is usually located under the steering wheel.The device features a GPS receive, mobile phone chip and onboard microprocessor. If the car driving is the dongle communicates with CAN bus of the car. This is the internal network that controls the physical components of the car.

The dongle then sends information from the car via the GSM network to the provider. Researchers at the University of California managed by sending text messages to the dongle to control the CAN bus of the car. For their demonstration, the researchers used a red Corvette, as in the video below shows. Via text message, they could eventually turn the brakes and turn off and turn on the windshield wipers.

Update

The US insurance company which distributes the Metro Mile dongles in the US was warned in June by investigators for the leak. Both Mobile Devices as Metro Mile argue that they have rolled out an update that automatically over-the-air is installed.The CERT Coordination Center (CERT / CC) at Carnegie Mellon University warns that there is no way to verify that the update is installed.

Users who do not know whether their dongle is vulnerable therefore be advised to remove the device until the update can be confirmed. Through the leak, an attacker can cause damage to the car or provide human injury, according to the CERT / CC.According to Wired would still driving thousands of vulnerable cars, mainly in Spain.

IEEE And IETF Test Privacy MAC Address

To prevent consumers via the MAC address of their smartphone or other mobile devices have followed the IEEE (Institute of Electrical and Electronics Engineers) and IETF (Internet Engineering Task Force) held several successful experiments, so both organizations this week let know . The IEEE and IETF are two organizations involved in the development of standards.

During the experiment in November was tested with random MAC addresses. Participants had to run a script that made ​​they got a random MAC address if they were connected to the network. A MAC address serves as a unique identifier on the local network and is assigned by manufacturers to network. Because of the unique feature of the MAC address, that is continuously broadcast by mobile devices, for example, stores use it to track people.

Privacy Implications

Because of the privacy implications decided the IEEE and IETF last year the IEEE 802 Executive Committee Privacy Study Group to focus on. This group looks at the impact of Wi-Fi technology and is working on recommendations and standards."From the beginning IEEE 802 and IETF have shared conviction to address the privacy risks for non-technical users, who live in a world of continuous connectivity is present," said Juan Carlos Zuniga, president of the group. According to him, the experiments show that there are viable ways to protect users from Wi-related privacy risks.

"The IETF community sees widespread monitoring as an attack on the privacy of Internet users," Joel Jaeggli IETF adds. He argues that the IETF and IEEE 802 itself will work to protect users from passive observation. "Successful tests with MAC address privacy implementations help solve a major problem with the visibility of Layer 2 identifiers on a shared local network," Jaeggli further notes. The results can be used to establish new standards. Whether this will happen and when exactly allow both organizations do not know. Last year Apple came with a measure to provide users with a random MAC address when scanning Wi-Fi networks.