6.1 Mobile Security (Security Management issues)

Question 1

Describe the capabilities of a mobile device

Answer 1

Powerful computers & communication devices
Storage processing & other capabilities (location functions, camera / video, calendar, clock)
Very useful tools for work & social activity

Question 2

What are the possible peculiar permission requests in terms of dangerous permissions?

Answer 2

CALL_Phone
GET_Accounts
INSTALL_Packages
MANAGE_Accounts
READ_Contacts
WRITE_Contacts
WRITE_Calendar

Question 3

What are the possible peculiar permission requests in terms of initial findings?

Answer 3

Case of security apps
Case of children’s gaming apps
Case of gaming apps

Question 4

What are the elements of a Feature Phone?

Answer 4

Fixed set of features

Handset capabilities can’t be added or improved

Question 5

What are the elements of a Smartphone?

Answer 5

Capabilities can be improved
Customised via updates
Increases functionality

Question 6

Where can (data) evidence be located?

Answer 6

Data can be physically stored in 3 different locations (SIM, Handset, Memory Card)
Some types of data can be found in more than 1 location (contacts on SIM & handset, pictures on handset & memory card)

Question 7

Describe the Identification of mobile security

Answer 7

Securing & evaluating the scene (identify all related evidence)

1. If the device is off, leave it off (remove battery - keep with the phone)
2. If device is on, leave it on
3. 1 Switch to airplane mode
4. 2 Change autolock to never
5. 3 Use cellular network isolation card to replace SIM card; put device in Faraday bag
6. 4 Gather all password information

Question 8

Describe the Preservation of mobile security

Answer 8

Mobile technology data = volatile (data can be lost by)
User selective deletion
App/OS updates
Factory reset simple & effective
Remote wipe capability

Deleted data may not be recoverable
Security on the device
Wear levelling of NAND technology

Question 9

Describe the Collection of mobile security

Answer 9

Mobile devices need to be identified by the make, model, and service provider
Logical imaging copies active file system (only the allocated data) from device to another file
Physical acquisition creates a bit by bit copy of data storage - used to recover deleted data
Acquisition tools (Paraben (SIM card), Encase, XRY, Oxygen)