Mon, 08 Feb 2010 by Craig H
This post is about trustworthiness (security in a broad sense) and specifically about reliability.
I see increasingly frequent suggestions that people should use their phones to monitor their health. This is, on the face of it, attractive; being an insulin-dependent diabetic, I carry a blood glucose meter with me pretty much everywhere, and in line with the general trend of convergence (calculator, camera, music player, radio, etc.) wouldn’t it be great if that was built in to my phone?
Well yes, that would be very convenient, but I’m afraid I think it’s a fundamentally bad idea.
Read the rest of this entry »
Posted in Applications, Risks | Leave a Comment »
Thu, 28 Jan 2010 by Craig H
This week we’ve published the first full version of the Symbian Platform Security Roadmap and Strategy. It’s by no means set in stone, so any and all comments and suggestions are welcome (either in the Security forum or using the comment facility on the wiki page).
I have taken some liberties with the format and tagged on a longish “wish list” of items Open for Contribution at the end. I’d particularly like to draw attention to the last four, which are opportunities for concerned individuals or organisations to address some consumer protection issues (which our traditional contributors probably won’t address).
I did allude to this six months ago, but this time I’ll be shorter and more to the point: 
- Notarised Call Recording
how to hold faceless utility companies to account?
- Pre-Advice of Premium-Rate Charges
think twice before giving your money away?
- Privacy Labels
how not to embarrass yourself on social networking sites?
- Vendor Relationship Management
how to do e-commerce on your terms?
Volunteers welcome 
Posted in Uncategorized | Leave a Comment »
Mon, 04 Jan 2010 by Craig H
I can’t let Karsten Nohl’s presentation at 26C3 go without comment. To be clear, he was only talking about weaknesses that were already known (so headlines like “Secret mobile phone codes cracked” are at best misleading) but his purpose was to demonstrate that those theoretically known attacks are now practical. His point is a very valid one, and holds for most (all?) cryptographic algorithms: researchers will discover more efficient attack techniques, and technology will evolve to make such attacks practical, so you’d better design your cryptographic protocols so you can switch to different algorithms if and when the future need arises.* Happily this is the case for the GSM protocols, and all (!) that is needed is for the phone manufacturers and network operators to deploy the A5/3 algorithm and we can all go about our business.
That said, there is an interesting point made, almost in passing, in the presentation. Read the rest of this entry »
Posted in Applications, Network Protocols, Privacy | 2 Comments »
Wed, 02 Dec 2009 by Craig H
I don’t often get SMS spam (maybe once a month on average) but it really feels like an intrusion when I do. What I get are usually borderline scams of the “you have won a prize” or “our records indicate you are due compensation for your recent accident” type. I really think that replying to these things (even with “STOP” as they suggest) is only going to encourage them, so I did some investigation about what can be done. I’m in the UK, so I’m going to talk about what to do in the UK, but if anyone can add to this with advice for other countries please do so in the comments!
Read the rest of this entry »
Posted in Spam | 4 Comments »
Mon, 23 Nov 2009 by Craig H
There have been various reports over the weekend of a new development of the “Ikee” iPhone worm that now collects banking details. It is being reported as a “botnet“, which seems to be a popular term with journalists (possibly because it appeals to “Rise of the Machines” type scare-mongering ).
I’ve been quite sceptical about such reports since this July when the “Sexy View” malware on the Symbian Platform was reported as the “first mobile botnet“. Now in my view that wasn’t even a proper worm (it had to be manually installed by the user on every phone it spread to) and definitely not a botnet (there was no remote control of the malware after it was installed), so is there any more truth in these latest reports?
According to F-Secure’s initial analysis, the latest iPhone malware connects to an IP address in Lithuania, and downloads something from it, but it’s not clear from that what the thing it downloads is, or what it does with it. Although they call the IP address a “command & control center”, I remain sceptical, and would like to see some more details before conceding that this actually is the “first mobile botnet”…
Posted in Uncategorized | 1 Comment »
Fri, 06 Nov 2009 by Craig H
We’ve been trying to get a Security Strategy Working Group going, and thus far it hasn’t really taken off. Chatting with various people about this, we’ve decided that, following Symbian’s principles of open governance, we should be brave and open the discussions to the world at large.
Do please note that this is not a commitment to full disclosure of unfixed security vulnerabilities; the point of this working group is, among other things, to discuss what the right policy should be for dealing with vulnerabilities. I (Craig) favour responsible disclosure, but that’s up for discussion.
If you have an opinion on the work items (and you really should, they will affect device manufacturers, security researchers, network operators, package owners and committers, security tools vendors and anyone who even uses a Symbian Platform device) then please sign up for the mailing list!
Posted in Open Source, Vulnerabilities | Leave a Comment »
Thu, 05 Nov 2009 by Craig H
Posted in People | Leave a Comment »
Mon, 19 Oct 2009 by Craig H
Posted in People | Leave a Comment »
Thu, 15 Oct 2009 by Craig H
We are forming a working group to decide what the Symbian community’s strategy should be in dealing with security issues on the Symbian Platform. This is an example of Symbian’s commitment to open governance, and membership of this working group is open to any Symbian Foundation member.
There are some interesting challenges, both in the operation of this working group and in the operation of whatever processes the working group decides should be put in place, arising from the tension between the desire for openness in our dealings with the community and the harm that could be caused by disclosing security vulnerabilities to the world before a fix or workaround is available.
Full details of the remit of the working group are on the Symbian Developer wiki. We already have several working group members signed up, and if you are a Symbian Foundation member and would like to participate, please go ahead and join in!
Posted in Open Source, Vulnerabilities | 1 Comment »
Wed, 07 Oct 2009 by Craig H
I thought it would be a good idea to introduce the package owners in the security technology domain; these good people don’t work for the Symbian Foundation, but they do work very hard on the Symbian Platform code, and deserve public recognition for that .
We thought we’d try an interview format for these introductions, and Santosh Patil, owner of the OS Security package, bravely volunteered to be the first up.
Read the rest of this entry »
Posted in People | Leave a Comment »
Subscribe to SF Security Blog posts
